Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

modzero.com

Post reply on HN
Print view View original

131–140 of 167 posts

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#131

Post by akerl_ »

monocasa wrote: post #126
tptacek wrote: post #121

Earlier quoted context omitted.

No, I was there at the inception of this term, and it was absolutely originally imagined as a way of controlling researchers and giving vendors more power over information about their products. It has pissed researchers off for decades, as it implies that not following the "responsible" process makes one per se "irresponsible".

> No, I was there at the inception of this term, and it was absolutely originally imagined as a way of controlling researchers and giving vendors more power over information about their products. I mean, that half is the carrot to get vendors to play ball and actually fix their shitty code occasionally. It lets unaffiliated white hat security researchers who are just trying to get sec issues fixed actually get some f…

What's an example of a researcher being lambasted for disclosing a vulnerability to the public?

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#132

Post by roblabla »

tptacek wrote: post #98
jcims wrote: post #97

Earlier quoted context omitted.

Is there still a safe harbor if you go that route?

You don't need "safe harbor" to test software you install on your own machine (which is what Crowdstrike is), and if you're testing someone else's server, you'd better have permission already.

The problem is with the publishing part. It's pretty unclear - to me at least - what the legal status of publishing 0days is around the world. In the USA, I'd expect it to be protected by free speech, but even then I wouldn't be 100% sure.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#133

Post by 0x457 »

bsamuels wrote: post #77
tptacek wrote: post #44

This seems extremely tame by vulnerability disclosure fuckup standards.

Seriously. I don't think the researcher realizes how many people try to bypass hackerone because H1 would have flagged their finding as invalid. Using h1 isn't about bug bounties, it's about not having to spend a 1-2 of your team's full time engineers triaging security researcher reports.

We had some of the dumbest H1 "findings" at some companies that I worked:

- Service that is explicitly out of scope of program is "leaking" default CloudFront headers.

- Android application can be decompiled (that's it, not secret is there, just the fact that it's possible)

- "I can do something bad IF I had a way to load malicious JavaScript" (no, CSRF protection was one and correctly implemented) (there is also no way to upload your own JavaScript)

- "I can do things if I open a console in a browser" (can't do anything because CORS policy only allowed for read-only endpoints)

- "You can make requests with CURL and not official client"

Every week, there was at least one variation of one of those reports. "Hackers" also got very defensive about their "findings" and acted like we don't want to pay them for some "mega hack of the year 0day total domination of user device" vulnerabilities.

Not once has anyone found even a minor vulnerability, just wannabes trying to get quick cash. Until we had H1 we had zero reports, with H1 we had moronic reports every other day.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#134

Post by tptacek »

FreakLegion wrote: post #130
tptacek wrote: post #67

Earlier quoted context omitted.

"Responsible" disclosure is an Orwellian term. The real term is "coordinated disclosure", and, as you can see from the timeline, there's coordination here.

You're watering down the meaning of Orwellian just a tad here but sure, "responsible" has a value judgment baked in that "coordinated" is mercifully free of. On the other hand, "coordinatedly disclosed" doesn't work as well in a sentence.

It's Orwellian because the term was deliberately chosen in order to coerce researchers into accepting the priorities of vendors (by implicitly rendering non-"responsible" disclosure "irresponsible"). I think it's actually one of the better modern examples of Orwellian language in tech.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#135

Post by monocasa »

akerl_ wrote: post #131
monocasa wrote: post #126

Earlier quoted context omitted.

> No, I was there at the inception of this term, and it was absolutely originally imagined as a way of controlling researchers and giving vendors more power over information about their products. I mean, that half is the carrot to get vendors to play ball and actually fix their shitty code occasionally. It lets unaffiliated white hat security researchers who are just trying to get sec issues fixed actually get some f…

What's an example of a researcher being lambasted for disclosing a vulnerability to the public?

