Security vendors should embrace those hunting bugs in their products

Posted by   Virus Bulletin on   Feb 1, 2016

Security software is software too — and it will have flaws.

Last week, I was interviewed for the Risky Business podcast. I really enjoyed the experience, not just because I've long been a fan of the show, but also because we discussed a subject I really care about: the security of security products.

If you follow the security news, you will have noticed that several researchers (with Google's Tavis Ormandy most prominent among them) are currently hunting for vulnerabilities in anti-virus and other security products. After disclosing the vulnerabilities to the relevant vendors in a responsible manner, they write about their findings on Twitter and on various blogs.

The media loves these stories, and "Security product actually makes you less secure!" is a headline that's hard to resist. Which is fair enough. After all, the last thing you want is for your security product to be used as a means for attackers to gain access to your system.

Still, we shouldn't forget that security software is software: it's written by humans who make mistakes, or who simply haven't had the time (or the incentive) to check whether old code actually follows today's secure coding practices.

And thus the only right response for security vendors is to embrace the work of Tavis and others. In my VB2015 opening address, I urged security vendors to seriously consider setting up bug bounty programs, if only to make it absolutely clear that they don't pretend their software is without flaws. Several vendors have set up such programs; other may follow soon, or are at least making it easy to report bugs to them.

Of course, when speaking to affected vendors, one does realise that often the exploitability of vulnerabilities is overstated, that other mitigations may have already been in place, or at least that the flaw in question was patched within days. There have even been cases where a researcher has simply misunderstood the purpose of a specific function. That feels, and probably is, unfair, but it's only the same as what other software vendors have had to deal with for years.

Of course, not working for a vendor makes it easier for me to write these things. But even those who do work for vendors, despite the occasional grumble, do really appreciate the work of Ormandy and others. As is so often the case in security, it's by working together that we get the best results.

As for the Risky Business podcast, the weekly show is a great way to get a summary of the week's security news and to listen to thought-provoking interviews with leading security experts. You won't regret listening to it.

Risky Business

 

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Security products and HTTPS: let's do it better

A recent paper showed that many HTTPS-intercepting security solutions have implemented TLS rather poorly. Does that mean we should avoid such solutions altogether?

The SHA-1 hashing algorithm has been 'shattered'

Researchers from Google and CWI Amsterdam have created the first known collision of the SHA-1 hashing algorithm, making a very strong case to ditch it.

Throwback Thursday: Once a researcher...

VB was saddened to learn this week of the passing of one of the pioneers of the AV industry, Ross Greenberg. This Throwback Thursday we look back at an interview with Ross in November 1995.

VB2017: What is happening in the threat landscape and what are we doing against it? Submit a proposal in the VB2017 CFP!

Have you analysed a new online threat? Do you know a new way to defend against such threats? Then submit an abstract in the CFP for VB2017!

VB2016 paper: APT reports and OPSEC evolution, or: these are not the APT reports you are looking for

APT reports are great for gaining an understanding of how advanced attack groups operate - however, they can also provide free QA for the threat actors. Today, we publish a VB2016 paper by Gadi Evron (Cymmetria) and Inbar Raz (Perimeter X), who…