9

I recently discovered a way to bypass a commonly used security seal system, requiring no special equipment and taking only a matter of seconds. I feel obliged to disclose this, so as to avoid the possibility of users of that seal system harbouring a false sense of security.

I would use CERT's Vulnerability Reporting Form, but that is only intended for software vulnerabilities.

Is there an equivalent responsible disclosure system in place for the physical security industry?

  • 7
    Attempt to contact the security seal manufacturer directly. If that fails try e-mailing the International Seal Manufacturers Association (ISMA) ismasecurity.com/Contact-Us.html – this.josh Jun 1 '14 at 8:26
9

First of all, set your expectations appropriately:

The physical security industry isn't quite like the information security industry. The probability that they don't already know everything you figured out is pretty slim. They may have even known about your technique before they went to market.

By assuming you have something novel, how do you realistically expect then to react? Would this mean simply retooling their process? Inventing a new sealing technique? Shutting down entire companies?

Physical security isn't perfect. It isn't even good. Not in comparison to what we have in IT. For example, lockpicking technique has been well understood for literally centuries, but most locks on the market today are still highly susceptible.

By going public you're guaranteed to make people mad on both sides. But the only way you can even hope to improve things is to present not just the problem, but also a commercially-viable solution. Then press the solution, not the problem.

  • 4
    The manufacturer is currently promoting it as a highly secure product, so either they don't know about the vulnerability, or they are behaving in a manner so unethical as to be indefensible. If informed of the vulnerability, I would expect them, at the very least, to stop promoting this product in that fashion; better still, they could issue a product recall. The manufacturer has other revenue streams, so I doubt very much any companies would need to close. – sampablokuper Jun 2 '14 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.