Sometimes security companies can be a little too heavy
handed. Or their lawyers have too much time on their hands. FireEye cleared this hurdle, recently.
Felix Wilhelm, a security researcher working for Germany based ERNW, was going to present his
findings on some vulnerabilities he had found with FireEye’s software. He was going to present at the 44CON Cyber
Security Conference (www.44con.com ) during
the week of September 9. The flaws had
been fixed, by the way.
The two parties had a series of discussions regarding what could
go into the report (FireEye was concerned about not exposing information on
their product’s IP). To be brief, the
parties supposedly agreed on a final report around August 5. FireEye then sent Wilhelm a cease and desist letter
on August 6, obtained a court injunction on August 13 and delivered it to
Wilhelm on September 2, a week before the 44Con conference. Ultimately, Wilhelm did present his findings
with some material redacted.
FireEye has a procedure for researchers to “disclose and inform us of potential
security issues”. In this case, FireEye was extremely heavy handed . Their
action does little to encourage researchers to share (stifle?) at
security conferences. This comes across
as “attacking the messenger”. They also attacked
the messenger with NSS Labs a couple of
years ago when FireEye e came in last in a multi-company Breach Detection Systems
Test.
FireEye came in
last again in a NSS Break Detection Systems Test (BDS) earlier this year. Eight
companies were in the test: Blue Coat, Check Point, Cisco, Fidelis,
FireEye, Fortinet, Lastline, and Trend Micro. The test measured security
effectiveness, performance, and total cost of ownership.
To obtain a copy of
the Value Map: NSS Security
Value Map Graphic
To read the complete Forbes article “FireEye Scolded For
Injunction Stopping Security Researcher Revealing Source Code”: Forbes
- FireEye Scolded
Posts
No comments:
Post a Comment