In this post I want to add (yet) another perspective, motivated by a disclosure
procedure which just happened recently.
todb’s article,
R7-2015-23: Comcast XFINITY Home Security System Insecure Fail Open
is a well planned public forum vulnerability disclosure. The article itself is
very well done: It gives credit to the researcher who discovered the
vulnerability and it shows a vulnerability disclosure timeline where Rapid7
reached out to Comcast (the vendor). They even go a step further and publish the
link showing the process for discovered vulnerabilities in a Rapid7 product as
well as how Rapid7 handles disclosing those vulnerabilities they find in
external products. For their internal disclosure process, they make sure to
release a patch before “publicly announcing the vulnerability in the release
notes of the update”(rapid7 disclosure).
Given there’s quite some speculation and, as we think, misinformation going
around we think it’s helpful to add/clarify the following information:
we fully comply with the injunction and we have no intentions to violate it.
we do not plan to publish any technical information besides the report (agreed
upon with FireEye themselves) and the slides (based on the former) anyway. No
3rd parties except for the ones involved (FireEye, lawyers) have received any
additional technical information from our side, let alone an earlier version
of the report.
the injunction covers accompanying details mostly within the architecture
space, but not the core vulnerabilities themselves. Those are not part of the
injunction.
we stand by the timeline as provided below. In particular, the following two
points:
– FireEye received a draft version of the report which had the objectionable
material (as identified by the cease and desist letter) fully removed on
August 11th.
– according to the cease and desist letter FireEye’s lawyer sent us, they were
informed – from our side – about the planned talk at 44CON on Jul 23rd.
there’s an injunction, but not a lawsuit. I used the term “sue” after
consulting Merriam-Webster
which states: “sue: to seek justice or right from (a person) by legal
process”, but this might have been misinterpreted by some readers. As stated,
there’s a pending injunction, but not a lawsuit.
Please note that we won’t share legal documents with 3rd parties or publish them
as we consider this inappropriate.
Please note further that, during the whole process, our goal was to perform a
responsible disclosure procedure with its inherent objectives (namely
vulnerability remediation by vendor and education of various stakeholders
involved, see also
here
or
here).
We consider this disclosure process as concluded. We don’t see a need to add
technical details from our side as we feel that the objectives of responsible
disclosure are met (not least as patches are released since quite some time
and both
vendor & finder
have released reports).
In this post I’ll discuss some aspects of vulnerability disclosure. I don’t want
to delve into an abstract & general discussion of vulnerability disclosure (for
those
interested here’s some discussion in
the context of Google’s Project Zero,
this is the well-known CERT/CC approach,
this a paper from WEIS 2006
laying out some variants, and
finally some statement by Bruce Schneier back in 2007). Instead
I will lay out which approach we followed in the past (and why we did so) and
which developments make us consider it necessary to re-think our way of
handling. The post is not meant to provide definitive answers; it was also
written not least to provide clarity for ourselves (“write down a problem in
order to better penetrate it”) and, maybe, to serve as a starting point for a
discussion which will help the community (and us) to find a position on some of
the inherent challenges.