Are Bug Disclosures Helping or Hurting?

In attempting to fix the problem of software vulnerabilities, we are inadvertently helping the bad guys by telling them where to find the problems.

That is the conclusion of an IBM Internet Security Systems X-Force report released today, which found that 80 percent of all vulnerabilities that are published, either by vendors or third-party sites like BugTraq, have an exploit crafted for them within 24 hours.

Further, 94 percent of all browser-related online exploits occurred within 24 hours of official vulnerability disclosure, and online attacks are the most popular form of attack.

The exploit usually comes in the form of sample code included in developer “kits” that are sold on the Internet underground for quick and easy development of all sorts of malware.

Holly Stewart, an X-Force researcher and editor of the report, said it’s time to reconsider such public disclosures. “The problem is that in the research community, people have felt it is best practice to have full disclosure,” she told InternetNews.com.

“For the longest time, the security community has held on to this common practice. Five years ago we didn’t have exploit toolkits on the underground to build exploits. Today, this is becoming a problem. I think we have to shift gears and reconsider this full disclosure policy and is the impact doing the best thing for the greater good,” she said.

It can be a double edged sword. In 2004, security firm eEye Digital found an exploit in Windows that was turned into the Sasser worm within three days after it was posted to Bugtraq. Sasser turned into one of the biggest Internet worms in history. So do we keep feeding the malware trolls?

Responsible disclosure?

Ken Dunham, director of global response for iSIGHT Partners, said it’s a tough call. “Certainly the concept of responsible disclosure involves two words, ‘responsible’ and ‘disclosure’. If you go out to the Internet at large and reveal a large security hole without informing the vendor, then you have given the bad guys an advantage they would not have through tradition non-public disclosure,” he told InternetNews.com.

Even with responsible disclosure, even if a vendor hears about a problem and works on it for weeks before issuing a patch, as soon as the patch is released it’s reverse engineered by the bad guys, he added. “It becomes a race between how fast can you test and implement it versus how fast can the bad guys weaponize it.”

Next page: Popular targets

Page 2 of 2

Popular targets

The biggest source of weakness is the ever-popular browser plug-in. IBM found that in the first six months of 2008, roughly 78 percent of Web browser exploits targeted browser plug-ins.

Another popular target is the SQL server database. SQL injection vulnerabilities jumped from 25 percent in 2007 to 41 percent of all Web server application vulnerabilities in the first half of 2008.

The problem is not in SQL or that confusing mess that SQL code can be. The problem, said Stewart, is in the Web page forms. “Some times it’s easier to allow the SQL statement in the form. When you do that, you allow SQL injection statements to pass from the form field to the database,” she explained.

“A lot of Web developers may not know better practices to avoid these vulnerabilities, they may see it as a cheaper way to achieve the required results.”

Among some of the newer trends: spammers have dropped gimmicks like image spam or writing keywords in an almost unreadable manner (h3rb4l V1-4gra) in favor of just a link to known, reputable sites, such as blog pages. Domains like WordPress and Blogger are trusted and get past spam filters, as opposed to the normal keywords that get caught.

Russia remains the biggest producer of spam, responsible for 11 percent of the world’s spam, followed by Turkey with 8 percent and then the United States with 7.1 percent.

Online financial institutions are the top target, with 18 of the top 20 phishing targets being financial institutions. However, online gaming is coming up quick. The top four password-stealing Trojans were all aimed at gamers. Because there is a healthy market for in-game assets, accounts are frequently stolen and sold for real world cash.

IBM ISS X-Force’s report is available online.

News Around the Web