8 ms·

Security pros question EU zero-day rule

67 points by skilled 3y ago

DrJaws 3y ago
I feel more like companies "worried" about disclosure to governments in 24 hours worry more about needing to fix things fast and maybe hire more people to do it than from security concerns issues.
- develatio 3y ago
  This is a very simplistic take. There are CVEs and then there are CVEs. Some may take months to be properly fixed, no matter how many engineer-hours you put on them (e.g. the entire side-channel attacks saga). And that's not even taking into account the time required to alert different vendors (think about all the different linux distributions, upstream, big companies, etc...) and coordinate adequate steps.
  - Detrytus 3y ago
    Also, there are governments and then there are governments. I would rather have a company keep zero-day a secret than disclose it to government run by assholes such as Victor Orban or Emmanuel Macron.
    - Kbelicius 3y ago
      Reports of security breaches need to be reported to ENISA which is an EU institution.
  - Jensson 3y ago
    Don't you think governments need to know if their software has a known actively exploited vulnerability that exposes their private data, especially if you are going to take months to fix it? Or are you saying it is fine to stay silent if you notice Russians are using an exploit reading private user data and it will take months for you to fix it?
    - Arnt 3y ago
      You make it sound as if the maintainer team already has a near-complete understanding of the problem in the first hours.
      - Jensson 3y ago
        Not sure what you mean, if you know you have an actively exploited vulnerability then what more investigation would you need to do in a few hours? This law only talks about actively exploited vulnerabilities, if you find a bug and go home for the weekend without fixing it that should be fine since that bug isn't actively exploited. Edit: Point is, once you have done the investigation necessary to know that it is actively exploited you already have a ton of understanding about the problem. I don't see why you would need more than 24 hours at that point just to write a report to affected actors.
        Arnt 3y ago
        Suppose that I'm actively exploiting your software. Then I'm in a position where I can describe the exploit, but you may not be. After all I'm hardly eager to tell you how I'm doing it. Once you discover that it's happening, you know there is an exploit so you know at least that the vulnerability exists. The discovery probably tells you something about the vulnerability, but how much? The last one I heard about in any detail was discovered when they noticed that an uplink was at 100% utilisation and realised that it was due to data being exfiltrated. That didn't tell them much about how the intruder gained the ability to exfiltrate the data. Do you know enough to describe it? I know enough, but you're the one who's required to write a notification. Can you describe the vulnerability that's the subject of your notification?
        j16sdiz 3y ago
        It's easy. Just report whatever you knew already. ... and prepare to join endless meetings with no time work on the problem. /s
    - develatio 3y ago
  - phpisthebest 3y ago
    None of which matters if it is active exploit, which not only the government but users fo the software should be made aware of even if no patch is avalible yet, this will allow them to make the choice to shutdown the system, apply network level or other security measure, increase monitoring or many many many many other things they would be unable to do if software vendors keep it hidden for months while they choose what is the best course. I am fundamentally a full disclosure supporter.
  - adql 3y ago
    Keeping multi month ones secret is even bigger risk to security if workarounds exist.
- unmole 3y ago
  > fix things fast and maybe hire more people I really hope you don't work in software.
- blitzar 3y ago
  I feel more like companies "worried" about disclosure to governments in 24 hours are "worried" less about the 24 hour and more about the disclose part. Their preferred outcome would be mandatory disclosure within infinity hours.
chmod775 3y ago
24 hours is an impossible timetable. When do those even start counting? When I think I've found something, or when I'm done investigating and confirming it and have completed a technical writeup? The official language can be found starting on page 41 (bottom) of this document: https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-34e9-11ed-9c68-01aa75ed71a1.0001.02/DOC_1&format=PDF https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-... > The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any actively exploited vulnerability contained in the product with digital elements. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken. Doesn't sound realistic at all.
- Jensson 3y ago
  They say "actively exploited vulnerability". So from the time you know the vulnerability is actively exploited is how I read it.
