Tom Ferris is walking a fine line. He could be Microsoft's friend or foe.
Ferris, an independent security researcher in Mission Viejo, California, found what he calls a serious vulnerability in Microsoft's Internet Explorer Web browser. He reported it to the software giant on 14 August via the "secure@microsoft.com" email address and has since exchanged several emails with a Microsoft researcher.
Up to that point, Ferris did everything according to Microsoft's "responsible disclosure" guidelines, which call for bug hunters to delay the announcement of security holes until some time after the company has provided a fix. That way, people who use flawed products are protected from attack, the argument goes.
Last weekend, however, Ferris came close to running afoul of those guidelines by posting a brief description of the bug on his Security Protocols Web site and talking to the media about the flaw. So far, the move has done little more than raise some eyebrows at Microsoft.
"I am walking a fine line, but I am doing it very carefully because I am not disclosing actual vulnerability details," Ferris said. "I do this to inform users that flaws still do exist in IE...I don't like it that Microsoft tries to give users a nice warm feeling that they are disclosing everything researchers report to them."
At issue is the push for "responsible disclosure" of software flaws by many industry players, including titans such as Microsoft, Oracle and Cisco.
Microsoft publicly chastises security researchers who don't follow its rules. Also, those researchers won't get credit for their flaw discovery in Microsoft's security bulletin, which is published when the company releases a patch. Because Ferris did not disclose any actual vulnerability details, he's still on Microsoft's good side, a company representative said.
While many software makers promote responsible disclosure, it isn't universally backed by the security community. Critics say it could make security companies lazy in patching. Full disclosure of flaws is better, they say, and turns up the heat on software makers to protect their customers as soon as possible.
How long is too long?
"Microsoft obviously takes way too long to fix flaws," Ferris said. "All researchers should follow responsible disclosure guidelines, but if a vendor like Microsoft takes six months to a year to fix a flaw, a researcher has every right to release the details."
By that time someone else, perhaps...
For more, click here...
Talkback
Vendors shouldn't lay down security related disclosure rules. Period.
When a researcher finds a flaw he/she should post it in full on a special members only disclosure list and 30 days after the same information should be posted on a public list by someone else. End of story.
That should motivate vendors and researchers alike to be very carefull as to what they publish (or sell on the markets). As well as making sure that they follow up with all required resources.
Don't like? Then make sure that, 1, you don't get posted or, 2, that if you get posted you can fix things within 30 days.
Nothing is perfect. We all know that. So make sure that you're prepared to handle inperfections in a timely matter. In fact, that aspect should have been part of the general design.
The only two constants in IT are: damage and change. So master that. The rest will be part of history sooner or later.
There's plenty of blame to go around.
The software makers are responsible for preventing and repairing issues with the software. This means they should keep any foreseeable holes out of there software and QUICKLY remove any that turn up despite their efforts to prevent them. Those that don't are the blame for making an insecure product; no more, no less.
The press and IT/security professionals are responsible for informing the software makers and computer users of any problems in such a way that does not compound the issue. Those that don't are the blame for reenforcing the problem by preventing appropriate communication.
The IT/security professionals and end users are responsible of understanding and applying the appropriate patches to already installed version of the software. Those that don't are the blame for leaving the issue in play.
The malicious hacker, are also the blame for exploiting these problems and actually aggravating them.