The example I generally use is when Peter Bright went on a several month set of tirades while a staff writer for arstechnica lambasting project zero disclosing a microsoft vulnerability after the disclosure window was up. Hard to find the source though now that his articles have been scrubbed ever since he got caught trying to diddle some children. : \ In the comments, most of the devops/sysadmin community of arstechnica took his side that you shouldn't disclose publicly at all, missing the point that others might be actively exploiting the same vulnerability. You routinely see the same sentiment even on HN (thankfully in the minority now), missing the point that while finding exploits is hard work and generally takes very smart individuals, that's not to the point of being able to assume that someone else who wears a slightly darker hat didn't figure out the same bug.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#136

Post by tptacek »

monocasa wrote: post #126
tptacek wrote: post #121

Earlier quoted context omitted.

No, I was there at the inception of this term, and it was absolutely originally imagined as a way of controlling researchers and giving vendors more power over information about their products. It has pissed researchers off for decades, as it implies that not following the "responsible" process makes one per se "irresponsible".

> No, I was there at the inception of this term, and it was absolutely originally imagined as a way of controlling researchers and giving vendors more power over information about their products. I mean, that half is the carrot to get vendors to play ball and actually fix their shitty code occasionally. It lets unaffiliated white hat security researchers who are just trying to get sec issues fixed actually get some f…

As Google proved long ago, the only thing you have to do to get vendors to fix their shitty code is to set a fixed timeline for disclosure; just tell the vendor "please let us know when this is patched, and we're disclosing regardless after 60 days".

The point of calling it "responsible" has nothing to do with defending researchers; it's literally the opposite. The norms of "responsible" disclosure were absolutely not the norms of vulnerability reearchers of the time. The term was invented back in the early aughts by @stake, then the largest software security consultancy in the world (my company, Matasano, was essentially a spin-off of @stake; one of my cofounders was an @stake cofounder).

This is one of those things, like "Zero Trust Networking", where people read the term, (reasonably) believe they understand what the words mean, and then axiomatically derive the concept. But, no, the concept has its own history and its own meaning; the words have little to do with it (except that here, it's especially obvious what's problematic about the words themselves).

The industry has largely moved away from "Responsible" disclosure to "Coordinated" disclosure, for all the reasons I've given here. Even CERT, the most conservative organization in software security, uses the new term now.

Later edit

This originally read The norms of "responsible" disclosure were absolutely not the norms of "Responsible Disclosure", which was a typo.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#137

Post by Thorrez »

fisf wrote: post #90
Thorrez wrote: post #71

Earlier quoted context omitted.

Well in this case the vulnerability is the ability to uninstall the program when you're not supposed to be able to uninstall it. So yes, if the program didn't exist at all, there would be no way to uninstall it in an unauthorized manor. So the vulnerability wouldn't exist. You wouldn't necessarily be any more secure though. If you have 10 layers of security and 5 have holes in them, you have 5 vulnerabilities, but yo…

What is the vulnerability here? An admin user can do admin stuff. Shocking.

Yeah, I'm not 100% sure. I'm not sure what the threat model for Uninstall Protection is. The official description page isn't completely clear.

>Uninstall protection prevents unauthorized users from uninstalling the Falcon Agent

>The “Maintenance Manager” role is available which grants permission to access the maintenance tokens. This role must be enabled against the Falcon user’s account in order to obtain maintenance tokens or manage policy related to Uninstall Protection.

Putting those 2 sentences together seems to lead to the conclusion that if someone doesn't have the "Maintenance Manager" role, that person will be prevented from uninstalling the Falcon Agent. It's unclear to me if all admin users are considered to have the Maintenance Manager role.

https://www.crowdstrike.com/blog/tech-center/uninstall-prote...

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#138

Post by tptacek »

monocasa wrote: post #135
akerl_ wrote: post #131

Earlier quoted context omitted.

What's an example of a researcher being lambasted for disclosing a vulnerability to the public?

