Feeds

Verizon dubs sec researchers 'narcissistic vulnerability pimps'

In defense of full-disclosure

Internet Security Threat Report 2014

Updated In an official blog post, an employee in Verizon's Risk Intelligence unit has taken aim at researchers who disclose security flaws, calling them "Narcissistic vulnerability pimps" and comparing them to criminals.

"Have you ever heard of a terrorist referred to as a 'demolition engineer?'" the unnamed author of the rant asked, one presumes rhetorically. "How about a thief as a 'locksmith?' No? Well, that's because most fields don't share the InfoSec industry's ridiculous yet long-standing inability to distinguish the good guys from the bad guys."

The post goes on to propose that a person who discloses security flaws henceforth be labeled a "narcissistic vulnerability pimp," which the writer defines as "One who - solely for the purpose of self-glorification and self-gratification - harms business and society by irresponsibly disclosing information that makes things less secure."

Besides befuddling all the men in leopard fur coats and feather-laced hats, this comparison is problematic for other reasons. As the recent Pwn2Own contest made abundantly clear, software makers can't be counted on to secure their products, at least not on their own. Security researchers armed with real-world vulnerabilities provide an important check on internal security teams and give them a powerful incentive to be thorough in finding bugs and swift in fixing them.

Without people reporting bugs, the only people creating weaponized exploits in widely used products are those who regularly hack into Fortune 500 companies - and they don't show the courtesy of telling anyone afterward that the software they've attacked is defective.

To witness the power of vulnerability disclosure, witness the announcement security researcher "narcissistic vulnerability pimp" Tavis Ormandy made earlier this month about a flaw in the Java virtual machine that made it trivial for bad guys to install malware on end user machines.

In private discussions, Oracle told Ormandy the threat didn't warrant them issuing a fix outside of their next scheduled patch release in July. Five days after the bulletin was published, the vulnerability was fixed.

We're all for companies fixing their buggy products, and this includes Verizon. But until they can do it on their own, and in a timely manner, we'll continue to use the term "security researcher." ®

Update

We just got off the phone with Dave Kennedy, manager of risk analysis at Verizon Business, who expanded a bit on the blog post, which he said was written by his boss, Wade Baker, with Kennedy's assistance. He said full disclosure was never a good idea, even in cases, like Ormandy's dust-up with Oracle, where the company delays a fix for a vulnerability that endangers millions of users.

"I don't want to pick a fight with these guys," he said, meaning security researchers or, uh, narcissistic vulnerability pimps. "By arbitrarily releasing vulnerability information you are putting others at risk and you are putting yourself in the position of managing the time of the employees of the companies that own that software. It's a rationalization to say that Charlie Miller's in a better position to judge the vulnerabilities that OS X has than Apple.

"Apple has a responsibility to their shareholders and to their customers to deal with the vulnerabilities, and their shareholders and their customers can hold Apple's feet to the fire. They have their own ways of exerting pressure on Apple to behave in a way they think Apple should behave."

Of course, if the public remains in the dark about gaping vulnerabilities that go unfixed for months or years - which is an inevitable outcome of the world Kennedy would have us all live in - it's questionable how shareholders and customers could be informed enough to take action. But hey, it sure would make life easier on the software makers, wouldn't it?

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.