From Discovering Vulnerabilities to Getting Them Fixed At Scale

No ratings

Presented at RuhrSecBochum 2018 by

Dr. Stock

Security researchers are often faced with a dilemma once they have discovered a new type of flaw, potentially affecting many servers or Web sites in the wild. On the one hand, their discovery may allow adversaries to find such flawed systems with ease and attack them quickly (as famously shown by the Drupageddon attack). On the other hand, there are no well-established channels which can be used reliably to notify the affected administrators.In this talk, we will first discuss how the Web’s security evolved over time, highlighting that the need for notifications at scale is bigger then ever. Afterwards, we present results from two experiments on notifications at scale, trying to help site operators to secure their sites from nefarious attackers. We also discuss numerous roadblocks, starting from a complete lack of a usable email address to issues of trust arising when a non-native speakers calls people in the US.