Security vendors should embrace those hunting bugs in their products

Posted by   Virus Bulletin on   Feb 1, 2016

Security software is software too — and it will have flaws.

Last week, I was interviewed for the Risky Business podcast. I really enjoyed the experience, not just because I've long been a fan of the show, but also because we discussed a subject I really care about: the security of security products.

If you follow the security news, you will have noticed that several researchers (with Google's Tavis Ormandy most prominent among them) are currently hunting for vulnerabilities in anti-virus and other security products. After disclosing the vulnerabilities to the relevant vendors in a responsible manner, they write about their findings on Twitter and on various blogs.

The media loves these stories, and "Security product actually makes you less secure!" is a headline that's hard to resist. Which is fair enough. After all, the last thing you want is for your security product to be used as a means for attackers to gain access to your system.

Still, we shouldn't forget that security software is software: it's written by humans who make mistakes, or who simply haven't had the time (or the incentive) to check whether old code actually follows today's secure coding practices.

And thus the only right response for security vendors is to embrace the work of Tavis and others. In my VB2015 opening address, I urged security vendors to seriously consider setting up bug bounty programs, if only to make it absolutely clear that they don't pretend their software is without flaws. Several vendors have set up such programs; other may follow soon, or are at least making it easy to report bugs to them.

Of course, when speaking to affected vendors, one does realise that often the exploitability of vulnerabilities is overstated, that other mitigations may have already been in place, or at least that the flaw in question was patched within days. There have even been cases where a researcher has simply misunderstood the purpose of a specific function. That feels, and probably is, unfair, but it's only the same as what other software vendors have had to deal with for years.

Of course, not working for a vendor makes it easier for me to write these things. But even those who do work for vendors, despite the occasional grumble, do really appreciate the work of Ormandy and others. As is so often the case in security, it's by working together that we get the best results.

As for the Risky Business podcast, the weekly show is a great way to get a summary of the week's security news and to listen to thought-provoking interviews with leading security experts. You won't regret listening to it.

Risky Business

 

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Firefox 59 to make it a lot harder to use data URIs in phishing attacks

Firefox developer Mozilla has announced that, as of version 59 of the browser, many kinds of data URIs, which provide a way to create "domainless web content", will not be rendered in the browser, thus making this trick - used in various phishing…

Standalone product test: FireEye Endpoint

Virus Bulletin ran a standalone test on FireEye's Endpoint Security solution.

VB2017 video: Consequences of bad security in health care

Jelena Milosevic, a nurse with a passion for IT security, is uniquely placed to witness poor security practices in the health care sector, and to fully understand the consequences. Today, we publish the recording of a presentation given by Jelena at…

Vulnerabilities play only a tiny role in the security risks that come with mobile phones

Both bad news (all devices were pwnd) and good news (pwning is increasingly difficult) came from the most recent mobile Pwn2Own competition. But the practical security risks that come with using mobile phones have little to do with vulnerabilities.

VB2017 paper: The (testing) world turned upside down

At VB2017 in Madrid, industry veteran and ESET Senior Research Fellow David Harley presented a paper on the state of security software testing. Today we publish David's paper in both HTML and PDF format.