Ferris, an independent security researcher in Mission Viejo, California, found what he calls a serious vulnerability in Microsoft's Internet Explorer Web browser. He reported it to the software giant on Aug. 14 via the "secure@microsoft.com" e-mail address and has since exchanged several e-mail messages with a Microsoft researcher.
Up to that point, Ferris did everything according to Microsoft's "responsible disclosure" guidelines, which call for bug hunters to delay the announcement of security holes until some time after the company has provided a fix. That way, people who use flawed products are protected from attack, the argument goes.
Last weekend, however, Ferris came close to running afoul of those guidelines by posting a brief description of the bug on his Security Protocols Web site and talking to the media about the flaw. So far, the move has done little more than raise some eyebrows at Microsoft.
"I am walking a fine line, but I am doing it very carefully because I am not disclosing actual vulnerability details," Ferris said. "I do this to inform users that flaws still do exist in IE...I don't like it that Microsoft tries to give users a nice warm feeling that they are disclosing everything researchers report to them."
At issue is the push for "responsible disclosure" of software flaws by many industry players, including titans such as Microsoft, Oracle and Cisco Systems.
Microsoft publicly chastises security researchers who don't follow its rules. Also, those researchers won't get credit for their flaw discovery in Microsoft's security bulletin, which is published when the company releases a patch. Because Ferris did not disclose any actual vulnerability details, he's still on Microsoft's good side, a company representative said.
While many software makers promote responsible disclosure, it isn't universally backed by the security community. Critics say it could make security companies lazy in patching. Full disclosure of flaws is better, they say, and turns up the heat on software makers to protect their customers as soon as possible.
How long is too long?
"Microsoft obviously takes way too long to fix flaws," Ferris said. "All researchers should follow responsible disclosure guidelines, but if a vendor like Microsoft takes six months to a year to fix a flaw, a researcher has every right to release the details."
By that time someone else, perhaps a malicious person, may also have found the same flaw and might be using it to attack users, Ferris said.
Often lambasted for bugs in its products, Microsoft is doing its best to win the respect of the security community. The company has "community outreach experts" who travel the world to meet with security researchers, hosts parties at security events and plans to host twice-annual "Blue Hat" events with hackers on it its Redmond, Washington, campus. At Blue Hat, hackers are invited to Microsoft's headquarters to demonstrate flaws in Microsoft's product security.
"Security researchers provide a valuable service to our customers in helping us to secure our products," said Stephen Toulouse, a program manager in Microsoft's security group. "We want to get face to face with them to talk about their views on security, our views on security, and see how best we can meet to protect customers."
Many companies are getting better at dealing with security researchers, said Michael Sutton, director of iDefense Labs, which deals with researchers and software makers. "The environment has definitely changed from two or three years ago, though there are vendors who are going in the opposite direction," he said.
While Microsoft sometimes is still referred to as the "evil empire," it appears to be successfully wooing security researchers.
"We are at the point where all the obvious things we tell Microsoft to do, they already do it," Dan Kaminsky, a security researcher who participated in Microsoft's first Blue Hat event last March, has said.
4%
4%
