4 ms·

I don't know what "norms" Rapid7 is expecting JetBrains to have followed, but this article certainly makes them come off in an entitled, power-tripping light, l

by 015a 3y ago

I don't know what "norms" Rapid7 is expecting JetBrains to have followed, but this article certainly makes them come off in an entitled, power-tripping light, like their glory is more important than security. I'll be adding them to my list of "companies I'll never do business with".

bitexploder 3y ago
It’s a bad article trying to spin it. This is business as usual for vulnerability disclosure. The Reg is always sensationalizing things to get clicks. Just add any infosec research firm ever that has disclosed a vulnerability using coordinated disclosure to your list. Like say Google and their Project Zero. They follow very similar policies and if you stop communicating with their researchers they will just drop your bugs.
- yegnau 3y ago
  Everyone has their coordinated disclosure policies, but not all of them are as harsh as Rapid7's. You mentioned Project Zero, it's a great example: >Project Zero follows a 90+30 disclosure deadline policy, which means that a vendor has 90 days after Project Zero notifies them about a security vulnerability to make a patch available to users. If they make a patch available within 90 days, Project Zero will publicly disclose details of the vulnerability 30 days after the patch has been made available to users. https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html https://googleprojectzero.blogspot.com/p/vulnerability-discl... Giving vendors 30 days after a fix is a much more user-friendly thing to do then releasing ready-made exploits simultaneously with a patch, isn't it?
  - bitexploder 3y ago
    Yes, I agree, but Rapid7 does not normally do that. https://www.rapid7.com/security/disclosure/ https://www.rapid7.com/security/disclosure/ “ If the responsible organization is showing consistent good-faith effort to develop and ship an update, but cannot complete this work within 60 days, a 30-day extension may be granted at Rapid7’s sole discretion under the Default Policy (or for any of the enumerated exceptions below).” They do this with good faith as far as I have seen. The issue as I see it is that JetBrains decided to stop communicating, eliminating the “good faith” on their end.
ziddoap 3y ago
>I'll be adding them to my list of "companies I'll never do business with". They are following all industry best practices, so I hope you're prepared to add every reputable infosec company onto your list.
- yegnau 3y ago
  They are following their own practices first a foremost. Consider this policy by Google's Project Zero for example: >Project Zero follows a 90+30 disclosure deadline policy, which means that a vendor has 90 days after Project Zero notifies them about a security vulnerability to make a patch available to users. If they make a patch available within 90 days, Project Zero will publicly disclose details of the vulnerability 30 days after the patch has been made available to users. https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html https://googleprojectzero.blogspot.com/p/vulnerability-discl... Rapid7's "we release full details and ready-made exploits the very day vendor releases a patch" seems to be an unnecessarily aggressive take on vuln disclosure. It benefits them as a for-profit security research firm, but definitely not the users who are given no time gap to apply the patches. All while any attacker of any skill level can start using the exploit against them.
  - ziddoap 3y ago
    As soon as a security patch is released, it will be reverse engineered and exploited, regardless of whether PoC code has been released. >Rapid7's "we release full details and ready-made exploits the very day vendor releases a patch" This is not their whole policy. They have exceptions, extensions, etc. But yes, they will publicly disclose a vuln if your company decides to refuse coordinated disclosure and choose to silent patch. They also don't release "ready-made exploits", please don't be hyperbolic. They release technical details about exploits, yes. But they aren't releasing metasploit modules or the likes... See also from Project Zero (assuming that is your preferred vendor?): >Any attacker with the resources and technical skills to turn a bug report into a reliable exploit chain would usually be able to build a similar exploit chain even if we had never disclosed the bug

by 015a 3y ago

bitexploder 3y ago

It’s a bad article trying to spin it. This is business as usual for vulnerability disclosure. The Reg is always sensationalizing things to get clicks. Just add any infosec research firm ever that has disclosed a vulnerability using coordinated disclosure to your list. Like say Google and their Project Zero. They follow very similar policies and if you stop communicating with their researchers they will just drop your bugs.

yegnau 3y ago
Everyone has their coordinated disclosure policies, but not all of them are as harsh as Rapid7's. You mentioned Project Zero, it's a great example: >Project Zero follows a 90+30 disclosure deadline policy, which means that a vendor has 90 days after Project Zero notifies them about a security vulnerability to make a patch available to users. If they make a patch available within 90 days, Project Zero will publicly disclose details of the vulnerability 30 days after the patch has been made available to users. https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html https://googleprojectzero.blogspot.com/p/vulnerability-discl... Giving vendors 30 days after a fix is a much more user-friendly thing to do then releasing ready-made exploits simultaneously with a patch, isn't it?
- bitexploder 3y ago
  Yes, I agree, but Rapid7 does not normally do that. https://www.rapid7.com/security/disclosure/ https://www.rapid7.com/security/disclosure/ “ If the responsible organization is showing consistent good-faith effort to develop and ship an update, but cannot complete this work within 60 days, a 30-day extension may be granted at Rapid7’s sole discretion under the Default Policy (or for any of the enumerated exceptions below).” They do this with good faith as far as I have seen. The issue as I see it is that JetBrains decided to stop communicating, eliminating the “good faith” on their end.

ziddoap 3y ago

>I'll be adding them to my list of "companies I'll never do business with". They are following all industry best practices, so I hope you're prepared to add every reputable infosec company onto your list.

yegnau 3y ago
They are following their own practices first a foremost. Consider this policy by Google's Project Zero for example: >Project Zero follows a 90+30 disclosure deadline policy, which means that a vendor has 90 days after Project Zero notifies them about a security vulnerability to make a patch available to users. If they make a patch available within 90 days, Project Zero will publicly disclose details of the vulnerability 30 days after the patch has been made available to users. https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html https://googleprojectzero.blogspot.com/p/vulnerability-discl... Rapid7's "we release full details and ready-made exploits the very day vendor releases a patch" seems to be an unnecessarily aggressive take on vuln disclosure. It benefits them as a for-profit security research firm, but definitely not the users who are given no time gap to apply the patches. All while any attacker of any skill level can start using the exploit against them.
- ziddoap 3y ago
  As soon as a security patch is released, it will be reverse engineered and exploited, regardless of whether PoC code has been released. >Rapid7's "we release full details and ready-made exploits the very day vendor releases a patch" This is not their whole policy. They have exceptions, extensions, etc. But yes, they will publicly disclose a vuln if your company decides to refuse coordinated disclosure and choose to silent patch. They also don't release "ready-made exploits", please don't be hyperbolic. They release technical details about exploits, yes. But they aren't releasing metasploit modules or the likes... See also from Project Zero (assuming that is your preferred vendor?): >Any attacker with the resources and technical skills to turn a bug report into a reliable exploit chain would usually be able to build a similar exploit chain even if we had never disclosed the bug