1

I am not a security professional. About 2.5 months ago I discovered systemic vulnerabilities in my employer's software with the potential for financial damage to customers if exploited.

A logged in user's ability to access or modify form data is checked when a form is loaded, but a POST of form data does not check authentication before saving. I was not able to exploit this unless I logged on as a user with lower privileges.

The vulnerability was reported to the company; but since fixing the problem requires a near complete rewrite of the application authentication and form submit code, the company has decided to continue releasing feature improvements while working on fixing the vulnerabilities over a much longer period (6 to 12 months). I do not know how many people in the company know this is happening, nor do I know if the legal people have assessed/approved the decision.

The application is a very large web application maintained by a team of three developers and one tester (me). There are no other developers or testers in the company.

A significant release of new functionality without any security fixes is being planned for about 6 weeks from now.

The company is publicly traded in the USA. Customer and individual bank account information is part of the saved data handled by the application.

Is my employer engaging in illegal or unethical behavior by releasing new functionality while the security flaws remain uncorrected?

  • Legalities are off-topic here (depends on jurisdiction). Ethics becomes an interesting question since they have a plan to remediate. At what speed of remediation would the ethics not be in question? – schroeder Jan 10 '17 at 17:51
  • Is it already released with the flaws, or will it be released in the future? I could read your question 2 ways. – schroeder Jan 10 '17 at 18:15
  • 1
    Regarding software releases with known vulnerabilities, this quote may be useful: "A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one." You can expect a company to apply the same decision process here. – Peteris Jan 10 '17 at 18:44
  • 6
    I should mention that your name is attached to this post, and there's a reasonable likelihood that someone could use this information to figure out your employer, the product you test, and begin probing more closely for the vulnerability you mention. This could potentially be a leak of information that might get you in trouble with your employer or the law. You may wish to redact more information from your post. – Jesse K Jan 10 '17 at 18:46
  • 2
    Your company should have a phone number for employees to anonymously report legal or ethical issues to an outside company that your company employees to protect itself. It is likely in your employee handbook. You should take advantage of this in a case like this. – David Schwartz Jan 10 '17 at 18:52
3

It is legal to sell imperfect products

The general standard for selling products is that they are required to be fit for the purpose for which they're sold and advertised. They are not required to be a very good fit for the purpose. They are not required to be fit for other purposes. They are certainly not required to be free of all flaws, risks and potential misuses - as long as they are mostly fit for a particular purpose, it is legal to sell them.

For example, it is completely legal to sell doors that can be smashed open by a scrawny teenager. It is completely legal to sell physical locks that can be picked open by a bobby pin. It is completely legal to do so even if you're completely aware that these vulnerabilities exist. These doors and locks are still fit for purpose even if explicitly advertised for the purpose of "keeping intruders out" - they are not required to be perfect at that purpose; it's okay to manufacture and sell flimsy doors and flimsy locks even if everybody knows that they could be made much more secure with some modifications.

Pretty much all software is released with known bugs, i.e., the company bug tracking system lists many unfixed problems of varying importance. Again, this is evidence that having known defects by itself isn't sufficient to make software unfit for purpose. Even when released without any known bugs, no software is fully secure - pretty much every nontrivial package has had multiple security vulnerabilities. This doesn't mean that they are not fit for purpose - they certainly allow users to perform useful tasks even if the vulnerabilities are never patched, so they are fit for that purpose even if they are totally unsecure.

For example, many systems similar to your system (as it looks like from the question) would be quite useful even if they didn't have any authentication and all users had full access. In that case it would be fit for purpose even with a totally flawed authentication system; some authentication is better than no authentication and no authentication also would be acceptable in this case - not too good, but acceptable.

One can imagine certain niches of software which are absolutely not useful if their security is flawed. Most software is clearly not in this category, but e.g. disk encryption or password management software could be. However, even then it would be a question of how severe the vulnerability is. As in the example of flimsy locks, an imperfect security solution that protects against some but not all attacks is generally considered fit for purpose.

Ethics of selling low quality products

The ethical situation is a bit different than the legal mandate, but again I believe we can draw parallels from sale of physical items.

For any given type of product consumers reasonably expect that there will be differences of quality depending on the brand. Some shoes will be much better than others, and it's nice; and some shoes will be much cheaper than others, and that's nice as well - both are valid choices for consumers and manufacturers.

It's a completely valid and ethical strategy to make and sell low quality items. Someone may reasonably intentionally buy a low quality item, for example, because it's cheaper. Someone may reasonably intentionally choose low quality software, for example, because it's cheaper. People may make, distribute and use free software that is well known to have as much holes as swiss cheese, and simply avoid using it in contexts where security is important. A customer ordering a custom development may reasonably choose to have their supplier work on new features over fixing known security flaws - it is their choice to make, and it's ethical to make a product according to these priorities.

