CERT/CC launches Twitter bot to give security bugs random names

guest · Nov 2, 2020

CERT/CC launches Twitter bot to give security bugs random names
CERT/CC attempts to reduce the use of sensationalized vulnerability names that needlessly scare software users
November 2, 2020
https://www.zdnet.com/article/certcc-launches-twitter-bot-to-give-security-bugs-random-names/

In an attempt to reduce the use of sensationalized and scary vulnerability names, the CERT/CC team launched a Twitter bot that will assign random and neutral names to every security bug that receives a CVE identifier.

Named Vulnonym, the bot is operated by the CERT Coordination Center (CERT/CC) at the Carnegie Mellon University, the first-ever CERT team created, and now a collaborator and partner of the DHS' official US-CERT team.
The idea for this bot came after the seemingly unending discussions around the topic "if vulnerabilities should have names?"
Click to expand...

THE PROBLEM WITH VULNERABILITY NAMES
For decades, all major security flaws have been assigned a CVE identifier by the MITRE Corporation. This ID is usually in the format of CVE-[YEAR]-[NUMBER], such as CVE-2019-0708.

Companies and researchers realized that the bugs they discovered had more chances to stand out if the bug had a cool-sounding name.
Things reached a ridiculous level last year when a Cisco bug was named using three cat emojis under the spoken term of Thrangrycat (aka "three angry cats").
Click to expand...

YES, VULNERABILITIES SHOULD HAVE NAMES
But in a blog post on Friday, the CERT/CC team decided to put forward a solution to put some order in vulnerability naming. Their answer was the Vulnonym bot, which will assign a two-word codename in the format of adjective-noun to every newly assigned CVE ID.

"Not every named vulnerability is a severe vulnerability despite what some researchers want you to think," said Leigh Metcalf, a member of the CERT/CC team.
"Our goal is to create neutral names that provides a means for people to remember vulnerabilities without implying how scary (or not scary) the particular vulnerability in question is," Metcalf said.
Click to expand...

CERT/CC: Vulnonym: Stop the Naming Madness!

Names of vulnerabilities, in particular, are matriculating into important spheres of influence. Case and point, on July 11, 2018, congressional testimony weighed the impacts of the "Meltdown" and "Spectre" vulnerabilities. The CVE-IDs, CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754, were never mentioned, only the sensational names were.

We aren't arguing that vulnerabilities shouldn't have names, in fact, we are encouraging this process!
Click to expand...

To test out this idea, we're operating @vulnonym on Twitter to publish the neutral names associated with CVE IDs as they are issued. Follow @vulnonym and let us know if this naming experiment is useful! And in case anyone considers a word or name to be offensive, we have a simple process to remove it from the corpus and re-generate a name.
Click to expand...

Log in or Sign up

CERT/CC launches Twitter bot to give security bugs random names

guest Guest

Log in or Sign up

CERT/CC launches Twitter bot to give security bugs random names

guest Guest

Useful Searches