Out of James Aguilar

Recently there's been a lot of talk about the "anti-sec" – anti-security -- movement.  They are a group that attacks security-minded websites, especially those that publish exploits for known vulnerabilities.  They justify themselves by claiming that the security industry, through its general policy of "full disclosure," is actually more guilty of compromising security than the hackers they supposedly protect against.  A lot of people think they are bad guys because "information should be free."

The policy of full disclosure is a means by which security experts convince software makers to fix security problems.  The way it typically works is that a security expert will discover a bug that compromises the security of an application.  They will disclose this bug to the software's manufacturer, then later to everyone.  During the window after learning of the bug, the software manufacturer must fix it or substantially risk the security of its users and long-term business.  The policy's origin is the bad old days, when software makers did not immediately fix security vulnerabilities upon being notified.  Full disclosure's proponents say this method enhances security by giving companies a concrete, probable timeframe for exploitation of a weakness, which demands a fix with more urgency than the possibility that a bad guy will find the vulnerability and exploit it.

Full disclosure is a morally shaky stance.  A real-world metaphor is a housing developer who builds a development in a war zone.  Throughout this warzone, mines have been placed that can be triggered from secret locations around the area.  Security experts look for the mines' triggers and contact the developer when they discover such a device.  They say, "Find and diffuse this mine within a week, or we will disclose the location of its trigger to parties who would benefit from your downfall."  Most of the time, the developer will fix the mines within the timeframe.  Rarely he cannot or does not and some of the homes he has built (and their owners) get blown up.  The security expert publishes the location of the trigger and says, "I'm pretty good at finding these things.  Look at this one!  You should contract with me so you can have me searching for the triggers to your mines full-time."

The morally questionable part is when you threaten to tell the location of a weapon to anyone who is interested in order to force some action.  No question it's legal.  Ethically, I would not want to be the one making such a threat.  Moreover, it may not lead to better outcomes for users.  Full disclosure might be less altruistic than the security industry in general has admitted.

For users, if a bug isn't fixed but also isn't disclosed by the security industry to the general public, the odds of it being widely exploited seem to be relatively low.  (The justification for full disclosure in the first place is to induce companies to fix bugs that they otherwise would not on private disclosure, presumably because they feel that rediscovery by malicious parties is unlikely.)  And because of implementation or deployment delays, vulnerabilities often still exist "in the wild" when disclosure occurs, increasing users' exposure to attack.  I am not sure of any exact numbers, but it seems likely that full disclosure is responsible for many of the exploits that currently exist, and such exploits mostly target unpatched software.

(A large part of the remaining exploits might come from the fixes themselves, since attackers frequently search for the vulnerabilities fixed by security patches and make exploits to attack unpatched systems.  Such exploits, when "disclosed," provide even less utility to the general public than the full-disclosure practiced by typical security researchers.  This is why Microsoft recommends that you install security updates immediately.  Even if an exploit for a patched vulnerability didn't exist before a patch's release, it won't be long until one does after update Monday.)

The argument for full disclosure defeats itself.  If software makers would not fix bugs without full disclosure, then the odds of bugs being found again must be relatively low.  But if this is the case, then the importance of getting those bugs fixed and transitively the moral justification for holding a gun to software makers' heads is absent.

Security researchers probably believe that they are being altruistic by fully disclosing bugs.  They are giving away their work "for free."  But I don't buy it.  When we look for the cause for human action, self-interest is always a good place to start.   What do security researchers get from full disclosure?  Recognition and advertisement mostly, and maybe personal satisfaction or pride.  I'm not familiar with the standard practices of engagement with security researchers, but if you engage one to work on your product he will only practice full disclosure if you allow it in the contract.  So employment, or to put it another way, hush money, is another benefit.

 Everyone has to eat.  The threat of full disclosure allows security researchers to do so while providing the valuable service of vetting software.  Without full disclosure, it would probably be much more difficult to work full time at security research.  If we believe that the practice of full disclosure is wrong, only two things can be done:

• Make it against a bug-finder's interest to disclose a bug.  Make it illegal.  Then no one will release bugs under their own name, and the third party security industry will decline.  (This is not necessarily a good outcome.  Internal security can only do so much, and bugs will still be disclosed anonymously.)
• Give the bug-finder an incentive to keep the bug hidden.  For example, provide significant bounties for undisclosed bugs.  For example, pay the researcher a cut of what it would have cost  the company to deal with the fallout had the bug been disclosed.