  - hsbauauvhabzb 3y ago
    ‘Actively exploited’ and ‘public knowledge / actively exploited en mass’ is also an important definition here.
  - Arnt 3y ago
    And that looks very appropriate. If the vulnerability is actively exploited, telling the governments about it doesn't add to your hurry. You're already racing. If it were not exploited, then telling 27 governments would create 27 opportunities for leaks, which would add considerable pressure and disturb your best judgment. But the phrasing says "actively exploited". FWIW I once had a vulnerability reported to a widely used piece of software I alone maintained. I took a couple of days to fix and distribute it. Wrote a patch on the first evening, slept on it, looked hard on it the next day, had someone else review it, and finally released it about 40 hours after the report. Much more speed would have been difficult to achieve in a careful, responsible manner. My best friend once did something similar in 36 hours as part of a large team, and that was 36 really, really stressful hours. 24 sounds hard to my ears. Very difficult to make and distribute a reliable fix in that time. Knowing that the leaks may start in 25 hours... that would be bad.
theragra 3y ago
Not used for surveillance is the absolute minimum
adql 3y ago
If vulnerability is actively exploited (and not just some theoretical) then it should be entirely fair that government gets to know it as the government might be one being attacked by it unknowingly. It's not disclosing it to public. It's making the companies disclose it to: * their actual users * the government You know, the government that a ton of info about every citizen ? Yeah they should probably know. It seems like "security experts" are really PR experts that don't want their big company to not be able to control the information about the vulnerabilities
blincoln 3y ago
There are strong arguments on both sides, IMO. I especially agree with the potential for EU members to send the feed directly to their intelligence agencies' exploit development divisions. The biggest gap I see in the open letter is this part: "Require reporting to agencies of mitigatable vulnerabilities only, within 72 hours of effective mitigations (e.g., a patch) becoming publicly available." There are a surprising number of commercial software vendors as well as open source projects that will happily sit on severe vulnerabilities[1] for many months, even years before issuing a patch. Some will ignore them entirely. In a tiny minority of cases I've encountered, that kind of delay is justifiable. When I reported CVE-2023-21541 to Microsoft,[2] they asked for something like six months to build and test a patch, and I felt like that was reasonable, because fixing the bug meant changing the way Task Scheduler worked in a way that could potentially break automated processes (including Windows Update) across the world. It was also only meaningfully exploitable in corner cases outside of Microsoft's control. Usually, it's not justifiable. I once sent a detailed writeup of severe vulnerabilities[3] in a widely-used telecom product to something like twenty people who worked for the vendor.[4] After literally a year of asking for status updates, they claimed that somehow all of them had lost the writeup and nothing had been fixed. When we pressed them further, they updated their documentation to include a statement that the recommended configuration for the product was behind a firewall.[5] No patch, no disclosure of the issues to their customers. The suggestion needs some additional deadlines, IMO, or it completely defangs the EU's requirement. For vulnerabilities being actively exploited (not by good-faith researchers) vendors should be required to report the vulnerability to the EU either within 72 hours of effective mitigations being made available, or 7 days, whichever occurs first. For vulnerabilities reported to the vendor by good-faith researchers that would allow attackers to compromise instances of the product/service (or the underlying host/device), or retrieve sensitive data without authorization, 72 hours or 90 days, whichever occurs first. If a vendor can provide very compelling evidence, maybe allow them an extension to 180 days. [1] The ability to execute arbitrary code on a remote system, obtain unauthorized administrative access, retrieve sensitive data belonging to other users, etc., with full exploit code provided to the vendor/maintainer. [2] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21541 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... [3] Unauthenticated remote code execution, hardcoded administrative passwords for almost every network service, etc. [4] I worked for a customer of the vendor, and the report went to everyone on an email thread about the issues.
barelysapient 3y ago
What's the definition of a "manufacturer"? Would this apply to, for example, the Linux Foundation and by extension the Linux kernal?

