Whats the Right Thing to Do with Software Flaw Discoveries?

Did you get slammed? The Slammer worm was the fastest moving in Internet history. It impaired important systems in the U.S. government and private sector, delayed operations at a major airline and several media organizations, knocked cash machines offline, and interfered with 911 and other emergency services.

It now looks like whoever launched the worm based the attack code on an exploit program that David Litchfield, a well-respected software security specialist, wrote to test the vulnerability.

Litchfield did nothing out of the routine. His company, NGS, discovered a flaw in a Microsoft SQL Server program last year. Litchfield reported it to Microsoft, which issued a patch for the vulnerability in July. Speaking at a security conference on August 1, he mentioned the vulnerability and released his code to the audience.

Litchfield had to know what we all know: A great many IT departments do not update their system patches as often as they should. Now, everyone knows the outcome.

Litchfield has acknowledged that we got away lucky. At the end of January analysts at London-based Mi2g Ltd. estimated that Slammer accounted for damages of $945 million to $1.15 billion. Had the worm carried a malevolent payload, Litchfield says, things would be much worse.

Security experts like Litchfield operate in a delicate and powerful space. Their knowledge of software vulnerabilities is typically used for good, yielding patches that make business safe from crooks. But it can also be used for ill, putting at risk hundreds of millions of dollars and even human life. With that in mind Litchfield has said hes unsure whether hell ever publish an exploit program again.

But some experts, like those at GreyMagic Software, have complained that even when vendors are aware of vulnerabilities, they can take several months to come up with patches. Going public with flaws early on, they say, is one way to light a fire under vendors who might otherwise drag their feet. According to a Boston Globe story last week, Litchfield has received hundreds of e-mails from colleagues in security, urging him to continue publishing what he finds. Having the knowledge out there will push both vendors and users to act expeditiously, they say.

What do you say? Should security pros share their discoveries of flaws only with the vendors who can fix them? Should they have to wait a certain amount of time after patches are issued before going public with code? Or should they tell all, and let the good and nefarious forces fight it out?