Security researchers 'aiding' cyber-crooks

Powered by SC Magazine
 

Security researchers should stop publishing vulnerabilities in the traditional way because cyber-criminals are using the code to generate zero-day exploits at record speeds, says a recent report.

The mid-year Trend Statistics report from IBM's X-Force team shows that cyber-criminals are using automated software tools to launch zero-day exploits more quickly than ever before.

The report claimed that 94 per cent of all browser-related online exploits occurred within 24 hours of official vulnerability disclosure.

The practice of disclosing exploit code along with a security advisory is accepted practice for many security researchers.

However, according to the X-Force report, vulnerabilities disclosed by independent researchers are twice as likely to have zero-day exploit code published.

IBM believes that this calls into question how researchers practise vulnerability disclosure, and highlights a need for a new standard in the industry.

"The two major themes in the first half of 2008 were acceleration and proliferation," said X-Force operations manager Kris Lamb.

"We see a considerable acceleration in the time a vulnerability is disclosed to when it is exploited, with an accompanying proliferation of vulnerabilities overall."

Lamb warned that, without a unified process for disclosing vulnerabilities, the research industry runs the risk of actually fuelling online criminal activity.

"There is a reason why X-Force does not publish exploit code for the vulnerabilities we have found, and perhaps it is time for others in our field to reconsider this practice," he said.

Copyright ©v3.co.uk


 
 
 
Top Stories
Inside the stalemate on Australia's piracy code
Still not registered almost five months on.
 
IT staff outline deep anger in Macquarie Uni survey
‘Morale at lowest point in a decade’.
 
Cost blowout to push NBN past $41bn budget
But government funding cap to remain.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
New Windows 10 users, are you upgrading from...




   |   View results
Windows 8
  48%
 
Windows 7
  44%
 
Windows XP
  4%
 
Another operating system
  2%
 
Windows Vista
  1%
TOTAL VOTES: 656

Vote