It appears that every time there's a vulnerability discovered major enough to hit the news, its been assigned a brand name and often even a logo. Heartbleed, Spectre, Meltdown, Foreshadow, etc. Who decides and produces these? Is it typically the person / group who discovered the bug, the group with responsibility for the affected product, or someone else?

I understand malicious software is typically named / branded by its author, but it seems odd that someone is out there coming up with names and designing logos for vulnerabilities.

  • 3
    Which is easier to communicate about, CVE-2014-0160 or Heartbleed? – Andy Lester Aug 16 at 21:50
up vote 74 down vote accepted

They are all branded by the people discovering them. There's even a note on the wiki for Heartbleed:

Logo representing Heartbleed. Security company Codenomicon gave Heartbleed both a name and a logo, contributing to public awareness of the issue.

Spectre/Meltdown explains the branding on their site. As does Foreshadow (same artist).

Such publicity helps to make the issue mainstream and more shareable and suitable for pick-up by the general media. This helps to make the problem more well-known, as well as the people who created the brand. Just like any other marketing.

Given that it is relatively cheap to get a logo designed (welcome to the gig economy), the return on investment, even for an expensive logo, is huge if it gets picked up by the media.

  • 1
    Ha ha, interesting to know how these things work. I read about this before but never bothered to check in more detail. – sir_k Aug 15 at 13:44
  • 8
    Also makes it easier for those in the industry to discuss it. Sysadmins will prefer saying "Have we patched Spectre yet?" rather than going by its CVE number. Also makes it a lot easier to communicate to upper manglement and other shareholders. – flith Aug 16 at 6:19
  • 16
    @flith hehe "manglement" - I have not heard that one in a while – schroeder Aug 16 at 7:49

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.