Catchy nicknames prompt more patching of vulnerabilities
According to a report released Tuesday by security researcher Secunia ApS, based in Copenhagen, Denmark, names such as Heartbleed, Shellshock and Poodle make it easier for users to learn about vulnerabilities and to ask their vendors for patches.
More than 100 vendors issued patches for 600 products within 40 days of the Heartbleed news.
"When Heartbleed hit us there was a lot of media attention, there was a logo, and everyone was going crazy," said Kasper Lindgaard, Secunia's director of research and security. "It was pretty heavy."
In August, however, the third round of patches from OpenSSL didn't attract as much attention, and only 20 vendors released patches for just 50 products. Now, 100 days in, the total number of products is up to 75.
"It should have been a lot more," said Lindgaard. "It should have been around 200 affected products."
The core problem, he said, is the lack of a mature vulnerability management process on the part of vendors, especially the smaller ones.
"Vendors should be interested in having more secure products, and the market will regulate itself as more customers are getting more focused on security," he said.
But that's a long-term view, and the number of vulnerabilities is increasing dramatically right now.
"Unfortunately, there's no short-term solution to getting vendors to become more mature about security," he said, "Unless you have a punishment system for when you have vulnerabilities and don't patch them in a certain timeframe."
The Secunia Vulnerability Update covers 1,841 vulnerabilities discovered in August, September, and October of this year. These were vulnerabilities discovered and disclosed in vendor products -- some disclosures accompanied by patches, but others unpatched.
The number of vulnerabilities was up by around 40 percent compared to the same time last year.
Google Chrome was in the top 20 list each month, and was in first place in August and October.
That's not a bad thing, Lindgaard said, if the results are due to the vendor proactively hunting down and fixing vulnerabilities before anyone knows about them.
"Google spends an enormous amount of resources on vulnerabilities," he said. "So here, it's a good thing."
Although Chrome was the single product with the most reported vulnerabilities, IBM was the company with the most reported vulnerabilities overall.
Several IBM products were on the top twenty lists in the Secunia report, including IBM Notes and Domino, Java, WebSphere Real Time, and several others.
According to Secunia, the reason for this is because IBM bundles their products with third-party software, often with vulnerable libraries like Java and OpenSSL. Whenever a vulnerability is later discovered in Java, OpenSSL, or other library, the corresponding IBM products need to be updated as well.
As a result, there were 4,000 total vulnerabilities in IBM products in 2013, reported Secunia, or 25 percent of all vulnerabilities reported. That trend is continuing through 2014, the company said.