A Researcher Centric Approach to Coordinated Vulnerability Disclosure

A Researcher Centric Approach to Coordinated Vulnerability Disclosure

Speakers: Patrick Garrity, Security Researcher, VulnCheck

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=577k_FYy5pk

Overview

In his FIRSTCON talk, "A Researcher Centric Approach to Coordinated Vulnerability Disclosure," Patrick Garrity, a Security Researcher at VulnCheck, delves into the often-overlooked psychological and practical realities faced by security researchers in the vulnerability disclosure process. Garrity, who coordinates Coordinated Vulnerability Disclosure (CVD) for researchers at VulnCheck and is heavily involved in CVE issuance, argues for a fundamental shift in how software suppliers interact with those who discover vulnerabilities. Rather than focusing solely on the vendor's perspective, he advocates for a researcher-centric model that acknowledges and addresses the significant burdens and diverse motivations of external discoverers.

The presentation meticulously dissects the various paths a researcher might take upon finding a vulnerability – from responsible reporting to public disclosure, selling, or even weaponizing it. Garrity highlights the common pitfalls of current CVD practices, such as a lack of clear contact points, legal encumbrances, and unresponsive vendors, which often discourage researchers from engaging constructively. By drawing parallels with threat actor motivations (without equating researchers to them), he illustrates the critical choices researchers make and the potential security implications when their efforts are not adequately supported or acknowledged.

This talk is crucial for anyone involved in software security, from developers and PSIRTs to security leaders and policy makers. It challenges conventional wisdom by positing that a more empathetic and streamlined disclosure process benefits all parties, ultimately leading to faster fixes, improved software security, and stronger community trust. Garrity’s insights underscore the urgent need for vendors to re-evaluate their CVD strategies in an increasingly dynamic threat landscape, especially with the rise of AI-assisted vulnerability discovery.

Background

▶ Watch: Introduction and talk overview (0:00)

The traditional model of Coordinated Vulnerability Disclosure (CVD), as often envisioned, involves a security researcher discovering a vulnerability, reporting it to the software supplier, and then working collaboratively towards a fix and public disclosure. However, Patrick Garrity argues that the reality for security researchers is far more complex and often fraught with significant challenges that go largely unaddressed by vendors. This disconnect creates a "researcher burden" that can undermine the entire disclosure process.

Garrity outlines a spectrum of choices a researcher might make upon discovering a vulnerability, each driven by different motivations:

• Reporting the Vulnerability: This is the ideal scenario. Motivations include a genuine desire for a fix to enhance software security, the pursuit of a CVE for resume building or recognition (the "collector" mentality), or a continuous effort to highlight systemic insecurity in a product. Financial incentives through bug bounty programs also fall into this category, though Garrity strongly differentiates bug bounties from true CVD.
• Not Reporting the Vulnerability: This is a surprisingly common choice. Researchers often lack the time to identify the correct contact, struggle with complex reporting processes, or face the demoralizing experience of receiving no acknowledgement or response from the software supplier. In some cases, researchers encounter competitive suppliers who perceive vulnerability disclosure as a negative PR event, discouraging future reports.
• Publicly Publishing the Vulnerability: When coordinated disclosure fails, or is perceived as impossible, researchers may opt for public disclosure. This can be due to a complete lack of response from a vendor (even legitimate PSIRTs or open-source projects), a desire for notoriety ("Uncle Rico" scenario), or the absence of public acknowledgement from the supplier after a fix.
• Selling the Vulnerability: A more controversial path, but a real one. There are active markets for vulnerabilities, including those involving nation-states (e.g., Russia reportedly buying Apple zero-days for $20 million, equivalent to four tanks), zero-day brokers like Zerodium, and even law enforcement agencies (e.g., FBI hinting at paying $1 million for the San Bernardino iPhone exploit). Detection companies, such as Trend Micro's Zero-Day Initiative (ZDI), also acquire vulnerabilities for defensive purposes, often facilitating CVD in the process.
• Using the Vulnerability: This can range from benign uses like reproduction testing and developing detection capabilities for security products to malicious exploitation by threat actors. Garrity cites the Moveit vulnerability exploited by the Clop ransomware group as a prime example of zero-days being actively used in the wild.