What is unethical is misleading customers. If you want to advertise that your product is better in quality than the competition, then it's ethical iff it actually is so. If you want to advertise that your product will hide sensitive data from authorised local users without proper permissions, then it's ethical iff it actually is true. However, do note that this is talking about the ethics of advertising and communication - the unethical act is not the selling of shoddy software, but the lies about your product.

In your particular example, the ethical way would be to ensure that the vulnerability is publicly disclosed. In that case, the customers can make an informed decision on how and if they should use the product, how important that vulnerability is to them and if it makes a meaningful difference to them.

All this is assuming that we're talking about defects of various severity, not malicious code - intentionally placing backdoors is strictly different.

  • The question is not about releasing software with a bug. Almost all software companies do that. Let us say that as I client I discover this vulnerability and decide to start a lawsuit against the company. I will also claim that they injected this vulnerability on purpose. Since they already know, it exists. In other words, it is a malicious code that they put. – Ubaidah Jan 10 '17 at 20:51
  • 1
    Shipping a known defect is strictly different than injecting a vulnerability on purpose - in both cases it's the same code put in by the same people, but the intent is different, and intent is a major deciding factor in law. You can definitely claim that they did put there on purpose, but I would be quite surprised if that would be accepted in court without some specific evidence showing intent. And yes, I definitely am claiming that shipping a known security flaw is exactly the same as shipping a serious known flaw of some other kind. – Peteris Jan 10 '17 at 21:00
  • Very well detailed, should be the accepted answer. – dark_st3alth Jan 10 '17 at 21:31
2

Risk Analysis is the centre of most Information Security certifications.

Will you ever have a product that is considered completely secure? No. Even paper and pen has a implicit risk to it, and that's why dumpster diving is still used by attackers to this day.

Can it be assumed that someone will never take advantage of a flaw in security? No. Does that mean we should be ringing the alarm bells each time a flaw is found? Depends on who you work for, but the answer tends to be no. Part of the risk analysis is not only how often this vulnerability might be taken advantage of, but also how severe it is.

The company you work for can be perfectly within the legal bounds to accept that there is a flaw, but as long as they do not misrepresent a future patch/update as resolving the security flaw, then all is OK.

What is considered ethical and moral however, is to make sure that customers are very well aware of flaws with your software. The degree of detail is up to the seller, and arguably to the legal system as well. The reason is not purely to "pass the buck" in terms of information security, but so that customers can make a well informed risk assessment. A vastly more secure system may cost sums more than a system which has a minor and well known vulnerability. As a small company, which would you be willing to pay for?

-1

I had to edit my answer since ethical and legal have fuzzy definitions, and it seems ethical is a matter of preference :)

For sure it is unethical, and from the legal point of view. Releasing a software knowing that the software has a major vulnerability that could result in financial damage is possibly a crime (at least where I come from). Therefore your company is waiting for a lawsuit to happen.

The fact that the company know about this vulnerability for most likely will void an insurance (insurance companies will not cover the damage caused by this vulnerability)

As a professional, you should make sure that responsible people in your company are aware of this vulnerability and understand the scope and outcome if this vulnerability is discovered. You may look at the case in this link Insurance company Columbia Casualty lawsuite

  • 2
    crime != lawsuit - 2 different fields of law – schroeder Jan 10 '17 at 18:01
  • Why is it unethical? They know about it and have a fix planned. The software is already released. It's just the fix that's in question. – schroeder Jan 10 '17 at 18:02
  • 2
    Releasing a software knowing that the software has a major vulnerability that could result in financial damage is not a crime in any jurisdiction that I know of. It may result in a civil claim if actual damage occurs, but the effectiveness of that will depend mostly on the licencing and contract details, and certainly is based only on actual incidents, not simply enabling potential incidents. Releasing software with known vulnerabilities that could result in loss of life is another issue, though, that may well be classified as a crime. – Peteris Jan 10 '17 at 18:37
  • 1
    Furthermore, we do know of vulnerabilities in the wild that can be trivially exploited to kill people, namely, vulnerabilities in cars allowing e.g. remote disabling of brakes and turning the steering wheel on a highway. As of now, no prosecutor has attempted to investigate this as a crime; all we have is civil liability against e.g. Toyota brake software faults but no criminal processes. – Peteris Jan 10 '17 at 18:42
  • 1
    @Peteris Theoretically, almost any act of fraud can be prosecuted criminally. At least arguably, selling a product when you know that product can cause harm in a manner that you fail to disclose to your customers could be considered fraud. Companies have legal departments so that they can make sure the legal risks they're taking are acceptable. Also, there are countries other than the US that tend to prosecute criminally with much greater frequency and ease. Also, there are PR risks. – David Schwartz Jan 10 '17 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy