nCircle VERT Blog

I'm not sure… but I think that a lot of people might be confused about what a vulnerability is. It seems to me that some people think researchers that are discovering vulnerabilities are magicians, making the vuln appear out of thin air. This is not the case, it already exists… it's waiting there for somebody to stumble across, and yes, people do stumble across bugs that have a negative impact. People also simultaneously discover the same bug. If Person A reports the bug and the vendor does nothing while Person B starts exploiting the bug then there's going to be problems. Yet if Person A publishes the bug while Person B is exploiting it, the vendor will likely respond faster and the solution will be expedited.


There's another discussion point that seems to be causing some confusion. There are people that apparently believe that releasing a vulnerability increases risk by increasing the likelihood of attack. This isn't actually the case and I'm hoping to set people straight right now, once and for all. Let's take a look at the pros and cons of publicly disclosing a vulnerability.
• Pros

1. IDS/IPS, Vulnerability Management and Content Filtering vendors can ship protections and defenses to their customers much more quickly.


2. The vendor will have to respond more quickly and issue a patch sooner.


3. Enterprises and Individuals will know that the problem exists and can take precautions to prevent it from affecting their systems. Be it policy changes, software changes or applying mitigations.


4. Attackers who may have been using the code for nefarious activities are going to see the number of days in which their attack is effective decrease as user awareness increases and mitigations are released.

• Cons

1. Attackers MAY not have known about the vulnerability, so we may be sharing information with them.

The pros far outweigh the cons, so the only possible answer is that the benefits of public disclosure far exceed doing nothing. This doesn't mean I'm advocating for full disclosure… I actually prefer responsible disclosure but only if action is being taken and the vendor is working under an acceptable time frame (say 30 days). After those 30 days, public disclosure seems perfectly reasonable to me… and based on the pros and cons, logic agrees with me.