The "researcher burden" itself is multifaceted. Before any disclosure can even begin, a researcher must:

1. Identify the correct company and product owner.
2. Determine if a PSIRT or security contact exists.
3. Find a working email or web form, if available (Garrity recommends disclose.io as a helpful resource).
4. Verify if the vendor is indeed the right point of contact (e.g., for subsidiaries or open-source projects).
5. Critically, navigate and consider legal agreements (e.g., NDAs) that often accompany bug bounty programs, placing individual researchers at a significant disadvantage against large corporations.

Common obstacles further compound this burden: missing or outdated security.txt files, unclear CVE Program (CNA) scope and contact information, reports vanishing into general support queues, and the pervasive issue of simply receiving no response. Garrity highlights that this lack of acknowledgement is a major deterrent, forcing researchers into a continuous loop of follow-ups and contact hunting. He quotes Todd Beardsley, illustrating how researchers often feel their discoveries are appropriated by vendors without due credit, fostering resentment and disengagement.

A core distinction Garrity emphasizes is between bug bounties and Coordinated Vulnerability Disclosure. While both involve reporting vulnerabilities, bug bounties introduce monetary incentives that create "perverse incentives." Researchers in bug bounty programs are often focused on severity ratings (which dictate payouts), the amount of payment, and the timeline for receiving it. This urgency can clash with the more collaborative, security-focused goals of CVD. Furthermore, many bug bounty platforms require non-disclosure agreements (NDAs) or other restrictive legal terms, effectively limiting a researcher's ability to engage in unencumbered CVD, or even obtain a CVE, as discussed in Kender Albert's USENIX talk, "Everything Old Is New Again: Legal Restrictions on Vulnerability Disclosure & Bug Bounties." This often leaves researchers with no option but to sign restrictive agreements or face the consequence of not reporting at all, or worse, dropping a zero-day publicly.

Key Findings

▶ Watch: Common reasons researchers don't report vulnerabilities (7:40)

Patrick Garrity's talk reveals several critical findings about the current state of Coordinated Vulnerability Disclosure (CVD) and the necessity of a paradigm shift towards a researcher-centric approach.

Firstly, the prevailing vendor-centric model of CVD is fundamentally flawed and unsustainable. It consistently overlooks the significant burdens, diverse motivations, and psychological impact on security researchers, leading to suboptimal outcomes for all parties. When vendors make disclosure difficult, unresponsive, or legally encumbered, researchers are more likely to bypass coordinated processes entirely.

Secondly, the choices researchers make when discovering a vulnerability are not monolithic but range across a spectrum from ideal reporting to public disclosure, selling, or even weaponization. These choices are directly influenced by the ease, fairness, and responsiveness of the vendor's disclosure process. A lack of clear contact points, the imposition of restrictive legal agreements (especially through bug bounties), and unresponsive communication are primary drivers for researchers to opt out of traditional CVD.

Thirdly, the rise of AI-assisted vulnerability discovery is significantly increasing the volume of reported vulnerabilities and, critically, leading to more frequent research collisions. With accessible AI tools, multiple researchers are more likely to find the same vulnerability independently. Garrity highlights the case of a CVE in the Anthropic Glass Wing report, which was discovered and fixed months earlier by another researcher (Isle), as a prime example. This phenomenon demands faster patching cycles and a more inclusive approach to duplicate reports, as ignoring subsequent reporters can lead to uncoordinated public disclosure.

Fourthly, vendors often send mixed signals to researchers, which can deter future engagement. Garrity cites recent examples like vendor responses that immediately hint at law enforcement involvement or historical instances where companies actively pressured researchers to suppress disclosure (as described by HD Moore in a Darknet Diaries episode regarding ActiveX). Such adversarial stances breed distrust and push researchers towards public disclosure out of frustration or a desire to force deprecation of insecure products.

