In
computer security
Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, t ...
, coordinated vulnerability disclosure, or "CVD" (formerly known as responsible disclosure)
is a
vulnerability disclosure model in which a vulnerability or an issue is disclosed to the public only after the responsible parties have been allowed sufficient time to
patch
Patch or Patches may refer to:
Arts, entertainment and media
* Patch Johnson, a fictional character from ''Days of Our Lives''
* Patch (''My Little Pony''), a toy
* "Patches" (Dickey Lee song), 1962
* "Patches" (Chairmen of the Board song ...
or remedy the vulnerability or issue. This coordination distinguishes the CVD model from the "
full disclosure" model.
Developers of hardware and software often require time and resources to repair their mistakes. Often, it is ethical hackers who find these vulnerabilities.
and computer security scientists have the opinion that it is their
social responsibility
Social responsibility is an ethical framework in which an individual is obligated to work and cooperate with other individuals and organizations for the benefit of the community that will inherit the world that individual leaves behind.
Social ...
to make the public aware of vulnerabilities. Hiding problems could cause a feeling of
false security. To avoid this, the involved parties coordinate and negotiate a reasonable period of time for repairing the vulnerability. Depending on the potential impact of the vulnerability, the expected time needed for an emergency fix or workaround to be developed and applied and other factors, this period may vary between a few days and several months.
Coordinated vulnerability disclosure may fail to satisfy security researchers who expect to be financially compensated. At the same time, reporting vulnerabilities with the expectation of compensation is viewed by some as extortion.
While a market for vulnerabilities has developed, vulnerability commercialization (or "bug bounties") remains a hotly debated topic. Today, the two primary players in the commercial vulnerability market are iDefense, which started their vulnerability contributor program (VCP) in 2003, and
TippingPoint, with their zero-day initiative (ZDI) started in 2005. These organizations follow the coordinated vulnerability disclosure process with the material bought. Between March 2003 and December 2007 an average 7.5% of the vulnerabilities affecting Microsoft and Apple were processed by either VCP or ZDI. Independent firms financially supporting coordinated vulnerability disclosure by paying
bug bounties include
Facebook
Facebook is an online social media and social networking service owned by American company Meta Platforms. Founded in 2004 by Mark Zuckerberg with fellow Harvard College students and roommates Eduardo Saverin, Andrew McCollum, Dust ...
,
Google
Google LLC () is an American Multinational corporation, multinational technology company focusing on Search Engine, search engine technology, online advertising, cloud computing, software, computer software, quantum computing, e-commerce, ar ...
, and
Barracuda Networks
Barracuda Networks, Inc. is a company providing security, networking and storage products based on network appliances and cloud services. The company's security products include products for protection against email, web surfing, web hackers ...
.
Disclosure policies
Google Project Zero has a 90-day disclosure deadline which starts after notifying vendors of vulnerability, with details shared in public with the defensive community after 90 days, or sooner if the vendor releases a fix.
ZDI has a 120-day disclosure deadline which starts after receiving a response from the vendor.
Examples
Selected
security vulnerabilities resolved by applying coordinated disclosure:
*
MD5 collision attack that shows how to create false CA certificates, 1 week
*
Starbucks
Starbucks Corporation is an American multinational chain of coffeehouses and roastery reserves headquartered in Seattle, Washington. It is the world's largest coffeehouse chain.
As of November 2021, the company had 33,833 stores in 80 cou ...
gift card double-spending/race condition to create free extra credits, 10 days (Egor Homakov)
*
Dan Kaminsky discovery of
DNS cache poisoning, 5 months
*
MBTA vs. Anderson, MIT students find vulnerability in the Massachusetts subway security, 5 months
*
Radboud University Nijmegen breaks the security of the
MIFARE Classic cards, 6 months
* The
Meltdown vulnerability, hardware vulnerability affecting
Intel x86 microprocessors and some
ARM-based microprocessors, 7 months.
* The
Spectre vulnerability, hardware vulnerability with implementations of
branch prediction
In computer architecture, a branch predictor is a digital circuit that tries to guess which way a branch (e.g., an if–then–else structure) will go before this is known definitively. The purpose of the branch predictor is to improve the flow ...
affecting modern microprocessors with
speculative execution
Speculative execution is an optimization technique where a computer system performs some task that may not be needed. Work is done before it is known whether it is actually needed, so as to prevent a delay that would have to be incurred by doing ...
, allowing malicious
processes
A process is a series or set of activities that interact to produce a result; it may occur once-only or be recurrent or periodic.
Things called a process include:
Business and management
*Business process, activities that produce a specific se ...
access to the
mapped memory contents of other programs, 7 months.
* The
ROCA vulnerability, affecting RSA keys generated by an
Infineon library and
Yubikeys, 8 months.
[The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli]
Matus Nemec, Marek Sys, Petr Svenda, Dusan Klinec,Vashek Matyas, November 2017
See also
*
Information sensitivity
Information sensitivity is the control of access to information or knowledge that might result in loss of an advantage or level of security if disclosed to others.
Loss, misuse, modification, or unauthorized access to sensitive information can ...
*
White hat (computer security)
*
Computer emergency response team
A computer emergency response team (CERT) is an expert group that handles computer security incidents. Alternative names for such groups include computer emergency readiness team and computer security incident response team (CSIRT). A more modern ...
*
Critical infrastructure protection
External links
The CERT Guide to Coordinated Vulnerability DisclosureCISA Coordinated Vulnerability Disclosure (CVD) ProcessMicrosoft's Approach to Coordinated Vulnerability DisclosureDutch National Cyber Security Centre Coordinated Vulnerability Disclosure GuidelineHewlett-Packard Coordinated Vulnerability Disclosure policyLinksys Coordinated Vulnerability Disclosure ProgramGlobal Forum on Cyber Expertise Coordinated Vulnerability Disclosure policyETSI Coordinated Vulnerability Disclosure policy
References
{{reflist
Computer security procedures
Disclosure
*