3 ms·
Perhaps financial compensation was indeed not Cr4sh's motivation for this zero day, but I felt it's a stretch to call this disclosure responsible. Also his name
by devy 10y ago
Perhaps financial compensation was indeed not Cr4sh's motivation for this zero day, but I felt it's a stretch to call this disclosure responsible. Also his name-calling (ThinkPwn) campaign was inappropriate and premature when the root cause was later discovered in Intel's reference code and propagated to IBVs's products.
- __jal 10y agoName calling? Come on. I'm not really a fan of the trend of "branding" vulnerabilities, but it is just harmless silliness, and substantially less inflammatory than security industry smack-talking norms from not too long ago. Or put another way, I suggest adjusting your sensitivity before cracking open an issue of Phrack. And a serious question: in your view what would be a "responsible" way to release a multivendor exploit? Please describe the preconditions which would need to be met before you'd use the adjective.
- devy 10y agoGive the vendor a timeframe to investigate and resolve. Even sometimes ignores reports like this, at least give them the courtesy instead of expose this as an 0day.
- geocar 10y agoWhy? Lenovo put users at risk and public shaming is a tool to correct their behaviour. Lenovo could allow users to replace software on their machine, but presently choose not to because they might make less money. However if Lenovo are shamed, people might buy less of Lenovo's products, which will also make Lenovo less money.
- __jal 10y agoMy mistake - I had developed the impression that Lenovo was informed ahead of time. I had only skimmed at first. I had thought the complaint was about not waiting until what sounds like most of the PC OEMs stopped sitting on their thumbs. Please disregard that part of my response.
- wyldfire 10y ago> I'm not really a fan of the trend of "branding" vulnerabilities, but it is just harmless silliness It's probably harmless but I'm not so sure it's silly. It's much more distinguishing than monikers like "CVE-2016-0093". It can sometimes convey the seriousness of the relevant exploit (not sure if that's the case this time though). These branded-vulnerabilities are also probably much more valuable on a CV as such.
- __jal 10y agoSure. "Silly" is in the eye of the beholder, of course, and I do think successfully executing the "launch" of an exploit is probably a great career move. I still think it is silly. I'm less convinced the trend has any use for communicating seriousness. I don't expect product names (basically what this is) to meaningfully convey actionable information in any trustworthy way. But I'll reconsider next time I see a car named "Cheap, mostly-OK vehicle with probable future maintenance headaches" or an exploit named "Smasher of stacks of a little-known utility optionally installed alongside Enterprise Product X, so long as these 7 unlikely preconditions are met".
- admax88q 10y agoI'm much more upset with the vendors that thought UEFI was a good idea and pushed it, than security researches who discover vulnerabilities in UEFI, no matter how they choose to disclose it.
- subway 10y agoUEFI vs BIOS itself isn't the issue. UEFI, the specificaiton, is really a nice interface to the hardware. The issue is with specific implementations of UEFI, and the fact that UEFI firmware vendors (much like traditional BIOS firmware vendors) can churn out hacky code and nobody is the wiser.