

Responsible Disclosure Can Be Anything But - daeken
http://daeken.com/responsible-disclosure-can-be-anything-but

======
sriramk
I'm shocked he didn't even try to contact Onity. He's trying ascribe
motivations and possible behavior just based on his reading of the lock market
- we have no idea whether Onity would have acted in this way. Perhaps they'd
have scrambled to contact hotels? Or maybe they'd have disregarded it.

We have no way of knowing because he never attempted to do the right thing.

~~~
luu
Don't we have a good idea how they would have responded from how they've
actually responded? It took four months and a huge public backlash before they
acquiesced to demands for replacements.[1]

[1] [http://www.forbes.com/sites/andygreenberg/2012/12/06/lock-
fi...](http://www.forbes.com/sites/andygreenberg/2012/12/06/lock-firm-onity-
starts-to-shell-out-for-security-fixes-to-hotels-hackable-locks/)

~~~
fatbird
How they responded after public disclosure says little about how they would
have responded to notification with a deadline for public disclosure.

I understand the various incentives for Onity, and I think a great incentive
for them is, given six months to address the issue, knowing it'll be made
public, to take at least some proactive steps such as notifying large
customers or being ready upon public disclosure with a mitigation plan.

His whole blog entry is a lot of handwaving to cover up the fact that he never
even gave them a chance to do something anything like the right thing.

~~~
Firehed
He makes an important point though: security researchers have been used by
vendors as part of trying to go through the traditional process of responsible
disclosure. It could easily come off as blackmail[1]. Simply disclosing to the
public avoids that possibility, because the researcher was clearly not trying
to personally get something from the vendor.

That being said, I think this kind of thing should be covered by whistleblower
protection laws (I don't know if it's ever been tested)... although it seems
those are only enforced when it's convenient.

So while I think he may have reached the right conclusion, I don't think it
was for the right reasons. If sufficient protections for disclosers are in
place, this should be a relative non-issue (though it makes sense to adjust
the disclosure window based on the ease and risk of the vulnerability in order
to apply pressure for an expedited fix)

[1] Given there's no payout for the researcher other than having the
vulnerability fixed, it is conceivably not too hard to defend against. That
doesn't change the fact that they can be sued, which is expensive, time-
consuming, and stressful.

~~~
fatbird
The best protection for the discloser is simply to do so anonymously, which
shouldn't be difficult for someone like this.

Alternately, do so 'legal anonymously', perhaps by the EFF approaching the
company and saying "we have in our possession information on a security
vulnerability in your product. We want to give you information on it. In six
months this information will be made public. We ask for and want no
compensation or consideration at all."

That's it. There exist methods to do this safely; Daeken could have done it,
and didn't.

~~~
lawnchair_larry
No, the EFF doesn't offer this service, and given the volume of
vulnerabilities disclosed, it would be a huge waste of their resources.

I'm not paying a lawyer because you have broken software that I had nothing to
do with making.

------
paupino_masano
If you haven't seen his original paper regarding this it can be found here:
<http://demoseen.com/bhpaper.html>

Also, slides for his talk at Blackhat: <http://demoseen.com/bhtalk2.pdf>

~~~
purplelobster
Wow, it's so easy. I can't really sympathize with Onity in any way.

------
tzs
He missed an option: disclose privately to Onity's major customers, and give
them some time to assess the situation and deal with Onity.

~~~
daeken
Yeah, didn't consider that angle. However, that (much like Onity's original
approach to the problems) leaves the independent hotels in the cold.
Definitely a decent option, though.

------
paulgb
Where does US law stand on full disclosure? I'm aware of MBTA v. Anderson, but
are there still some grey areas?

------
gojomo
While fixing all the locks will be costly and time-consuming, perhaps a far
smaller number of specialized 'tripwire' fix boards can be sent to affected
hotels, boards which track (and perhaps report instantly by radio) attempts to
use the hack. For example, one such device could be added per floor.

Even if crooks only very occasionally trip the specialized replacements, they
would alert hotels to active exploitation, allowing either immediate
apprehension or timely review of security footage. Shifting the risk/reward
for criminals could buy time for a more complete but gradual fix.

~~~
daeken
Once you've already spent the time and money to pull the locks off the doors
and replace/add a circuit board, you may as well just drop in the fixed board.
That prevents the main vulnerability from functioning, though there's no fix
at all for the encryption flaw (but no one has exploited that, nor will they
in the near future, if I had to guess).

~~~
knowaveragejoe
Not only that, but seeing as the locks don't communicate in any way besides
the maintenance port, there's no way to know if they've been tripped without
reading them at some regular interval.

~~~
gojomo
The replacement board, in the hypothesized special 'tripwire' assembly, would
have added radio-reporting. You only need a few of these super-locks, randomly
added to the population of vulnerable locks, to catch any exploitation at
scale. That'd both curtail the losses and deter future copycats. ("While
you're rifling through the guest's belongings looking for valuables, security
is already on its way.")

------
kevingadd
Even if the risk for independent discovery was high, announcing it to the
public without contacting the vendor and giving them the opportunity to at
least prepare a response plan (even if you think the plan is inadequate)
ensured a thoroughly dramatic media response that made certain that anyone
with the slightest desire to break into hotel rooms now knew how.

EDIT: Yep, you're right. I don't know how I missed that given that I skimmed
the article twice. Sorry.

~~~
daeken
> The fact that 'contact Onity, then disclose publicly after a reasonable
> period of time' is nowhere on his list just blows my mind.

That's the very first thing on the list. Quote: "The standard 'Responsible
Disclosure' approach would be to notify Onity and give them X months to deal
with the issue before taking it public."

