Patch or we go public, says bug bounty program
TippingPoint's ZDI sets a 6-month deadline on vendors to encourage faster patching
Computerworld - The world's biggest bug bounty program today slapped a six-month deadline on vendors, saying it would release some vulnerability information, even if a patch wasn't ready.
"We're going to be enforcing a six-month deadline as general policy," said Aaron Portnoy, who leads the security research team at HP TippingPoint.
It's a major change for TippingPoint's Zero Day Initiative (ZDI), which buys vulnerabilities from independent security researchers, privately reports them to vendors and then uses the information to craft defenses for its own line of security appliances. Previously, ZDI's policy was to indefinitely withhold a vulnerability, publishing its information only after a patch had been issued.
Starting Wednesday, ZDI will give vendors six months to come up with a patch. Bugs currently in its queue get a deadline that's six months from now: Feb. 4, 2011.
If a fix isn't ready by the deadline, ZDI will pressure the vendor by issuing an advisory that will include what Portnoy called "limited details" of the vulnerability, as well as any workarounds ZDI can come up with to help protect users until a patch does appear.
But the new line in the sand is movable. "For vulnerabilities that may be more impactful, like ones in the core operating system, we will provide an extension on a case-by-case basis," Portnoy said in an interview. A vulnerability in the Windows kernel would be a good example of a candidate for extension.
"But if we provide an extension, we'll be totally transparent, and publish the full communications between us and the vendor once it's patched," Portnoy said.
The back-and-forth between security researchers and vendors, such as what Core Security has occasionally published when it's grown frustrated with Microsoft's patching pace, is sometimes as interesting, or even more so, than the actual bugs, giving everyone a behind-the-scenes look at how large software developers handle vulnerability reports.
Portnoy said the change had been a long-time coming, and wasn't directly connected to the debate over bug disclosure that heated up in early June when a Google employee went public with a critical Windows vulnerability just five days after reporting it to Microsoft.
"We've been thinking about this for quite a while," said Portnoy, arguing that the delays on the part of vendors put it ZDI in a tight spot. "We have to track some of these bugs for two years, three years, which slows us down."
Currently, ZDI is holding information on 31 critical bugs that it reported to vendors a year ago or longer. "[Vendors] have the responsibility to fix the issues," said Portnoy. "We shouldn't be held responsible for withholding information until they do."
Portnoy made it clear that part of the reason for the new deadline is to pressure the intransigent to patch. "By releasing some information, it puts the spotlight on vendors," Portnoy said.
He also argued that the secrecy over vulnerabilities may end up doing users a disservice. "There's been a lot of discovery overlap, where several [researchers] find the exact same vulnerability," said Portnoy. Immunity and Vulpen, two rival security firms, report bug discoveries only to their own customers, not to the vendors. "Some of what Immunity has could very well be among those we're sitting on right now," Portnoy added.
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!