Feeds

Verizon dubs sec researchers 'narcissistic vulnerability pimps'

In defense of full-disclosure

Secure remote control for conventional and virtual desktops

Updated In an official blog post, an employee in Verizon's Risk Intelligence unit has taken aim at researchers who disclose security flaws, calling them "Narcissistic vulnerability pimps" and comparing them to criminals.

"Have you ever heard of a terrorist referred to as a 'demolition engineer?'" the unnamed author of the rant asked, one presumes rhetorically. "How about a thief as a 'locksmith?' No? Well, that's because most fields don't share the InfoSec industry's ridiculous yet long-standing inability to distinguish the good guys from the bad guys."

The post goes on to propose that a person who discloses security flaws henceforth be labeled a "narcissistic vulnerability pimp," which the writer defines as "One who - solely for the purpose of self-glorification and self-gratification - harms business and society by irresponsibly disclosing information that makes things less secure."

Besides befuddling all the men in leopard fur coats and feather-laced hats, this comparison is problematic for other reasons. As the recent Pwn2Own contest made abundantly clear, software makers can't be counted on to secure their products, at least not on their own. Security researchers armed with real-world vulnerabilities provide an important check on internal security teams and give them a powerful incentive to be thorough in finding bugs and swift in fixing them.

Without people reporting bugs, the only people creating weaponized exploits in widely used products are those who regularly hack into Fortune 500 companies - and they don't show the courtesy of telling anyone afterward that the software they've attacked is defective.

To witness the power of vulnerability disclosure, witness the announcement security researcher "narcissistic vulnerability pimp" Tavis Ormandy made earlier this month about a flaw in the Java virtual machine that made it trivial for bad guys to install malware on end user machines.

In private discussions, Oracle told Ormandy the threat didn't warrant them issuing a fix outside of their next scheduled patch release in July. Five days after the bulletin was published, the vulnerability was fixed.

We're all for companies fixing their buggy products, and this includes Verizon. But until they can do it on their own, and in a timely manner, we'll continue to use the term "security researcher." ®

Update

We just got off the phone with Dave Kennedy, manager of risk analysis at Verizon Business, who expanded a bit on the blog post, which he said was written by his boss, Wade Baker, with Kennedy's assistance. He said full disclosure was never a good idea, even in cases, like Ormandy's dust-up with Oracle, where the company delays a fix for a vulnerability that endangers millions of users.

"I don't want to pick a fight with these guys," he said, meaning security researchers or, uh, narcissistic vulnerability pimps. "By arbitrarily releasing vulnerability information you are putting others at risk and you are putting yourself in the position of managing the time of the employees of the companies that own that software. It's a rationalization to say that Charlie Miller's in a better position to judge the vulnerabilities that OS X has than Apple.

"Apple has a responsibility to their shareholders and to their customers to deal with the vulnerabilities, and their shareholders and their customers can hold Apple's feet to the fire. They have their own ways of exerting pressure on Apple to behave in a way they think Apple should behave."

Of course, if the public remains in the dark about gaping vulnerabilities that go unfixed for months or years - which is an inevitable outcome of the world Kennedy would have us all live in - it's questionable how shareholders and customers could be informed enough to take action. But hey, it sure would make life easier on the software makers, wouldn't it?

New hybrid storage solutions

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.