Finally, Garrity asserts that researchers feel a sense of "ownership" over their discoveries. They want recognition, public credit, and the ability to publish their work. When vendors appropriate findings without acknowledgement or attempt to control disclosure timelines excessively, it erodes the researcher's goodwill. The goal should be to build a collaborative connection, not to suppress or appropriate.

Technical Deep Dive

▶ Watch: Distinguishing bug bounties from coordinated vulnerability disclosure (16:00)

While not a deep dive into specific code or exploit techniques, Patrick Garrity's talk provides a detailed technical analysis of the mechanisms and processes that define successful versus failed Coordinated Vulnerability Disclosure (CVD) from a researcher's perspective. It dissects the infrastructure, communication protocols, and incentive structures that either facilitate or impede the secure patching of software.

Flaws in Current CVD Mechanisms:

1. Contact Point Obscurity: A significant technical barrier is the lack of clear, standardized, and easily discoverable contact points for reporting vulnerabilities.

• Missing/Outdated security.txt: The security.txt file (a standard for security contacts) is often absent or contains stale information, forcing researchers to hunt for contacts.
• Unclear CNA Scope: For organizations acting as CVE Numbering Authorities (CNAs), their scope of vulnerability acceptance and the appropriate contact channels are frequently opaque.
• General Support Queues: Submitting reports through general customer support channels is often ineffective, leading to reports being lost or ignored.
• Subsidiary Confusion: Large companies with acquisitions or diverse product lines (open-source vs. closed-source) often lack a unified or clear reporting path, directing researchers between different internal teams or external projects.

1. Legal and Bureaucratic Encumbrances: The legal frameworks surrounding disclosure often create insurmountable hurdles.

• Non-Disclosure Agreements (NDAs): Many bug bounty programs, which are often the only available reporting channel, require researchers to sign NDAs or other restrictive legal agreements upfront. This is a primary deterrent for researchers who do not seek financial reward or who work for organizations that prohibit participation in such programs.
• Registration Requirements: Forcing researchers to register accounts or sign up for platforms often implies agreement to terms of service that carry legal obligations, again hindering unencumbered disclosure.

1. Communication Failures: The fundamental breakdown in CVD often stems from inadequate communication.

• Lack of Responsiveness: The most common complaint is the absence of any acknowledgement, even a simple "we received your report," for days, weeks, or indefinitely. This immediately erodes trust and discourages further engagement.
• No Updates: Even when a report is acknowledged, researchers are rarely kept informed about the vulnerability's status, patch development, or release timelines.
• "Informative" Dispositions: Classifying valid findings as "informative" (meaning not a critical vulnerability) can be frustrating for researchers, potentially leading them to believe the issue is being dismissed, thus increasing the likelihood of public disclosure.

Impact of AI on Vulnerability Discovery:

The advent of AI-assisted vulnerability discovery introduces new technical dynamics:

• Increased Volume: AI models make vulnerability discovery more accessible, leading to a surge in vulnerability reports for vendors.
• False Positives: While AI is improving, initial reliance on it can generate more false positives if researchers don't perform adequate testing and validation.
• Improved Detail: As AI matures, reports become more detailed and actionable, which is a positive development, but still contributes to volume.
• Research Collisions: The shared access to powerful AI models significantly increases the probability that multiple researchers will discover the same vulnerability simultaneously. This necessitates a vendor's ability to manage duplicate reports gracefully, acknowledging all reporters rather than just the first.

Resurfacing Challenges and Historical Context:

Garrity highlights that many of these issues are not new but are resurfacing with increased intensity.

• Adversarial Responses: Vendor responses that hint at law enforcement involvement (e.g., in the Red Sun, Undefend, Blue Hammer, Yellow Key POC drops by I am Eric Lopes) immediately put researchers on the defensive.
• Historical Precedents: The example of HD Moore and ActiveX illustrates the long-term consequences of vendor unresponsiveness. Moore's continuous public disclosure of hundreds of vulnerabilities in ActiveX ultimately forced Microsoft to deprecate the insecure product, demonstrating the power of persistent researcher action when coordinated disclosure fails. This also underscores the researcher's perspective of "ownership" over their discovery.

