6 ms·
> Personally, I would've released the PoC back in July when they said the problem was resolved. Dropping a zero day on the public is never acceptable, regardle
by ajross 4y ago
> Personally, I would've released the PoC back in July when they said the problem was resolved.
Dropping a zero day on the public is never acceptable, regardless of how disingenuous a device manufacturer is being. Bug disclosure without a known remedy has to be an absolute last resort kind of thing, and it's actually a little upsetting that modzero used that tactic as a kind of threat ("As the issue was not considered valid, we informed CrowdStrike that we would release the advisory to the public.")
- matheusmoreira 4y agoIt is absolutely acceptable. Corporate negligence harms everyone. If disclosing vulnerabilities is what it takes to force them to do something about them, so be it.
- buscoquadnary 4y agoReleasing information increases the transparency of the market, allowing customers to make informed decisions. To hide things is not beneficial to the customers. Always assume a bad guy has the 0-day before a security researcher.
- ndsipa_pomu 4y agoI think it's a reasonable progression if the company refuses to accept that the exploit is valid and won't open up equable discussion about it. Trying to force someone to sign an NDA is not really acceptable behaviour when someone is going out of their way to help the company (and their customers).
- vvillena 4y agoI'd argue any kind of vulnerability announcement, even a zero-day exploit, is better than having the vulnerability be exploited under the radar by malicious actors. The existence of an exploit allows people affected by the vulnerability to know there's a threat, and to act accordingly.
- outworlder 4y ago> Bug disclosure without a known remedy has to be an absolute last resort kind of thing, and it's actually a little upsetting that modzero used that tactic as a kind of threat I don't think it is upsetting at all. "We found a vulnerability" "There's no vulnerability" "No, you misunderstand, here's how it works and how to exploit" "Naah, no vulnerability" "Ok, if there's no vulnerability as you claim, you don't mind us releasing our findings to the public, right?"
- ajross 4y agoThe thing is, "releasing our findings to the public" puts the vendor's customers at risk, it's not just some imagined Just Punishment For The Guilty, innocents get hurt. Imagine if you took a new job and they had a bunch of hardware sitting around from such a vendor. Would you be OK if someone published an exploit for your systems? (In this case, the vulnerability seems minor, so it's sort of academic. But I'm not understanding the mindset of the people here who want to see this as a two party adversarial kind of relationship between Modzero and CrowdStrike. It's not!)
- detaro 4y agoYou can't let vendors hide security problems by just not doing anything about them. People deserve to know if the product they rely on has vulnerabilities, because just because you aren't exploiting it doesn't mean nobody else will find it. Modzero was even following a more conservative playbook here: not setting a deadline from the start, but only talking about release once the vendor indicated there was no issue (anymore).
- ajross 4y ago> You can't let vendors hide security problems by just not doing anything about them. Telling people that the product they rely on has vulnerabilities is clearly not the same thing as "release the vulnerability report" though, is it? I still remain amazed at the absolutism in the arguments here. There is a spectrum of responses that can be explored before dropping bombs. But everyone wants to see stuff burn?
- detaro 4y agoSo what is an appropriate point in time to release information about an issue the vendor claims doesn't exist?