The recent CopyFail disclosure leaves a lot to be desired for defenders. Because of the vagaries around impacted systems and patch availability (including hallucinated RHEL versions?), defenders are left to themselves to figure out how to respond. So I thought we could discuss this.
What does an ideal vulnerability disclosure look like?
Actions
For me, as always, actionability is what matters most. If you do a (very enjoyable) technical deep dive, but neglect to inform folks how to protect against a vulnerability, you’ve forgotten what this is all about. These actions should be at the top of the article, so busy defenders can get busy defending. The exploit nerds can scroll.
(I am both).
PoCs
Also, PoC after responsible disclosure. Vague videos of an anonymous Python script or binary gaining root/SYSTEM is unhelpful. We know now that more information always benefits defenders, so if you have a PoC that works and there is a patch available, share it.
Technicals
These are, I think, the most fun part to write, but they often assume knowledge on behalf of the audience that might be absent. A best effort to cite sources, reference documentation, and when jargon is necessary, define or link to definitions.
That’s all I can think of right now. What about you?
I am not sure if that adds to the perspective but i wish there would be some kind of pre-disclosure measurements (responsible) reporters would follow.
There i would like to see a planned timetable (even for planned events like the actual disclosure) but also the measurements taken to prepare providers upfront.
Also not sure if that’s thought to wide but a some kind of RACI-alike matrix showing of which lists, vendors, whatsoever were informed (and may already have taken over responsibility).
As a Defender also timeline for the vuln management software (Tenable, Rapid7, Qualys etc..) to detect it if applicable. The amount of times I have had to wait a day or so before the databases update to show in scans, and other teams not seeing the vulnerable software due to their reliance on vuln scan reporting to make something actionable is amazing and a big problem in some enterprises.
Hmm, that is a nice-to-have. Is that a thing one can reasonably expect of a researcher? It would seem to require coordination and pre-disclosure with multiple vendors besides the impacted party.
Oh absolutely a detection means. Personally, I think YARA/Sigma as appropriate should be standard fare, and both are vendor-independent. You mentioned timelines from vuln scanners, which I think is a much harder ask.
I would think that the major players would/should have a way to take YARA/Sigma and convert it at this point.
Half the problem is so many people rely on those platforms to “prove” they are vulnerable, which is so much of the battle to getting an emergency patch out there. But I won’t derail this thread any more on this. Probably a discussion to be had on its own.