Proposed Researcher-Centric Improvements:

To overcome these technical and procedural hurdles, Garrity proposes several actionable changes:

1. Clear and Accessible Contact Points:

• Implement security.txt and maintain it diligently.
• Provide multiple, easy-to-find reporting options (dedicated email, web forms).
• Crucially, ensure these channels have no legal obligations or registration requirements upfront.

1. Enhanced Responsiveness and Communication:

• Acknowledge Reports Promptly: Aim for a response within one business day, even if it's just to confirm receipt.
• Engage with All Researchers: For duplicate reports, acknowledge all researchers, informing them that the issue is known and being addressed.
• Provide Continuous Updates: Keep researchers informed throughout the lifecycle: validation, fix development, patch release, and public advisory.
• Proactive Disclosure: Inform researchers when a fix is available and when they can expect public disclosure (including CVE issuance and credit).

1. Separation of CVD and Bug Bounties:

• Maintain distinct channels for unencumbered CVD (focused on security and fixing) and bug bounty programs (focused on financial incentives). This allows researchers uninterested in monetary rewards or constrained by organizational policies to still contribute.

By addressing these technical and procedural shortcomings, vendors can foster a more collaborative environment, encouraging researchers to report vulnerabilities through coordinated channels rather than resorting to less desirable alternatives.

Demo / Proof of Concept

▶ Watch: AI-assisted discovery and research collision challenges (20:00)

This talk was primarily an analytical discussion of vulnerability disclosure processes and challenges, rather than a demonstration of specific tools or proof-of-concept exploits. Patrick Garrity's insights were drawn from his extensive experience coordinating CVD at VulnCheck and interacting with security researchers, using real-world examples and historical anecdotes to illustrate his points rather than live technical demonstrations.

Defensive Implications

▶ Watch: Q&A: Regulation impact and scaling vulnerability disclosure (32:20)

Patrick Garrity's talk offers crucial, actionable insights for defenders, particularly for Product Security Incident Response Teams (PSIRTs), software suppliers, and security leaders. Adopting a researcher-centric approach to Coordinated Vulnerability Disclosure (CVD) is not merely about goodwill; it's a strategic imperative for enhancing overall security posture and minimizing risk.

1. Streamline and Standardize Reporting Channels:

• Implement security.txt: Ensure a clear, up-to-date security.txt file is present on all web properties, providing a standardized and easily discoverable contact point for security researchers.
• Dedicated, Unencumbered Forms: Provide dedicated web forms and email addresses for vulnerability reports that are separate from general support queues. These channels should not require registration or upfront agreement to legal terms (NDAs, restrictive clauses) that deter legitimate researchers.
• Clear CNA Scope: If operating as a CVE Numbering Authority (CNA), clearly communicate the scope of products covered and the preferred reporting methods to avoid confusion.

1. Prioritize Responsiveness and Transparency:

• Rapid Acknowledgment: Aim for a response to vulnerability reports within one business day. Even a simple acknowledgement of receipt can significantly improve researcher morale and trust.
• Proactive Communication: Keep researchers continually updated on the status of their report – from initial validation to patch development and release. This reduces the likelihood of researchers feeling ignored and resorting to public disclosure.
• Engage All Reporters: In cases of research collisions (multiple researchers finding the same bug), acknowledge and engage with all reporters, not just the first. Inform them that the issue is known and being addressed, preventing subsequent public disclosures by unacknowledged researchers.
• Public Disclosure and Credit: Commit to publicly disclosing vulnerabilities (e.g., via advisories) and crediting researchers. This fulfills a key researcher motivation for recognition and transparency, which also benefits the broader defensive community.

