Black Hat attendees are very vocal about the VEP

Las Vegas has been buzzing with questions about the government's process for disclosing newly discovered software vulnerabilities.

As Black Hat USA is in full swing, Las Vegas buzzed with questions about the government’s process for disclosing newly discovered software vulnerabilities, even as the government is working to change the way the process works.

At issue: What can fresh data examining zero-days tell the public about whether the U.S. government secretly retains a new software vulnerability or reveals it to the manufacturer so it can be fixed. Retained vulnerabilities can be used to spy on U.S. adversaries, but — if rediscovered by foreign spies, cybercriminals or other hackers — they could also be used to wreak havoc on systems both inside and outside the U.S.

“I’m gonna light it up,” cybersecurity researcher Katie Moussouris told CyberScoop about a planned debate on the subject.

Because of the nature of the global software market — people and companies all over the world use the same programs — a high chance of rediscovery means a greater likelihood that a vulnerability discovered and kept secret by the U.S. will be independently rediscovered — and used against Americans before manufacturers can fix it.

Two recent studies have reached very different conclusions about how high the rediscovery rate is — and some believe that the data is not informative.

Wednesday, a bill that advanced out of the House Homeland Security Committee requires a report from the Secretary of Homeland Security on the government’s use of its policy process for deciding whether zero-days should be retained or reported to the manufacturer.

The report, due eight months after the Cyber Vulnerability Disclosure Reporting Act passes, would also include a description of all the disclosures made during the prior year and, if needed, a classified annex.

The controversy comes as White House cybersecurity czar Rob Joyce is also examining the Vulnerability Equities Process.

Proponents say the bill will help provide a definitive answer to questions about how helpful the Vulnerabilities Equities Process is — and conversely, how damaging retention might be.

The debate has swirled through the corridors of the Mandalay Bay Convention Center and is the subject of several sessions here.

RAND researcher Lily Ablon told a session Wednesday that her study and statistical analysis of a rare collection of more than 200 zero-days found the rediscovery rate was under 6 percent a year.

Harvard researchers Trey Herr and Bruce Schneier say their research shows the rediscovery rate varies between 15-20 percent annually, but has climbed steadily over the past seven years.

Moussouris says neither study is compelling.

She says the RAND study dataset of 207 vulnerabilities is “incredibly small.”

“What broad conclusions can you draw from such a tiny sample?,” she said. “It’s a case study, not a basis for policy.”

Moussouris also says the Harvard study conflates data from different types of software — and that the authors misunderstand the process of vulnerability detection and discovery.

“How many vulnerabilities are rediscovered from a single version of Chrome, which doesn’t even tell you what [the rediscovery rate] will be in a different version of Chrome … So much of the code is changed,” she said.

Ablon, Herr, Schneier and Moussouris will debate the issue Thursday during a panel at the conference.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure