3 ms·

You can't let vendors hide security problems by just not doing anything about them. People deserve to know if the product they rely on has vulnerabilities, beca

by detaro 4y ago

You can't let vendors hide security problems by just not doing anything about them. People deserve to know if the product they rely on has vulnerabilities, because just because you aren't exploiting it doesn't mean nobody else will find it. Modzero was even following a more conservative playbook here: not setting a deadline from the start, but only talking about release once the vendor indicated there was no issue (anymore).

ajross 4y ago
> You can't let vendors hide security problems by just not doing anything about them. Telling people that the product they rely on has vulnerabilities is clearly not the same thing as "release the vulnerability report" though, is it? I still remain amazed at the absolutism in the arguments here. There is a spectrum of responses that can be explored before dropping bombs. But everyone wants to see stuff burn?
- paulryanrogers 4y ago
  So what's the intermediate step on the spectrum? Publicly call out the vendor and model, yet vaguely enough that others will have to find the specific gap(s)? Tell the press? If one publicly discloses some mitigation it's usually enough to give malicious actors enough to go on anyway.
- jeroenhd 4y ago
  Telling the customers that there's a vulnerability will make them turn to their vendor. The vendor will obviously lie and say there's no vulnerability, everything is fine, ignore the panic. Without the necessary details telling the public about a vulnerability is like shouting at a wall. Publishing the details forces vendors to release fixes when they deny the existence of the vulnerability. This isn't some hidden password or evil DoS attack, this is an attack only processes with admin access can leverage on infected machines. This command is either executed by a computer user (which should flag a warning in the management software) or it's executed by a virus with admin permissions that went undetected by the antivirus solution on the machine. The stakes are low enough and the vendor is irresponsible enough that I don't see a problem with publishing a PoC when vendors lie about these kinds of bugs. Of course remote exploitation and auth bypass PoCs shouldn't be released into the wild without trying to get a patch out first, but even still vendors like D-Link just don't seem to care if you don't at least threaten them with releasing the details to the public.
- xphos 4y ago
  This kind of thinking does not protect customers though. We can all pretend there is no vulnerability but that does not mean there isn't a vulnerability. This is kind of "Don't look up" thinking. The spectrum here was they tried with the OEM and the OEM said let it burn by snubbing the researchers. The researchers than attempted to let customers know since the OEM did not want to protect them.

by detaro 4y ago

ajross 4y ago

> You can't let vendors hide security problems by just not doing anything about them. Telling people that the product they rely on has vulnerabilities is clearly not the same thing as "release the vulnerability report" though, is it? I still remain amazed at the absolutism in the arguments here. There is a spectrum of responses that can be explored before dropping bombs. But everyone wants to see stuff burn?

paulryanrogers 4y ago
So what's the intermediate step on the spectrum? Publicly call out the vendor and model, yet vaguely enough that others will have to find the specific gap(s)? Tell the press? If one publicly discloses some mitigation it's usually enough to give malicious actors enough to go on anyway.
jeroenhd 4y ago
Telling the customers that there's a vulnerability will make them turn to their vendor. The vendor will obviously lie and say there's no vulnerability, everything is fine, ignore the panic. Without the necessary details telling the public about a vulnerability is like shouting at a wall. Publishing the details forces vendors to release fixes when they deny the existence of the vulnerability. This isn't some hidden password or evil DoS attack, this is an attack only processes with admin access can leverage on infected machines. This command is either executed by a computer user (which should flag a warning in the management software) or it's executed by a virus with admin permissions that went undetected by the antivirus solution on the machine. The stakes are low enough and the vendor is irresponsible enough that I don't see a problem with publishing a PoC when vendors lie about these kinds of bugs. Of course remote exploitation and auth bypass PoCs shouldn't be released into the wild without trying to get a patch out first, but even still vendors like D-Link just don't seem to care if you don't at least threaten them with releasing the details to the public.
xphos 4y ago
This kind of thinking does not protect customers though. We can all pretend there is no vulnerability but that does not mean there isn't a vulnerability. This is kind of "Don't look up" thinking. The spectrum here was they tried with the OEM and the OEM said let it burn by snubbing the researchers. The researchers than attempted to let customers know since the OEM did not want to protect them.