4 ms·

The bogusly reported CVEs could be part of a more sophisticated reverse-attack attempt. Suppose you run PostgreSQL 13 freshly patched, and a new vulnerability

The bogusly reported CVEs could be part of a more sophisticated reverse-attack attempt. Suppose you run PostgreSQL 13 freshly patched, and a new vulnerability is introduced anonymously in the latest minor version (e.g. version 16.3). The attempt to make users update to the latest version could lead to more severe consequences than not updating.

deleted 3y ago
[deleted]
rwmj 3y ago
I doubt it's that sophisticated. There's unfortunately an alignment problem where you can boost your resume by saying you "discovered" CVEs, and it's hard for a hiring company to check if a CVE in some random program is bogus garbage or real issue. As a result people are incentivised to file garbage CVEs. See also: garbage answers on Stack Overflow. Edit: To expand a bit on "alignment issue". CVEs are easy to create and are quite a trusted system. There's no penalty for the reporter if they are bogus (discovered or not). Also there's a huge amount of downstream work that happens after a CVE is reported, eg. at Red Hat we have teams of people who run around categorizing and deploying fixes, customers have to update, there are security reporting tools, even government regulations. None of this burden is carried by the reporter if they are wrong.
- thayne 3y ago
  But these CVEs were filed anonymously. Wouldn't that make it hard to take credit for it? At least in a verifiable way?
  - rwmj 3y ago
    Isn't this the person who filed it? https://www.postgresql.org/message-id/CAA8ZSMqAHDCgo07hqKoM5XJaoQy6Vv76O7966agez4ffyQktkA%40mail.gmail.com https://www.postgresql.org/message-id/CAA8ZSMqAHDCgo07hqKoM5... But even "anonymous" CVEs have this problem since in some teams you can get raises/bonuses based on the number of CVEs you report. See the other reply here: https://news.ycombinator.com/item?id=37406345 https://news.ycombinator.com/item?id=37406345
    - owenmarshall 3y ago
      Not necessarily: that email reported a legitimate bug and identifies a buffer overflow. They don't mention anything about it being exploitable or try to work towards this. Then the CVE was published >20 days later. It's very possible someone else watching the Postgres DL saw an email with "buffer overflow" and pushed it out.
  - dylan604 3y ago
    Flipped the other way, prove that the person taking credit didn't file it.
owenmarshall 3y ago
My conspiratorial read was that these could be an effective way to raise the noise floor. Make it difficult to impossible for a security team on a project to ever "catch up" and get to zero reported risk, get them acclimatized to constantly having some open security issues, boil the frogs slowly. And while this is probably just a naive attempt to get yourself recognized, I like this take, too.

deleted 3y ago

[deleted]

rwmj 3y ago

I doubt it's that sophisticated. There's unfortunately an alignment problem where you can boost your resume by saying you "discovered" CVEs, and it's hard for a hiring company to check if a CVE in some random program is bogus garbage or real issue. As a result people are incentivised to file garbage CVEs. See also: garbage answers on Stack Overflow. Edit: To expand a bit on "alignment issue". CVEs are easy to create and are quite a trusted system. There's no penalty for the reporter if they are bogus (discovered or not). Also there's a huge amount of downstream work that happens after a CVE is reported, eg. at Red Hat we have teams of people who run around categorizing and deploying fixes, customers have to update, there are security reporting tools, even government regulations. None of this burden is carried by the reporter if they are wrong.

thayne 3y ago
But these CVEs were filed anonymously. Wouldn't that make it hard to take credit for it? At least in a verifiable way?
- rwmj 3y ago
  Isn't this the person who filed it? https://www.postgresql.org/message-id/CAA8ZSMqAHDCgo07hqKoM5XJaoQy6Vv76O7966agez4ffyQktkA%40mail.gmail.com https://www.postgresql.org/message-id/CAA8ZSMqAHDCgo07hqKoM5... But even "anonymous" CVEs have this problem since in some teams you can get raises/bonuses based on the number of CVEs you report. See the other reply here: https://news.ycombinator.com/item?id=37406345 https://news.ycombinator.com/item?id=37406345
  - owenmarshall 3y ago
    Not necessarily: that email reported a legitimate bug and identifies a buffer overflow. They don't mention anything about it being exploitable or try to work towards this. Then the CVE was published >20 days later. It's very possible someone else watching the Postgres DL saw an email with "buffer overflow" and pushed it out.
- dylan604 3y ago
  Flipped the other way, prove that the person taking credit didn't file it.

owenmarshall 3y ago

My conspiratorial read was that these could be an effective way to raise the noise floor. Make it difficult to impossible for a security team on a project to ever "catch up" and get to zero reported risk, get them acclimatized to constantly having some open security issues, boil the frogs slowly. And while this is probably just a naive attempt to get yourself recognized, I like this take, too.