Security vendors should embrace those hunting bugs in their products

Posted by   Virus Bulletin on   Feb 1, 2016

Security software is software too — and it will have flaws.

Last week, I was interviewed for the Risky Business podcast. I really enjoyed the experience, not just because I've long been a fan of the show, but also because we discussed a subject I really care about: the security of security products.

If you follow the security news, you will have noticed that several researchers (with Google's Tavis Ormandy most prominent among them) are currently hunting for vulnerabilities in anti-virus and other security products. After disclosing the vulnerabilities to the relevant vendors in a responsible manner, they write about their findings on Twitter and on various blogs.

The media loves these stories, and "Security product actually makes you less secure!" is a headline that's hard to resist. Which is fair enough. After all, the last thing you want is for your security product to be used as a means for attackers to gain access to your system.

Still, we shouldn't forget that security software is software: it's written by humans who make mistakes, or who simply haven't had the time (or the incentive) to check whether old code actually follows today's secure coding practices.

And thus the only right response for security vendors is to embrace the work of Tavis and others. In my VB2015 opening address, I urged security vendors to seriously consider setting up bug bounty programs, if only to make it absolutely clear that they don't pretend their software is without flaws. Several vendors have set up such programs; other may follow soon, or are at least making it easy to report bugs to them.

Of course, when speaking to affected vendors, one does realise that often the exploitability of vulnerabilities is overstated, that other mitigations may have already been in place, or at least that the flaw in question was patched within days. There have even been cases where a researcher has simply misunderstood the purpose of a specific function. That feels, and probably is, unfair, but it's only the same as what other software vendors have had to deal with for years.

Of course, not working for a vendor makes it easier for me to write these things. But even those who do work for vendors, despite the occasional grumble, do really appreciate the work of Ormandy and others. As is so often the case in security, it's by working together that we get the best results.

As for the Risky Business podcast, the weekly show is a great way to get a summary of the week's security news and to listen to thought-provoking interviews with leading security experts. You won't regret listening to it.

Risky Business




Latest posts:

Test your technical and mental limits in the VB2017 foosball tournament

As has become tradition, VB2017 will once again see a security industry table football tournament. Register your team now for some great fun and adrenaline-filled matches in between sessions in Madrid!

The case against running Windows XP is more subtle than we think it is

Greater Manchester Police is one of many organizations still running Windows XP on some of its systems. This is bad practice, but the case against running XP is far more subtle than we often pretend it is.

Hot FinSpy research completes VB2017 programme

Researchers from ESET have found a new way in which the FinSpy/FinFisher 'government spyware' can infect users, details of which they will present at VB2017 in Madrid.

Transparency is essential when monitoring your users' activities

Activity monitoring by security products in general, and HTTPS traffic inspection in particular, are sensitive issues in the security community. There is a time and a place for them, VB's Martijn Grooten argues, but only when they are done right.

VB2017 preview: Android reverse engineering tools: not the usual suspects

We preview the VB2017 paper by Fortinet researcher Axelle Apvrille, in which she looks at some less obvious tools for reverse engineering Android malware.