A company's responsibility to their customers?

[Codewiz]

I am just curious about the prevailing opinions here. A friend of mine has discovered an extremely poor implementation in a security product on the market that is used by many different corporations and universities. And by extremely poor implementation, I mean full on compromise and potential to create a botnet easily. In about 100 lines of code, he can do whatever he wants to any computer that has this product installed.

He is going through the proper channels to report it but the design is so poor, the company is going to have to likely scrape 90% of the existing code and redesign the product. Therefore, I think the company is going to try and keep it quiet.

What is the general opinion on companies and releasing information about severe vulnerabilities to their customers? In this case, I believe every customer should be notified ASAP so they can assess the threat model and determine whether they continue to use the product. I can say turning off the product would actually provide more security than leaving it on if this vulnerability started to be targeted.

Additionally, the compounding threat to me is that universities utilizing the product put not only identities at risk but also research.

So what responsibility does companies have to their customers when they sell a product that has such gaping security holes that put their customers at risk?

 

[seepy83]

I've heard researchers in the Info Sec community discuss the concept of Reasonable Disclosure. There's an article about it here: http://www.thetechherald.com/articl...ability-disclosure-a-brief-chat-with-HD-Moore

Cliffs from that article:
Day 1: After discovering and documenting the vulnerability, provide details to the software vendor
Day 15: Provide the same details to CERT
Day 60: 45 days after CERT receives the info, they publish a public security advisory

 

[Chiefcrowe]

I agree, after the company is notified and working on the fix, we should find out asap so that we can consider moving to a different product.

I wonder which one it is.....

 

[Codewiz]

He is doing exactly as seepy mentioned. Our concern is the arbitrary classification by the affected vendor. In their case, they use three criteria when classifying the severity. 1. Whether an exploit exists in the wild. 2. The level of effort to fix. 3. The impact if the vulnerability is exploited.

We feel that due to #1 and #2, there is little doubt, they won't classify it as high risk. Even though any computer science student with any interest in crypto would quickly discovered how flawed the product is.

I will say it is a well respected company's product.

 

[seepy83]

He is doing exactly as seepy mentioned. Our concern is the arbitrary classification by the affected vendor. In their case, they use three criteria when classifying the severity. 1. Whether an exploit exists in the wild. 2. The level of effort to fix. 3. The impact if the vulnerability is exploited.

We feel that due to #1 and #2, there is little doubt, they won't classify it as high risk. Even though any computer science student with any interest in crypto would quickly discovered how flawed the product is.

I will say it is a well respected company's product.

If the vulnerability is as severe as you are making it sound, involving CERT should get them motivated.

Or he could hold out until the beginning of August and release the info to the masses at Black Hat :twisted: