Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Hacked Opinions: Vulnerability disclosure -- Jeff Williams

Steve Ragan | July 24, 2015
Contrast Security's Jeff Williams talks about disclosure, bounty programs, and vulnerability marketing

JW: In my opinion, the economics can't ever really work at scale. Even if the program is paying a high value for vulnerabilities, you have to factor in the odds of winning. Let's imagine bug bounty really takes off and there are lots of people doing it.

There will always be a rush to report "easy to find" vulnerabilities, making it increasingly unlikely to win the bounty. So the expected value to the researcher drops precipitously. The "hard to find" vulnerabilities that exist after the company has done everything they can to secure their product are a much more viable market.

These should command a much higher bounty and there may be very talented researchers willing to take a chance on getting paid. But this dramatically limits the scalability of the bug bounty model. Until the relationship between the researcher and the company is more like a real consulting arrangement, with access to source code, confidentiality agreement, structured rates, etc...

I can't imagine bug bounty programs finding anything more than a niche. In the meantime, the danger of bug bounty programs is that they are being advertised as a replacement for structured security verification.

This can lead to a false sense of security from companies that aren't doing enough for their own security testing programs.

Do you think vulnerability disclosures with a clear marketing campaign and PR process, such as Heartbleed, POODLE, or Shellshock, have value?

JW: Yes. Unfortunately. The game is set up so that security researchers are forced to advertise the "worst case scenario" for vulnerabilities because otherwise nobody will pay attention.

Within days, everyone scanned and patched their networks for Heartbleed and even demanded compliance from their subcontractors. That's how we should handle all new dangerous vulnerabilities.

Except that it shouldn't be a fire drill, it should be a standard part of IT development and operations. But when organizations fail to fix serious vulnerabilities, like Struts and Spring RCE that have been out for years, they force researchers into ridiculous marketing and stunt hacking.

If the proposed changes pass, how do you think Wassenaar will impact the disclosure process? Will it kill full disclosure with proof-of-concept code, or move researchers away from the public entirely preventing serious issues from seeing the light of day? Or, perhaps, could it see a boom in responsible disclosure out of fear of being on the wrong side of the law?

JW: I doubt that it will have very much of an effect. There have been many legal threats to security researchers over the past 20 years, but only a tiny fraction have ever actually been prosecuted.

Essentially, the chilling effect has already been in effect for years. Ironically, I think the biggest outcome of Wassenaar will be to continue the fiction that controlling the attackers is possible.

We need to recognize that we have created an environment where it is impossible to identify or control attackers, and therefore the only sane strategy is to build rugged code, create strong defenses, and block attacks.

 

Previous Page  1  2 

Sign up for CIO Asia eNewsletters.