1. Separate CVD from Bug Bounty Programs:

• Distinct Paths: Maintain separate processes for pure CVD (focused on fixing vulnerabilities) and bug bounty programs (focused on financial incentives). This allows researchers who are not interested in monetary rewards or are prohibited from accepting them (e.g., due to employer policies) to still report vulnerabilities without legal encumbrance.
• Avoid Restrictive Terms: Ensure that the primary CVD path does not impose NDAs or other legal agreements that might prevent researchers from reporting or obtaining CVEs. Such restrictions can drive researchers to disclose publicly or even sell vulnerabilities.

1. Accelerate Patching and Remediation:

• Faster Fixes: Recognize that the increasing velocity of vulnerability discovery, especially with AI-assisted tools, demands faster remediation cycles. The longer a vulnerability remains unfixed, the higher the chance of research collisions and subsequent reports, increasing workload and the risk of exploitation.
• Address "Informative" Findings: Re-evaluate the handling of "informative" or low-severity reports. While not critical, dismissing valid findings can still frustrate researchers and lead to public discussion that could be avoided.

1. Foster a Collaborative Relationship:

• Avoid Adversarial Stances: Refrain from responses that threaten legal action or involve law enforcement, as these immediately alienate researchers and break trust.
• Recognize Researcher Ownership: Acknowledge that researchers often feel a sense of ownership over their discoveries and desire credit and the ability to publish their work. Facilitate this where possible within responsible disclosure timelines.
• Engage with the Community: Participate in security conferences (like FIRSTCON), B-Sides, DEFCON, and engage with researcher communities on platforms like Discord and Slack. Being present and approachable builds relationships that encourage responsible disclosure.

By proactively adopting these defensive measures, organizations can transform their CVD process from a perceived burden into a powerful asset, leveraging the global research community to identify and fix vulnerabilities before they are exploited by malicious actors. The investment in a researcher-centric approach ultimately leads to more secure products and a stronger defense against emerging threats.

Key Takeaways

• CVD Must Be Researcher-Centric: Traditional vulnerability disclosure processes often overlook the significant burdens, motivations, and psychological factors affecting security researchers. A shift towards acknowledging and addressing these researcher-centric issues is critical for effective disclosure.
• Clear, Accessible, and Unencumbered Reporting Channels Are Paramount: Vendors must provide easily discoverable contact points (e.g., security.txt, dedicated forms/emails) that do not impose legal obligations (NDAs) or registration requirements, which deter legitimate researchers.
• Responsiveness and Continuous Communication Build Trust: Prompt acknowledgment (within one business day) and ongoing updates throughout the vulnerability lifecycle (validation, fix, patch release, public disclosure) are essential to maintain researcher engagement and prevent uncoordinated public disclosures.
• Separate Bug Bounties from Core CVD: While bug bounties offer financial incentives, their associated legal terms and focus on payment can create "perverse incentives" and hinder unencumbered vulnerability reporting. Vendors should offer distinct paths for financially motivated bug bounty participants and researchers focused solely on responsible disclosure.
• AI Accelerates Discovery, Demanding Faster Fixes and Inclusive Communication: The rise of AI-assisted vulnerability discovery increases report volume and research collisions. Vendors must accelerate patching cycles and acknowledge all researchers reporting the same vulnerability, not just the first, to prevent frustrated researchers from going public.
• Ignoring Researcher Motivations Increases Risk: When vendors are unresponsive, dismissive, or adversarial, researchers are more likely to choose alternative paths such as public disclosure (sometimes leading to product deprecation, like ActiveX) or selling vulnerabilities, ultimately increasing the risk to the software ecosystem.

About the Speaker(s)

Patrick Garrity is a Security Researcher at VulnCheck. In his role, he operates and coordinates vulnerability disclosure for security researchers, helping them report vulnerabilities to affected vendors and facilitating the issuance of CVEs. He is deeply involved in various vulnerability-related industry groups, which provides him with extensive exposure to diverse experiences and perspectives within the security research community. Beyond his coordination efforts, Patrick also actively tracks vulnerability trends and known exploited vulnerabilities, contributing to a comprehensive understanding of the threat landscape. His work at VulnCheck positions him as a key intermediary between independent researchers and software suppliers, striving to make the disclosure process more efficient and equitable.