Difference between revisions of "Full vs. Responsible Disclosure of Vulnerabilities"

Revision as of 22:29, 12 November 2005

• Wikipedia: Full Disclosure
• Google Scholar search
• RFPolicy
• Vulnerability Disclosure
• Anti-hacking method of full disclosure
• Windows of Vulnerability
• The vulnerability process: a tiger team approach to resolving vulnerability cases
• Bug hunters don't always play by same rules
• Vulnerability disclosure publications and discussion tracking

• Abstract

• Introduction
  • Terminlogy: product, flaw, vulnerability, exploit, exploitation, discoverer, originator, coorinator, vendor, customer Vulnerability Disclosure
  • What are software/hardware vulnerabilities?
  • Definition of full disclosure and responsible disclosure
  • Purpose of disclosure
    • Publicity: Bug hunters want to be the first people to get credit for discovering new vulnerabilities. They like to show their talents and promote themselves. People like publicity and see their name in newspapers. [1] The media coverage a security company receives can mean substantial revenue in the form of new or larger customer contracts. [2]
  • What kinds of peoples would discover the vulnerabilities? hobbyist hacker, expert, specialist
  • What kinds of peoples would take the advantage of vulnerabilities? vandal/script-kiddy, thief, spy
  • Window of exposure / vulnerability TimelineWindows of Vulnerability
    • undiscovered, experimentation/investigation, correction, packaging, deployment

• Type of Disclosure
  • Non Disclosure
  • Full Disclosure
    • For
      • Vendoris motivated to provide a timely patch or workaround to a new vulnerability.
      • Administrator might make use of exploit code to test for the existence of vulnerable systems. Exploit code may also be used to test the integrity of a patch that has been distributed to correct a vulnerability. Vulnerability Disclosure
    • Against
      • Developing a patch requires time to investigate, debug, and test. Not ony it requires time for the vendor, it also requires time for IT to test the patches before deployment.
      • As mentioned by one of the speakers on 11/9, hackers usually won’t go for discovering new vulnerabilities.
      • Not all administrators are knowledgeable to work with firewall and intrusion detection system (IDS) to build a temporary workaround to stop vulnerability.
  • Responsible Disclosure
    • For
    • Against

• Controversy (by discussing read world exmaples)
  • incident in 2000, public criticism of Internet Security System (ISS)
  • Responsible/limited disclosure can only delay the vulnerabilities since hackers can apply reverse-engineering to patches in order to understand the details.
  • Blaster worm, release patch on 7/16; exploit code available on 7/25; worm discovered on 8/11

• Existing Practice, Policies and Proposals
  • BugTraq
  • RFPolicy

• Government step in? Use of Law?
  • Maybe it is no good since the law can only apply to United State. Linux Update withholds security details

• Conclusion

• Once people discover vulnerabilities, how much should they disclose (full/partial)? Who should they disclose to (public/government/academic-research/manufacturer-only)? When should they disclose?
• What constitute a responsible disclosure?
• What is bad about full disclosure of vulnerabilities?
• Does it mean safe if people responsibly disclose the vulnerabilities?
• If the software/hardware manufacturer cannot fix the vulnerabilities in reasonable time, should the academic/research communities step in and help?
• Does “Open Source” necessarily mean full disclosure? Hmmm... Not necessary. If you don't tell people about the vulnerabilities, most people won't know it unless they dig into the code. We are talking about disclosure of vulnerabilities, not disclosure of entire source code.
• Comparing the disclosure of vulnerabilities to other non-cyber industries, i.e. health, environment, food...
• Discuss some examples/incidents of non-responsible disclosure and their result/affect.
• Should we have a public committee to manage/control the info flow of vulnerabilities?
• Should we do a better job on notifying/educating the public/consumers about vulnerabilities? Why people should care? What they should do?