5 ms·

> Bug disclosure without a known remedy has to be an absolute last resort kind of thing, and it's actually a little upsetting that modzero used that tactic as a

> Bug disclosure without a known remedy has to be an absolute last resort kind of thing, and it's actually a little upsetting that modzero used that tactic as a kind of threat I don't think it is upsetting at all. "We found a vulnerability" "There's no vulnerability" "No, you misunderstand, here's how it works and how to exploit" "Naah, no vulnerability" "Ok, if there's no vulnerability as you claim, you don't mind us releasing our findings to the public, right?"

ajross 4y ago
The thing is, "releasing our findings to the public" puts the vendor's customers at risk, it's not just some imagined Just Punishment For The Guilty, innocents get hurt. Imagine if you took a new job and they had a bunch of hardware sitting around from such a vendor. Would you be OK if someone published an exploit for your systems? (In this case, the vulnerability seems minor, so it's sort of academic. But I'm not understanding the mindset of the people here who want to see this as a two party adversarial kind of relationship between Modzero and CrowdStrike. It's not!)
- detaro 4y ago
  You can't let vendors hide security problems by just not doing anything about them. People deserve to know if the product they rely on has vulnerabilities, because just because you aren't exploiting it doesn't mean nobody else will find it. Modzero was even following a more conservative playbook here: not setting a deadline from the start, but only talking about release once the vendor indicated there was no issue (anymore).
  - ajross 4y ago
    > You can't let vendors hide security problems by just not doing anything about them. Telling people that the product they rely on has vulnerabilities is clearly not the same thing as "release the vulnerability report" though, is it? I still remain amazed at the absolutism in the arguments here. There is a spectrum of responses that can be explored before dropping bombs. But everyone wants to see stuff burn?
    - paulryanrogers 4y ago
      So what's the intermediate step on the spectrum? Publicly call out the vendor and model, yet vaguely enough that others will have to find the specific gap(s)? Tell the press? If one publicly discloses some mitigation it's usually enough to give malicious actors enough to go on anyway.
    - jeroenhd 4y ago
      Telling the customers that there's a vulnerability will make them turn to their vendor. The vendor will obviously lie and say there's no vulnerability, everything is fine, ignore the panic. Without the necessary details telling the public about a vulnerability is like shouting at a wall. Publishing the details forces vendors to release fixes when they deny the existence of the vulnerability. This isn't some hidden password or evil DoS attack, this is an attack only processes with admin access can leverage on infected machines. This command is either executed by a computer user (which should flag a warning in the management software) or it's executed by a virus with admin permissions that went undetected by the antivirus solution on the machine. The stakes are low enough and the vendor is irresponsible enough that I don't see a problem with publishing a PoC when vendors lie about these kinds of bugs. Of course remote exploitation and auth bypass PoCs shouldn't be released into the wild without trying to get a patch out first, but even still vendors like D-Link just don't seem to care if you don't at least threaten them with releasing the details to the public.
    - xphos 4y ago
      This kind of thinking does not protect customers though. We can all pretend there is no vulnerability but that does not mean there isn't a vulnerability. This is kind of "Don't look up" thinking. The spectrum here was they tried with the OEM and the OEM said let it burn by snubbing the researchers. The researchers than attempted to let customers know since the OEM did not want to protect them.
- xphos 4y ago
  I don't think its the job of Security Researchers to defend a OEMs customers. That's the OEMs job? If the OEM does not want to protect its customers after a research has literally given the vulnerability to them its no longer on the researcher. In fact its probably bad ethics for the researcher not to publish because just because there is no report does not mean the bug is not exploited or known by malicious actors. The researchers last recourse is to publish a notification to let the OEMs customers there is an issue since the OEM won't acknowledge it.
- paulryanrogers 4y ago
  > The thing is, "releasing our findings to the public" puts the vendor's customers at risk If vendor denies there is a problem despite repeated submissions of evidence then customers are already at risk indefinitely.
- matheusmoreira 4y ago
  > puts the vendor's customers at risk They were already at risk and didn't even know before disclosure. If anyone's to blame for anything, it's the corporation. They were told a vulnerability existed. If it got to the point people are releasing things to the public, it's certainly because they neglected to do what needed to be done.
- conioh 4y ago
- rodgerd 4y ago
  The vendor's customers are already at risk. It's a peculiar arrogance to imagine otherwise.
- Sohcahtoa82 4y ago
  I feel like you're arguing from an absolute. Yes, we're all arguing in favor of responsible disclosure, but if the vendor is not communicating in good faith, what else can you do?
- JohnFen 4y ago
  > Would you be OK if someone published an exploit for your systems? Under those circumstances? Yes. How else would I learn that my systems are vulnerable?

