Responsible Disclosure Debates……What about No Disclosure?

Posted on July 27th, 2008 by Drazen Drazic

This topic has been hot again in recent times and we’ve been asked a few times on what our position to this is. In the past, and with our previous relationships, we’ve been in the “responsible disclosure” camp. Advisories went out after the vendors had announced patches to the vulnerabilities announced, (and in some cases exploits developed in parallel to confirm the proof of concept). It seems the camps are divided in two as described here but is the third option of no-disclosure outside of vendor/client a major consideration that hasn’t had much discussion (relatively)? What percentage of vulns in systems and applications are never disclosed? Why isn’t this seen as potentially a major part of how vulns are dealt with? How skewed are figures in yearly stats and surveys due to this area, (and I don’t mean sales of vulns to organisations who buy them - I mean those vulns discovered in vendor systems and applications and those detected in personal engagements for clients for home grown systems and applications)?

This is probably a position Securus Global adopts more than others - with each case determined on a case by case basis. I know the percentage rate of what we find compared to that “responsibly disclosed” and then post or about to post as a world-wide advisory is hugely lop-sided. While we are waiting on a few vendors at present, there’s probably 10 fold more that we work directly to fix with vendors and applications that will never see the light of day. Is that the better alternative? Keen on your thoughts……

It depends on your philosophy and thoughts on what is right and wrong, relationships with vendors and most importantly, relationships with clients whose systems may have just as significant issues as those “major” and largely deployed systems and applications. Case by case basis?

Is one seen as a successful IT security researcher (or genius in our field) because they publish everything? Are those guys who never publicly disclose to be discounted or not considered as the upper echelons of the research community themselves because they don’t publish, but rather work to quietly fix what can be fixed to minimise impact to the wider community - most importantly, clients and the business servicing those clients?

It’s a bit of a catch 22 - you disclose and you become famous. You work quietly in the background and you remain a no-name but who’s adding most value to the goals of the industry?

Is the tide just going to be too strong towards selling of vulns…with few left who aren’t making good dollars having no choice but to head down that path? Seems to be heading that way sadly. Has the argument by either taking one of two positions and not a third seriously considered meant that we set a future that could have been different?

In a way, it comes down to your own thoughts on what you think is right, what you personally want to achieve as an individual and importantly also, how parties you deal with react to what you do. Am I overly simplifying this? Am I being too naive? Has the horse bolted now? Am I just plain wrong to think we’ve had a third option that could/could have worked?