Who "brands" vulnerabilities?

Question

It appears that every time there's a vulnerability discovered major enough to hit the news, its been assigned a brand name and often even a logo. Heartbleed, Spectre, Meltdown, Foreshadow, etc. Who decides and produces these? Is it typically the person / group who discovered the bug, the group with responsibility for the affected product, or someone else?

I understand malicious software is typically named / branded by its author, but it seems odd that someone is out there coming up with names and designing logos for vulnerabilities.

Answer 1

They are all branded by the people discovering them. There's even a note on the wiki for Heartbleed:

Logo representing Heartbleed. Security company Codenomicon gave Heartbleed both a name and a logo, contributing to public awareness of the issue.

Spectre/Meltdown explains the branding on their site. As does Foreshadow (same artist).

Such publicity helps to make the issue mainstream and more shareable and suitable for pick-up by the general media. This helps to make the problem more well-known, as well as the people who created the brand. Just like any other marketing.

Given that it is relatively cheap to get a logo designed (welcome to the gig economy), the return on investment, even for an expensive logo, is huge if it gets picked up by the media.