Security vendors should embrace those hunting bugs in their products

Posted by   Virus Bulletin on   Feb 1, 2016

Security software is software too — and it will have flaws.

Last week, I was interviewed for the Risky Business podcast. I really enjoyed the experience, not just because I've long been a fan of the show, but also because we discussed a subject I really care about: the security of security products.

If you follow the security news, you will have noticed that several researchers (with Google's Tavis Ormandy most prominent among them) are currently hunting for vulnerabilities in anti-virus and other security products. After disclosing the vulnerabilities to the relevant vendors in a responsible manner, they write about their findings on Twitter and on various blogs.

The media loves these stories, and "Security product actually makes you less secure!" is a headline that's hard to resist. Which is fair enough. After all, the last thing you want is for your security product to be used as a means for attackers to gain access to your system.

Still, we shouldn't forget that security software is software: it's written by humans who make mistakes, or who simply haven't had the time (or the incentive) to check whether old code actually follows today's secure coding practices.

And thus the only right response for security vendors is to embrace the work of Tavis and others. In my VB2015 opening address, I urged security vendors to seriously consider setting up bug bounty programs, if only to make it absolutely clear that they don't pretend their software is without flaws. Several vendors have set up such programs; other may follow soon, or are at least making it easy to report bugs to them.

Of course, when speaking to affected vendors, one does realise that often the exploitability of vulnerabilities is overstated, that other mitigations may have already been in place, or at least that the flaw in question was patched within days. There have even been cases where a researcher has simply misunderstood the purpose of a specific function. That feels, and probably is, unfair, but it's only the same as what other software vendors have had to deal with for years.

Of course, not working for a vendor makes it easier for me to write these things. But even those who do work for vendors, despite the occasional grumble, do really appreciate the work of Ormandy and others. As is so often the case in security, it's by working together that we get the best results.

As for the Risky Business podcast, the weekly show is a great way to get a summary of the week's security news and to listen to thought-provoking interviews with leading security experts. You won't regret listening to it.

Risky Business

 

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2021 localhost call for last-minute papers

The call for last-minute papers for VB2021 localhost is now open. Submit before 20 August to have your paper considered for one of the slots reserved for 'hot' research!

New article: Run your malicious VBA macros anywhere!

Kurt Natvig explains how he recompiled malicious VBA macro code to valid harmless Python 3.x code.

New article: Dissecting the design and vulnerabilities in AZORult C&C panels

In a new article, Aditya K Sood looks at the command-and-control (C&C) design of the AZORult malware, discussing his team's findings related to the C&C design and some security issues they identified.

VB2021 localhost call for papers: a great opportunity

VB2021 localhost presents an exciting opportunity to share your research with an even wider cross section of the IT security community around the world than usual, without having to take time out of your work schedule (or budget) to travel.

New article: Excel Formula/Macro in .xlsb?

In a follow-up to an article published last week, Kurt Natvig takes us through the analysis of a new malicious sample using the .xlsb file format.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.