ajross 4y ago

The thing is, "releasing our findings to the public" puts the vendor's customers at risk, it's not just some imagined Just Punishment For The Guilty, innocents get hurt. Imagine if you took a new job and they had a bunch of hardware sitting around from such a vendor. Would you be OK if someone published an exploit for your systems? (In this case, the vulnerability seems minor, so it's sort of academic. But I'm not understanding the mindset of the people here who want to see this as a two party adversarial kind of relationship between Modzero and CrowdStrike. It's not!)

detaro 4y ago
You can't let vendors hide security problems by just not doing anything about them. People deserve to know if the product they rely on has vulnerabilities, because just because you aren't exploiting it doesn't mean nobody else will find it. Modzero was even following a more conservative playbook here: not setting a deadline from the start, but only talking about release once the vendor indicated there was no issue (anymore).
- ajross 4y ago
  > You can't let vendors hide security problems by just not doing anything about them. Telling people that the product they rely on has vulnerabilities is clearly not the same thing as "release the vulnerability report" though, is it? I still remain amazed at the absolutism in the arguments here. There is a spectrum of responses that can be explored before dropping bombs. But everyone wants to see stuff burn?
  - paulryanrogers 4y ago
    So what's the intermediate step on the spectrum? Publicly call out the vendor and model, yet vaguely enough that others will have to find the specific gap(s)? Tell the press? If one publicly discloses some mitigation it's usually enough to give malicious actors enough to go on anyway.
  - jeroenhd 4y ago
    Telling the customers that there's a vulnerability will make them turn to their vendor. The vendor will obviously lie and say there's no vulnerability, everything is fine, ignore the panic. Without the necessary details telling the public about a vulnerability is like shouting at a wall. Publishing the details forces vendors to release fixes when they deny the existence of the vulnerability. This isn't some hidden password or evil DoS attack, this is an attack only processes with admin access can leverage on infected machines. This command is either executed by a computer user (which should flag a warning in the management software) or it's executed by a virus with admin permissions that went undetected by the antivirus solution on the machine. The stakes are low enough and the vendor is irresponsible enough that I don't see a problem with publishing a PoC when vendors lie about these kinds of bugs. Of course remote exploitation and auth bypass PoCs shouldn't be released into the wild without trying to get a patch out first, but even still vendors like D-Link just don't seem to care if you don't at least threaten them with releasing the details to the public.
  - xphos 4y ago
    This kind of thinking does not protect customers though. We can all pretend there is no vulnerability but that does not mean there isn't a vulnerability. This is kind of "Don't look up" thinking. The spectrum here was they tried with the OEM and the OEM said let it burn by snubbing the researchers. The researchers than attempted to let customers know since the OEM did not want to protect them.
xphos 4y ago
I don't think its the job of Security Researchers to defend a OEMs customers. That's the OEMs job? If the OEM does not want to protect its customers after a research has literally given the vulnerability to them its no longer on the researcher. In fact its probably bad ethics for the researcher not to publish because just because there is no report does not mean the bug is not exploited or known by malicious actors. The researchers last recourse is to publish a notification to let the OEMs customers there is an issue since the OEM won't acknowledge it.
paulryanrogers 4y ago
> The thing is, "releasing our findings to the public" puts the vendor's customers at risk If vendor denies there is a problem despite repeated submissions of evidence then customers are already at risk indefinitely.
matheusmoreira 4y ago
> puts the vendor's customers at risk They were already at risk and didn't even know before disclosure. If anyone's to blame for anything, it's the corporation. They were told a vulnerability existed. If it got to the point people are releasing things to the public, it's certainly because they neglected to do what needed to be done.
conioh 4y ago
rodgerd 4y ago
The vendor's customers are already at risk. It's a peculiar arrogance to imagine otherwise.
Sohcahtoa82 4y ago
I feel like you're arguing from an absolute. Yes, we're all arguing in favor of responsible disclosure, but if the vendor is not communicating in good faith, what else can you do?
JohnFen 4y ago
> Would you be OK if someone published an exploit for your systems? Under those circumstances? Yes. How else would I learn that my systems are vulnerable?