The example I generally use is when Peter Bright went on a several month set of tirades while a staff writer for arstechnica lambasting project zero disclosing a microsoft vulnerability after the disclosure window was up. Hard to find the source though now that his articles have been scrubbed ever since he got caught trying to diddle some children. : \ In the comments, most of the devops/sysadmin community of arstech…

I don't much care what Peter Bright thinks or said a decade ago. Peter Bright isn't a security researcher, or on a vendor security team. He's just some guy (or, was some guy) on Twitter. Project Zero, meanwhile, is the global gold standard for coordinated vulnerability disclosure.

Lots of people with better reputations than Bright have publicly lobbied against disclosure of any sort. Bruce Schneier is a great example of this; if you're an old industry head, Marcus Ranum is another name here. The point isn't that everybody agrees with me about "Responsible Disclosure"; it's that everybody who matters does.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#139

Post by tptacek »

roblabla wrote: post #132
tptacek wrote: post #98

Earlier quoted context omitted.

You don't need "safe harbor" to test software you install on your own machine (which is what Crowdstrike is), and if you're testing someone else's server, you'd better have permission already.

The problem is with the publishing part. It's pretty unclear - to me at least - what the legal status of publishing 0days is around the world. In the USA, I'd expect it to be protected by free speech, but even then I wouldn't be 100% sure.

Publishing vulnerabilities in the US is protected speech. You get in trouble with disclosing vulnerabilities in the US in four ways, ordered from most to least common:

1. You tested someone else's servers, and not software running on your own computer, and you didn't get permission or adhere to the rules of engagement the target established. Now you're not a researcher, you're an intruder, subject to CFAA. There's a bright line in US law between your computer and someone else's computer.

2. You tested software running on your own computer, but you acquired that software by agreeing to a contract prohibiting research, reverse engineering, or disclosure (ie: any NDA). Now you've violated a contract, and can be sued civilly for doing so. This comes up a fair bit when testing stuff on behalf of big enterprises, where all the software acquisitions come with big, enforceable contracts. I've had to cave a bunch of times on disclosures because of this; most memorably, I got locked in a vendor's suite at Black Hat an hour before my talk redacting things, because that vendor had a binding contract with my consulting client.

3. You were wrong about the vulnerability, or it could plausibly be argued that you were wrong, and you made a big stink about it. You're still a researcher, but you've also possibly defamed the target, which is a tort that you can be sued for.

4. You disclosed a vulnerability that you'd previously leaked, or provided exploit tooling regarding, to a criminal enterprise. Now you're not a researcher, you're an accomplice to the criminal enterprise. This has come up with people writing exploits for carding rings --- they weren't (or couldn't be proved to be) carders themselves, but they explicitly and knowingly enabled the carding.

As you can see, disclosing vulnerabilities isn't the least scary thing you can do with speech in the US, but it's not that much more scary than, say, leaving a nasty Yelp review for a dentist's office (something that also gets people sued). Just (a) don't test servers and (b) don't give secret bugs to organized criminals.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#140

Post by conioh »

ajross wrote: post #96
outworlder wrote: post #93

Earlier quoted context omitted.

> Bug disclosure without a known remedy has to be an absolute last resort kind of thing, and it's actually a little upsetting that modzero used that tactic as a kind of threat I don't think it is upsetting at all. "We found a vulnerability" "There's no vulnerability" "No, you misunderstand, here's how it works and how to exploit" "Naah, no vulnerability" "Ok, if there's no vulnerability as you claim, you don't mind u…

The thing is, "releasing our findings to the public" puts the vendor's customers at risk, it's not just some imagined Just Punishment For The Guilty, innocents get hurt. Imagine if you took a new job and they had a bunch of hardware sitting around from such a vendor. Would you be OK if someone published an exploit for your systems? (In this case, the vulnerability seems minor, so it's sort of academic. But I'm not un…

No post body was provided.
Post reply on HN