67 points by skilled 3y ago

I feel more like companies "worried" about disclosure to governments in 24 hours worry more about needing to fix things fast and maybe hire more people to do it than from security concerns issues.

develatio 3y ago
This is a very simplistic take. There are CVEs and then there are CVEs. Some may take months to be properly fixed, no matter how many engineer-hours you put on them (e.g. the entire side-channel attacks saga). And that's not even taking into account the time required to alert different vendors (think about all the different linux distributions, upstream, big companies, etc...) and coordinate adequate steps.
- Detrytus 3y ago
  Also, there are governments and then there are governments. I would rather have a company keep zero-day a secret than disclose it to government run by assholes such as Victor Orban or Emmanuel Macron.
  - Kbelicius 3y ago
    Reports of security breaches need to be reported to ENISA which is an EU institution.
- Jensson 3y ago
  Don't you think governments need to know if their software has a known actively exploited vulnerability that exposes their private data, especially if you are going to take months to fix it? Or are you saying it is fine to stay silent if you notice Russians are using an exploit reading private user data and it will take months for you to fix it?
  - Arnt 3y ago
    You make it sound as if the maintainer team already has a near-complete understanding of the problem in the first hours.
    - Jensson 3y ago
      Not sure what you mean, if you know you have an actively exploited vulnerability then what more investigation would you need to do in a few hours? This law only talks about actively exploited vulnerabilities, if you find a bug and go home for the weekend without fixing it that should be fine since that bug isn't actively exploited. Edit: Point is, once you have done the investigation necessary to know that it is actively exploited you already have a ton of understanding about the problem. I don't see why you would need more than 24 hours at that point just to write a report to affected actors.
      - Arnt 3y ago
        Suppose that I'm actively exploiting your software. Then I'm in a position where I can describe the exploit, but you may not be. After all I'm hardly eager to tell you how I'm doing it. Once you discover that it's happening, you know there is an exploit so you know at least that the vulnerability exists. The discovery probably tells you something about the vulnerability, but how much? The last one I heard about in any detail was discovered when they noticed that an uplink was at 100% utilisation and realised that it was due to data being exfiltrated. That didn't tell them much about how the intruder gained the ability to exfiltrate the data. Do you know enough to describe it? I know enough, but you're the one who's required to write a notification. Can you describe the vulnerability that's the subject of your notification?
        j16sdiz 3y ago
        It's easy. Just report whatever you knew already. ... and prepare to join endless meetings with no time work on the problem. /s
  - develatio 3y ago
- phpisthebest 3y ago
  None of which matters if it is active exploit, which not only the government but users fo the software should be made aware of even if no patch is avalible yet, this will allow them to make the choice to shutdown the system, apply network level or other security measure, increase monitoring or many many many many other things they would be unable to do if software vendors keep it hidden for months while they choose what is the best course. I am fundamentally a full disclosure supporter.
- adql 3y ago
  Keeping multi month ones secret is even bigger risk to security if workarounds exist.
unmole 3y ago
> fix things fast and maybe hire more people I really hope you don't work in software.
blitzar 3y ago
I feel more like companies "worried" about disclosure to governments in 24 hours are "worried" less about the 24 hour and more about the disclose part. Their preferred outcome would be mandatory disclosure within infinity hours.

chmod775 3y ago

24 hours is an impossible timetable. When do those even start counting? When I think I've found something, or when I'm done investigating and confirming it and have completed a technical writeup? The official language can be found starting on page 41 (bottom) of this document: https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-34e9-11ed-9c68-01aa75ed71a1.0001.02/DOC_1&format=PDF https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-... > The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any actively exploited vulnerability contained in the product with digital elements. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken. Doesn't sound realistic at all.

