Google Security Pushes for 7-Day Vulnerability Publishing
May 30, 2013 2:29 PM
comment(s) - last by
This could encourage companies to issue security patches more quickly
is backing a new seven-day deadline that would allow researchers to make serious vulnerabilities public a week after notifying a company.
Google security engineers Chris Evans and Drew Hintz said they want critical vulnerabilities under active exploitation to be published seven days after researchers have informed the company about them. They said this will lead to quicker patches and cut the risk of further problems in the future.
“Our standing recommendation is that companies should fix critical vulnerabilities within 60 days — or, if a fix is not possible, they should notify the public about the risk and offer workarounds,” said Evans and Hintz. “We encourage researchers to publish their findings if reported issues will take longer to patch. Based on our experience, however, we believe that more urgent action — within seven days — is appropriate for critical vulnerabilities under active exploitation. The reason for this special designation is that each day an actively exploited vulnerability remains undisclosed to the public and unpatched, more computers will be compromised.”
Right now, companies use either responsible disclosure or full disclosure when dealing with vulnerabilities. Responsible disclosure allows a company as much time as they want to patch an exploit, and the details surrounding the bug aren't revealed to the public until a patch is issued. Full disclosure, on the other hand, means the company and the public are given information about the flaw at the same time.
Three years ago, Google's security team introduced a 60-day notice in order to find a happy medium between the two disclosures. This meant that researchers could publish details about a flaw for the public to see after 60 days whether a patch was issued or not.
But it looks like Google is taking this a giant step further by advocating a new seven-day deadline, where researchers can make details about a flaw public only a week after telling the company about it.
However, Google realizes that seven days is not enough time to patch all vulnerabilities. Even if a company can't address the bug in seven days, the researchers could still publish the details of the software flaw after a week so that the public can protect itself.
Earlier this month, Google security engineer Tavis Ormandy
exposed a Microsoft flaw
on Full Disclosure. The Microsoft vulnerability, which was in the Windows kernel driver "Win32k.sys," was featured in a Full Disclosure mailing list on May 17.
Ormandy also insulted Microsoft on Full Disclosure, saying "As far as I can tell, this code is pre-NT (20+ years) old, so remember to thank the SDL for solving security and reminding us that old code doesn't need to be reviewed ;-)."
Microsoft has been annoyed with Ormandy for publicly discussing vulnerabilities before they could be patched. Microsoft prefers "responsible disclosure," where security experts are asked to report flaws privately to the company.
Google Online Security Blog
This article is over a month old, voting and posting comments is disabled
5/30/2013 4:49:37 PM
This is just a guidance 7 days.
There is absolutely nothing that requires disclosure in 7 days, nor is there anything that absolutely forbids the discoverer from disclosing on day zero.
I believe it would be nice if every security investigator that found a hole waited at least 60 days after disclosure to the developer to disclose it to the public as I believe if you can't solve the issue in 60 days (which includes a reasonable testing period) the developer either can't solve it without major architecture changes or the developer doesn't care enough to solve it.
Many small to medium sized developers may not have the resources to respond to vulnerabilities with a fully vetted fix within seven days. Why set up a system that actively penalizes them?
And this does not go for vulnerabilities already being actively exploited in the wild. In those cases the vulnerability needs to be disclosed immediately (though maybe not disclose the low level, nuts and bolts of how the vulnerability is exploited).
"Let's face it, we're not changing the world. We're building a product that helps people buy more crap - and watch porn." -- Seagate CEO Bill Watkins
Google Engineer Finds Microsoft Security Flaw, Says Company is Hostile About It
May 23, 2013, 10:51 AM
Chris Poole Retires From Role as 4Chan After a Decade of Success, Struggles
January 23, 2015, 1:45 PM
Study Shows People are Dumb as Ever With Passwords, Still Using "123456"
January 20, 2015, 3:19 PM
Site for "Glitter as a Service" Mail Pranks, ShipYourEnemiesGlitter, Launches
January 13, 2015, 2:22 PM
OS X Yosemite Compromises Security by Retrieving Embedded Email Images
January 13, 2015, 11:30 AM
ISIS JIhadi From NZ Accidentally Shares Location on Twitter, Outs Cohorts in Selfie
January 3, 2015, 11:35 PM
Amazon's Kindle Fire HDX 8.9 Drops to $299 (30 Percent Off) for a Day
December 22, 2014, 10:57 AM
Most Popular Articles
Microsoft Shows Off Latest Windows 10 Build, Preps it for Next Week Release
January 21, 2015, 2:57 PM
IDC: 2014 Sales Show PC Isn't Dead, But Desktop May be Dying
January 19, 2015, 1:50 PM
Police are Using New Handheld Radar Sensors to Peer Into Houses w/out Warrant
January 20, 2015, 1:35 PM
Great Expectations: The Rise and Fall of Google Glass Explorer Edition
January 16, 2015, 1:14 AM
Report: HTC One M9 (2015) is Tied to Under Armour-Powered HTC Smartwatch
January 19, 2015, 11:10 AM
Latest Blog Posts
Sceptre Airs 27", 120 Hz. 1080p Monitor/HDTV w/ 5 ms Response Time for $220
Dec 3, 2014, 10:32 PM
Costco Gives Employees Thanksgiving Off; Wal-Mart Leads "Black Thursday" Charge
Oct 29, 2014, 9:57 PM
"Bear Selfies" Fad Could Turn Deadly, Warn Nevada Wildlife Officials
Oct 28, 2014, 12:00 PM
The Surface Mini That Was Never Released Gets "Hands On" Treatment
Sep 26, 2014, 8:22 AM
ISIS Imposes Ban on Teaching Evolution in Iraq
Sep 17, 2014, 5:22 PM
More Blog Posts
Copyright 2015 DailyTech LLC. -
Terms, Conditions & Privacy Information