Verizon dubs sec researchers 'narcissistic vulnerability pimps'

In defense of full-disclosure


Updated In an official blog post, an employee in Verizon's Risk Intelligence unit has taken aim at researchers who disclose security flaws, calling them "Narcissistic vulnerability pimps" and comparing them to criminals.

"Have you ever heard of a terrorist referred to as a 'demolition engineer?'" the unnamed author of the rant asked, one presumes rhetorically. "How about a thief as a 'locksmith?' No? Well, that's because most fields don't share the InfoSec industry's ridiculous yet long-standing inability to distinguish the good guys from the bad guys."

The post goes on to propose that a person who discloses security flaws henceforth be labeled a "narcissistic vulnerability pimp," which the writer defines as "One who - solely for the purpose of self-glorification and self-gratification - harms business and society by irresponsibly disclosing information that makes things less secure."

Besides befuddling all the men in leopard fur coats and feather-laced hats, this comparison is problematic for other reasons. As the recent Pwn2Own contest made abundantly clear, software makers can't be counted on to secure their products, at least not on their own. Security researchers armed with real-world vulnerabilities provide an important check on internal security teams and give them a powerful incentive to be thorough in finding bugs and swift in fixing them.

Without people reporting bugs, the only people creating weaponized exploits in widely used products are those who regularly hack into Fortune 500 companies - and they don't show the courtesy of telling anyone afterward that the software they've attacked is defective.

To witness the power of vulnerability disclosure, witness the announcement security researcher "narcissistic vulnerability pimp" Tavis Ormandy made earlier this month about a flaw in the Java virtual machine that made it trivial for bad guys to install malware on end user machines.

In private discussions, Oracle told Ormandy the threat didn't warrant them issuing a fix outside of their next scheduled patch release in July. Five days after the bulletin was published, the vulnerability was fixed.

We're all for companies fixing their buggy products, and this includes Verizon. But until they can do it on their own, and in a timely manner, we'll continue to use the term "security researcher." ®

Update

We just got off the phone with Dave Kennedy, manager of risk analysis at Verizon Business, who expanded a bit on the blog post, which he said was written by his boss, Wade Baker, with Kennedy's assistance. He said full disclosure was never a good idea, even in cases, like Ormandy's dust-up with Oracle, where the company delays a fix for a vulnerability that endangers millions of users.

"I don't want to pick a fight with these guys," he said, meaning security researchers or, uh, narcissistic vulnerability pimps. "By arbitrarily releasing vulnerability information you are putting others at risk and you are putting yourself in the position of managing the time of the employees of the companies that own that software. It's a rationalization to say that Charlie Miller's in a better position to judge the vulnerabilities that OS X has than Apple.

"Apple has a responsibility to their shareholders and to their customers to deal with the vulnerabilities, and their shareholders and their customers can hold Apple's feet to the fire. They have their own ways of exerting pressure on Apple to behave in a way they think Apple should behave."

Of course, if the public remains in the dark about gaping vulnerabilities that go unfixed for months or years - which is an inevitable outcome of the world Kennedy would have us all live in - it's questionable how shareholders and customers could be informed enough to take action. But hey, it sure would make life easier on the software makers, wouldn't it?


Keep Reading

Microsoft drives users to the Edge: Internet Explorer to redirect to Chromium-based browser in November

'Hey, you folks heard that there's this virus starting to spread?' – IE, probably

In a world where up is down, it's heartwarming to know Internet Explorer still tops list of web dev pain points

Incompatibilities and inconsistent standards support among browsers ensure an ongoing source of headaches

Azure DevOps Services reminds users that, yes, it really is time to pull the plug on Internet Explorer 11

Ignite Sure, it's still wedged in the OS, but maybe you'd prefer something shiny and Chromier?

We've come to wish you an unhappy birthday: Microsoft to yank services from Internet Explorer, kill off Legacy Edge by 2021

You need to give that plate back to us after you've finished your cake. Yes the fork too. We'll get your coat

Microsoft teases Azure Data Explorer connector for picking its Synapse analytics service's brains

What do you mean you're not on board the Big Data bus?

If you never thought you'd hear a Microsoftie tell you to stop using Internet Explorer, lap it up: 'I beg you, let it retire to great bitbucket in the sky'

We say take off and nuke the entire codebase from orbit. It's the only way to be sure

Google yanks Apple Silicon Chrome port after browser is found to 'crash unexpectedly'

Updated You'll have to run x64 version through the Rosetta emulation layer, or give it access to the Mac Bluetooth radio

Disabled by default: Microsoft ups the ante in its war against VBScript on Internet Explorer

Will the last IE 11 user please turn out the lights?

Biting the hand that feeds IT © 1998–2020