Jensson 3y ago
They say "actively exploited vulnerability". So from the time you know the vulnerability is actively exploited is how I read it.
- hsbauauvhabzb 3y ago
  ‘Actively exploited’ and ‘public knowledge / actively exploited en mass’ is also an important definition here.
- Arnt 3y ago
  And that looks very appropriate. If the vulnerability is actively exploited, telling the governments about it doesn't add to your hurry. You're already racing. If it were not exploited, then telling 27 governments would create 27 opportunities for leaks, which would add considerable pressure and disturb your best judgment. But the phrasing says "actively exploited". FWIW I once had a vulnerability reported to a widely used piece of software I alone maintained. I took a couple of days to fix and distribute it. Wrote a patch on the first evening, slept on it, looked hard on it the next day, had someone else review it, and finally released it about 40 hours after the report. Much more speed would have been difficult to achieve in a careful, responsible manner. My best friend once did something similar in 36 hours as part of a large team, and that was 36 really, really stressful hours. 24 sounds hard to my ears. Very difficult to make and distribute a reliable fix in that time. Knowing that the leaks may start in 25 hours... that would be bad.

theragra 3y ago

Not used for surveillance is the absolute minimum

adql 3y ago

If vulnerability is actively exploited (and not just some theoretical) then it should be entirely fair that government gets to know it as the government might be one being attacked by it unknowingly. It's not disclosing it to public. It's making the companies disclose it to: * their actual users * the government You know, the government that a ton of info about every citizen ? Yeah they should probably know. It seems like "security experts" are really PR experts that don't want their big company to not be able to control the information about the vulnerabilities

blincoln 3y ago

There are strong arguments on both sides, IMO. I especially agree with the potential for EU members to send the feed directly to their intelligence agencies' exploit development divisions. The biggest gap I see in the open letter is this part: "Require reporting to agencies of mitigatable vulnerabilities only, within 72 hours of effective mitigations (e.g., a patch) becoming publicly available." There are a surprising number of commercial software vendors as well as open source projects that will happily sit on severe vulnerabilities[1] for many months, even years before issuing a patch. Some will ignore them entirely. In a tiny minority of cases I've encountered, that kind of delay is justifiable. When I reported CVE-2023-21541 to Microsoft,[2] they asked for something like six months to build and test a patch, and I felt like that was reasonable, because fixing the bug meant changing the way Task Scheduler worked in a way that could potentially break automated processes (including Windows Update) across the world. It was also only meaningfully exploitable in corner cases outside of Microsoft's control. Usually, it's not justifiable. I once sent a detailed writeup of severe vulnerabilities[3] in a widely-used telecom product to something like twenty people who worked for the vendor.[4] After literally a year of asking for status updates, they claimed that somehow all of them had lost the writeup and nothing had been fixed. When we pressed them further, they updated their documentation to include a statement that the recommended configuration for the product was behind a firewall.[5] No patch, no disclosure of the issues to their customers. The suggestion needs some additional deadlines, IMO, or it completely defangs the EU's requirement. For vulnerabilities being actively exploited (not by good-faith researchers) vendors should be required to report the vulnerability to the EU either within 72 hours of effective mitigations being made available, or 7 days, whichever occurs first. For vulnerabilities reported to the vendor by good-faith researchers that would allow attackers to compromise instances of the product/service (or the underlying host/device), or retrieve sensitive data without authorization, 72 hours or 90 days, whichever occurs first. If a vendor can provide very compelling evidence, maybe allow them an extension to 180 days. [1] The ability to execute arbitrary code on a remote system, obtain unauthorized administrative access, retrieve sensitive data belonging to other users, etc., with full exploit code provided to the vendor/maintainer. [2] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21541 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... [3] Unauthenticated remote code execution, hardcoded administrative passwords for almost every network service, etc. [4] I worked for a customer of the vendor, and the report went to everyone on an email thread about the issues.

barelysapient 3y ago

What's the definition of a "manufacturer"? Would this apply to, for example, the Linux Foundation and by extension the Linux kernal?