Responsible disclosure or a cash cow ?

phenomlab

If there’s one thing that saddens me working in the information and infrastructure security arena, it’s the abuse of “disclosure” - or better known as irresponsible disclosure. Those operating under the banner of “security researcher” (in my view) have a moral obligation to disclose any flaw or vulnerability they may find to the application author with a proof of concept and provide them sufficient time to remediate it. To quantify this, a security researcher using an irresponsible method to disclose a vulnerability they have identified would be the same as a penetration tester discovering it, then posting it on the dark web for others to exploit - making a quick profit in the process - and then not informing their client. Admittedly, this is exactly what non disclosure agreements were created for, so the latter scenario is an unlikely one. However, a security researcher isn’t bound by the same agreement.

Quite a few times over my career I’ve seen irresponsible disclosure in a variety of forms. Some range from giving the vendor 40 days to remediate the flaw before going public with the details, whilst others seem to make a vulnerability public when they realise there isn’t a bounty to collect. One side of me thinks that taking this route forces a vendor to be responsible for the security of their software, take it seriously, and remediate as soon as they are aware, whilst the other side of me thinks that this approach is irresponsible on the part of the researcher to publicly disclose a vulnerability without the vendors prior knowledge. In most cases I’ve seen, the vendor often either completely ignores the disclosure, forcing the researcher to take a more dramatic route, or they are totally unaware that a vulnerability in their software stack has been posted for others to exploit - then subsequently discover this via another channel (usually another security researcher).

As a white hat security researcher, it’s clear on which route I will take if I discover a vulnerability - along with the steps required to reproduce. I’m also not interested in the bounty (if applicable) - I’m more interested in protecting the security and rights of others when it comes to sensitive information. I understand that some are driven by gain in the momentary perspective, but where does a moral responsibility and obligation to a security community start and end ?

Interested in views.

Dave_Howe

It’s a complex topic.
Responsible Disclosure is a thing because, on the whole, Vendors proved time and time again they couldn’t be trusted. Standard response to a vuln report was, in order - Denial, Lawyering Up and threatening the researcher, then Including at best a fix in the next generation of the product, and not crediting the researcher, or in many cases, not fixing it at all.
So yeah (and this is before something like a bug bounty existed) RD established a number of things; a reasonable deadline for response (and a further, reasonable deadline for disclosure if the vendor didn’t fix it), a common repository for embargoed disclosures (CVE and similar) and a common policy on what would be demanded of the vendor (basically, a fix, and a public acknowledgement of the vuln and the role of the researcher in finding it)

Now, I generally approve of bug bounties (the info is valuable to vendors, and if independent researchers weren’t doing it, they would have to pay for that work to be done or only find out after criminals started exploiting it) and note they started out fairly small (a t-shirt and other merch, licences to software and so forth) and have grown over time to the point there are third parties that can make a living just managing those programmes for companies)

Bug bounties DO have three problems though. The first is, as you say, that some classes of researcher will deliberately bounty-hunt and concentrate on what gives the best bounty, which skews the goals a bit.

The second is that many vendors say “you must follow OUR rules or lose the bounty” which can mean a bug goes unpatched for a year or more, because the vendor doesn’t want the negative publicity or wants to wait for a model to end-of-life so they don’t have to patch it.

The third is “fairness” - a lot of researchers will feel resentful when they report a serious bug to a programme only to be told “oh, we decided that is out of scope and won’t pay for it, but thanks for finding it for us!” - and will instead just disclose the next bug they find (and they will go out of their way to find a related bug the vendor didn’t patch) purely due to their grudge.

Money ALWAYS changes the game.

phenomlab

Dave_Howe Some great points here - all of which are 100% valid, and along my lines of thinking. Personally, I fully agree in bringing a vendor to account, but I’d have to stop at dropping them in the sh!t either because they didn’t pay me for my time, or left that particular bug or vulnerability exposed without formally notifying users, and taking action to patch.

Money seems to speak the loudest and clearest language.

Dave_Howe

Yup. As I say, adding money to the equation has skewed motivations, but also given back vendors more control (because those who hold the purse strings, control the outcome)

phenomlab

Dave_Howe Agreed. There is a positive, but there’s also still the negative of a supposed researcher who “defects to the dark side” because he or she can make more money selling that same vulnerability on the dark web. I’m not alluding to all researchers having criminal intent of course, but seeing as money is a primary driver…

Dave_Howe

You could also take the viewpoint that having a “clean” source of money (bug bounties) could offset that “dark” source…

phenomlab

Dave_Howe You could also take the viewpoint that having a “clean” source of money (bug bounties) could offset that “dark” source…

That’s also true. A great casing point.