Measuring Vulnerability Rediscovery
New paper: “Taking Stock: Estimating Vulnerability Rediscovery,” by Trey Herr, Bruce Schneier, and Christopher Morris:
Abstract: How often do multiple, independent, parties discover the same vulnerability? There are ample models of vulnerability discovery, but little academic work on this issue of rediscovery. The immature state of this research and subsequent debate is a problem for the policy community, where the government’s decision to disclose a given vulnerability hinges in part on that vulnerability’s likelihood of being discovered and used maliciously by another party. Research into the behavior of malicious software markets and the efficacy of bug bounty programs would similarly benefit from an accurate baseline estimate for how often vulnerabilities are discovered by multiple independent parties.
This paper presents a new dataset of more than 4,300 vulnerabilities, and estimates vulnerability rediscovery across different vendors and software types. It concludes that rediscovery happens more than twice as often as the 1-9% range previously reported. For our dataset, 15% to 20% of vulnerabilities are discovered independently at least twice within a year. For just Android, 13.9% of vulnerabilities are rediscovered within 60 days, rising to 20% within 90 days, and above 21% within 120 days. For the Chrome browser we found 12.57% rediscovery within 60 days; and the aggregate rate for our entire dataset generally rises over the eight-year span, topping out at 19.6% in 2016. We believe that the actual rate is even higher for certain types of software.
When combined with an estimate of the total count of vulnerabilities in use by the NSA, these rates suggest that rediscovery of vulnerabilities kept secret by the U.S. government may be the source of up to one-third of all zero-day vulnerabilities detected in use each year. These results indicate that the information security community needs to map the impact of rediscovery on the efficacy of bug bounty programs and policymakers should more rigorously evaluate the costs of non-disclosure of software vulnerabilities.
We wrote a blog post on the paper, and another when we issued a revised version.
Comments on the original paper by Dave Aitel. News articles.
Subscribe to comments on this entry
reggie • July 31, 2017 7:22 AM
I wonder if there are deeper and more generic mechanisms at work here. When I founded a startup company, I got funded by a venture capital company (a VC, as they are known). My contact in the VC told me that they routinely received approaches from people, all of whom had had the same idea for a new company at the same time. In fact, apparently they used the number in the cluster of related proposals as a measure of how good an idea was, and only chose the best pitch when they had exceeded more than a threshold number of ‘same ideas’.
A cynic (what, in the comments on this blog, surely not?) might assign this to industrial espionage, poor security, etc., but there’s a lot of arguments against this happening: huge attack surface that you need to monitor, ideas tend to only happen very infrequently, many ideas are developed by individuals working on their own…
I wonder if there’s something about technology that means that lots of people receive subtle clues about something that then builds until it eventually emerges as an ‘idea’. Does ‘being informed’ or ‘reading blogs’ provide some of these nudges that sometimes turn into ideas, or rediscoveries?
(My assumption is that three letter agencies are already well aware of this, have studied it, have characterised it, and that cluster thresholds are part of their standard operating practice…)