HackDig : Dig high-quality web security articles for hacker

Security company sues to bar disclosure related to its own flaws

2015-09-11 14:50

FireEye is a publicly traded security firm that regularly finds and reports vulnerabilities in Adobe Flash and Apple's iOS and Google's Android operating systems. But when security researcher Felix Wilhelm found five critical flaws in FireEye's Malware Protection System, the company sued to obtain an injunction barring the disclosure of some of the technical details.

The move is generating howls of protest among security professionals, who argue that FireEye of all companies should know better than to stifle the free flow of vulnerability information. They point out that ERNW, the German consultancy that found the vulnerabilities, privately notified FireEye of the findings in April, more than four months before FireEye sued to prevent Wilhelm from providing technical details related to the flaws. In the future, critics argued, it would be better if researchers publicly reported their findings first rather than give private notice. On Thursday, ERNW founder Enno Rey also criticized the move.

"We can only speculate what the intentions are from their side," Rey wrote in a blog post. "In general we consider it an inappropriate strategy to sue researchers responsibly reporting security vulnerabilities [for the protocol, without asking for money or anything else]."

Wilhelm spoke Thursday at the 44CON conference in London. One of the presentation slides Wilhelm displayed during his talk was censored to comply with the injunction, which was issued by a court in Hamburg, Germany. Rather than providing technical information that Wilhelm said was necessary to fully understand how the now-patched vulnerabilities worked, the slide was blacked out except for the words "architecture" and "rejected."

FireEye representatives told IDG News that the injunction was necessary to prevent the leakage of technical information that could be used against people using its products.

"We were not willing to expose any of the proprietary information that would put our business and customers at risk," a FireEye spokesperson wrote. "Under German law, they were also not allowed to release intellectual property that was not theirs."

At least some of the five vulnerabilities are compounded by the fact that some FireEye software runs with root privileges on top of the Apache Web server. One flaw, according to Forbes, allowed attackers to open a backdoor by sending booby-trapped e-mails to a customer. The vulnerabilities have since been fixed.

Source: f-nwo-sti-ot-detaler-erusolcsid-rab-ot-seus-ynapmoc-ytiruces/90/5102/ytiruces/moc.acinhcetsra

“Security company sues to bar disclosure related to its own flaws”0 Comments

Submit A Comment



Blog :

Verification Code:


Share high-quality web security related articles with you:)


Tag Cloud