Scribd
Upload
10 views1 page

Gray Hat Hacking 78

The document discusses the ongoing debate between vendors, security companies, and gray hat hackers regarding the disclosure of software vulnerabilities. It highlights the frustrations of both customers and vendors due to existing flaws and the challenges in communication and collaboration. The CERT Coordination Center's policy on vulnerability disclosure, which mandates public announcements within 45 days, is outlined as a key framework in addressing these issues.

Uploaded by

digapo7593
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
10 views1 page

Gray Hat Hacking 78

The document discusses the ongoing debate between vendors, security companies, and gray hat hackers regarding the disclosure of software vulnerabilities. It highlights the frustrations of both customers and vendors due to existing flaws and the challenges in communication and collaboration. The CERT Coordination Center's policy on vulnerability disclosure, which mandates public announcements within 45 days, is outlined as a key framework in addressing these issues.

Uploaded by

digapo7593
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

Gray Hat Hacking, The Ethical Hacker’s Handbook, Third Edition

50
details would be released to its customers and the public at a “prescribed period of
time” after the vendor has been notified. ISS coordinates their public disclosure of the
flaw with the vendor’s disclosure. This policy only fueled the people who feel that vul-
nerability information should be available for the public to protect themselves.
This dilemma, and many others, represents the continual disconnect among ven-
dors, security companies, and gray hat hackers today. Differing views and individual
motivations drive each group down various paths. The models of proper disclosure that
are discussed in this chapter have helped these different entities to come together and
work in a more concerted effort, but much bitterness and controversy around this issue
remains.

NOTE The range of emotion, the numerous debates, and controversy


over the topic of full disclosure has been immense. Customers and security
professionals alike are frustrated with software flaws that still exist in the
products in the first place and the lack of effort from vendors to help in this
critical area.Vendors are frustrated because exploitable code is continually
released just as they are trying to develop fixes. We will not be taking one side
or the other of this debate, but will do our best to tell you how you can help,
and not hurt, the process.

CERT’s Current Process


The first place to turn to when discussing the proper disclosure of software vulnerabili-
ties is the governing body known as the CERT Coordination Center (CC). CERT/CC is a
federally funded research and development operation that focuses on Internet security
and related issues. Established in 1988 in reaction to the first major virus outbreak on
the Internet, the CERT/CC has evolved over the years, taking on more substantial roles
in the industry, which includes establishing and maintaining industry standards for the
way technology vulnerabilities are disclosed and communicated. In 2000, the organiza-
tion issued a policy that outlined the controversial practice of releasing software vulner-
ability information to the public. The policy covered the following areas:

• Full disclosure will be announced to the public within 45 days of being


reported to CERT/CC. This timeframe will be executed even if the software
vendor does not have an available patch or appropriate remedy. The only
exception to this rigid deadline will be exceptionally serious threats or
scenarios that would require a standard to be altered.
• CERT/CC will notify the software vendor of the vulnerability immediately so
that a solution can be created as soon as possible.
• Along with the description of the problem, CERT/CC will forward the name of
the person reporting the vulnerability unless the reporter specifically requests
to remain anonymous.
• During the 45-day window, CERT/CC will update the reporter on the current
status of the vulnerability without revealing confidential information.

You might also like