9

While participating in a bug bounty program, I stumbled upon an issue which led to a security vulnerability when exploited with other issues on unrelated products.

All those issues aren't security vulnerabilities per se, but they become one when combined. None of the issues is more critical than the others.

I would like that vulnerability to be fixed, so I plan to report it to vendors.

Following responsible disclosure guidelines, each report should not contain information about the other vendors' issues, but I'm afraid that all vendors will reject the report, explaining that their issue is the expected behavior.

Each vendor has a security program and a competent security team. The only problem is communicating the issues' impact to each of them.

What would be the best way to handle this problem?

5
  • Are the products/companies totally isolated, or is this a supply-chain related issue? I am very interested in the outcome of this.
    – JonRB
    Mar 6, 2018 at 0:19
  • 1
    @JonRB: They are fully isolated. Mar 6, 2018 at 0:33
  • 1
    @JonRB: A full fix needs each product to be fixed. The issue can be made more difficult to exploit if any of them fixed the issue, though. Mar 6, 2018 at 0:50
  • (Sorry, deleted comment because I messed up a part) I fear you may have to pray for very understanding security teams. If you don't want to disclose, you can still tell the teams they are part of a bigger picture. Does it require all of the companies involved to fix, or will the issue be resolved if even a single company fixes it?
    – JonRB
    Mar 6, 2018 at 0:51
  • 3
    If your primary goal is to have the vulnerability fixed you might contact the US-CERT. They even have a checkbox there to let them know that "I need assistance with coordinating the disclosure of a specific vulnerability". Mar 6, 2018 at 4:53

2 Answers 2

5

Involve a trusted third n-th party.

While JonRB's approach can work, involving another trusted party, like a national or transnational CERT, can speed up the process and bring it to the desired outcome.

We have seen in the past, that big companies did not react properly to reports of major bugs/vulnerabilities in their products. The companies in question either did not react at all, did not try to develop a solution or sometimes the issue just got lost in a big corporate labyrinth. This ultimately led researchers to publishing vulnerabilities on their own to pressure vendors.

When you involve another trusted like a CERT, you can be relatively sure that the affected companies will realize the seriousness of the matter and handle the issue with a certain elevated attention.

Be sure though, that you trust the party that you plan to involve. If the companies that are involved are based in different countries there is probably no one single entity with authority over all of them. Luckily most of the world's bigger CERTs work together and are (somewhat) organized.

1
  • How did I forget this?! This is probably the better answer because CERT organisations will have a process for this kind of disclosure.
    – JonRB
    Mar 8, 2018 at 0:29
4

Intitial Communications

The first step here is to contact the security teams individually. Let them know that they are part of a bigger picture, but that you don't want to publicise the list of companies involved. It's important that you put in as much detail as you can without naming the companies, so that you aren't disregarded for being too vague.

It is also important to make it clear in your messaging that if each company does their part, this issue will be completely resolved. It may also be worth asking the company at this stage whether or not they are happy to be named in a more detailed report, so that they can work with each other more transparently.

Gather responses

You will now have to await the response of each team and assess how many "will not fix" responses you get. If companies are willing to be made aware of one another, you should be able to the security teams may be willing to reprioritised based on the new information. Otherwise you may have to produce some subset of the report for the companies that are happy to be named.

In any of your messaging, you can state that you have been able to obtain the information required for any missing steps using other companies that would rather not be named.


Aside

You may also want to look to the way the KRACK Attacks (for example) were handled with vendors to see how vendor-independent issues have been handled in the past.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .