Re: Call to arms - INFORMATION ANARCHY

From: Luke Kenneth Casson Leighton (lkcl@SAMBA-TNG.ORG)
Date: 11/03/01 

Message-ID:  <20011103114309.D5271@samba-tng.org>
Date:         Sat, 3 Nov 2001 11:43:09 +0000
From: Luke Kenneth Casson Leighton <lkcl@SAMBA-TNG.ORG>
Subject:      Re: Call to arms - INFORMATION ANARCHY
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

On Fri, Nov 02, 2001 at 08:45:37PM -0500, Carter Mobley wrote:
> If Microsoft would simply offer cash rewards to vulnerability discoverers,
> conditioned on the discoverer promising to never disclose to a third party,
> I think the problem is solved quite nicely. For Microsoft, it's a cost of
> doing business, they can add it to the price of the software. All we need is
> a price list. What about this one?
>
> A. $25,000.00 for bringing down a fully patched web server
> B. $50,000.00 for accessessing database records without setting off any
> alarms on a fully patched SQL server.
> C. $10,000.00 for accessing private information from a fully patched windows
> XP home edition.
> etc...
>
> If we assume that over the course of the next 5 years that 100 A type
> vulnerabilities and 100 B type vulnerabilities are found, reported
> responsibly, and fixed by Micorosoft, it cost Microsoft a total of 7.5
> million dollars in reward money to protect their customers, all
> vulnerabilities remaining 100 percent undisclosed.
>
> Any rational objections to this simple, inexpensive, yet effective plan?

yes, i have one and only one objection to this otherwise
very good plan: the undisclosure bit.

there's no guarantee that the information received will be
acted upon effectively or even at all.

sorry to put it quite so bluntly, but it's true.

the information so obtained could, instead, be used to...
say... simply delay releases of software.

let's imagine that several quite serious security problems were
found - twenty, all told.

one of them, the first one, was incredibly incredibly serious.
they're just about to release a hotfix, or a major new version,
with the problem fixed.

then there comes in the other nineteen other problems.
the hotfix and new version are delayed whilst these other
nineteen problems are analysed, for impacts upon the hotfix
and the rest of the OS, and the entire testing procedure has
to go round AGAIN.

in the mean-time, out on the internet, someone discovers
how to exploit Serious Problem No. 1.

too late!

so, no, i don't think that non-disclosure is a good idea.

oh, and for the record, i don't think that immediate disclosure
is a good idea _either_: that's just irresponsible.

[i worked for ISS, i know the procedure / algorithm for reporting
problems to vendors and working with vendors to get the
problem fixed quite well]

luke

Relevant Pages

  • RE: Microsoft Vulnerabilities ARE being reported to Microsoft
    ... Do you really care what MS thinks? ... Microsoft Vulnerabilities ARE being reported to Microsoft ... Contrary to popular opinion, I do disclose ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #305
    ... Microsoft Office security, part one ... Microsoft Internet Explorer Multiple COM Object Color Property Denial of Service Vulnerabilities ... An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #306
    ... Microsoft Office security, part two ... Microsoft Internet Explorer COM Object Instantiation Daxctle.OCX Heap Buffer Overflow vulnerability. ... Cybozu Garoon Multiple SQL Injection Vulnerabilities ...
    (Focus-Microsoft)
  • Re: [Full-disclosure] Microsofts Real Test with Vista is Vulnerabilities
    ... So if they can earn more from the subscription based security solution where is the incentive to make the OS more secure? ... I am far from a Microsoft marketing expert... ... Microsoft's Real Test with Vista is Vulnerabilities ...
    (Full-Disclosure)
  • SecurityFocus Microsoft Newsletter #360
    ... A Method of Testing VoIP security or Voice VLANs ... MICROSOFT VULNERABILITY SUMMARY ... Online Armor Personal Firewall SSDT Hooks Multiple Local Vulnerabilities ...
    (Focus-Microsoft)
Quantcast