China Introduced New Rules for Software Vulnerability Disclosure

guest · Jul 14, 2021

China Introduced New Rules for Software Vulnerability Disclosure
July 14, 2021
https://www.technadu.com/china-new-rules-software-vulnerability-disclosure/289708/

The Chinese state introduces new software vulnerability disclosure rules in the form of a sweeping new law.

The new guidelines require that bug bounty hunters will not use or sell or hoard flaws for profit or harm.

All identified flaws must be reported to the public after they have been fixed, and reported to the state within two days after their discovery.

Click to expand...

The Chinese Ministry of Industry and Information Technology has presented a set of new regulations that will underpin software and network product security vulnerability disclosure procedures. The new rules will come into force on September 1, 2021, and cover all provinces, autonomous regions, and municipalities of China, so every piece of software developed in the Asian superpower will be expected to comply.

The new rules create a host of complications even for software companies outside of China, as many of them work with Chinese researchers who are covered by the new law. If these researchers were to disclose their findings to the Chinese Ministry, the state and potentially the actors it sponsors would get to learn about valuable backdoors in foreign products. This can’t work out in any way within the new legal context, so essentially, all Chinese bug bounty hunters are about to be excluded from international programs.
Click to expand...

Offensive security expert and influential hacker John Jackson has shared the following comment with us on the above rules:

It looks like China is attempting to control the flow of exploits that are discovered by hackers. Requiring mandatory reporting of exploits undoubtedly means that the state will weaponize these exploits against adversaries as we’ve seen previously. In addition, not allowing research outside of the country is going to hamper hacker’s abilities to learn techniques.
Click to expand...

guest · Jul 26, 2021

Research roadblock? Security pros weigh in on China’s new vulnerability disclosure law
New regulation may present ‘new challenges to security researchers and pen testers working in China’
July 26, 2021
https://portswigger.net/daily-swig/...in-on-chinas-new-vulnerability-disclosure-law

Security researchers operating in the People’s Republic of China will soon be required to hand over information on vulnerabilities, including zero-days, to the authorities.
This, according to a recent report by Recorded Future imprint The Record, must be done within two days, with all bugs being reported to the Ministry of Industry and Information Technology (MIIT).

“This rule has the potential to present new challenges to security researchers and penetration testers working in China. Specifically, as the reporting mechanism is formalized, it will be interesting to see how China implements the law itself,” Frank Downs, director of proactive services, BlueVoyant, and member of ISACA’s Emerging Trends Working Group, told The Daily Swig.
Click to expand...

Downs added: “No matter how this law is implemented, China-based security researchers are probably going to tread much more carefully out of concern of being labelled a ‘hacker’. This law makes the prospect of security and penetration testing more fraught.”

“I don’t believe this will impact hacker contests or bug bounty programs significantly, however it might impact companies who are doing development within China,” warned Joseph Carson, chief security scientist at ThycoticCentrify.
Click to expand...

Log in or Sign up

China Introduced New Rules for Software Vulnerability Disclosure

guest Guest

guest Guest

Log in or Sign up

China Introduced New Rules for Software Vulnerability Disclosure

guest Guest

guest Guest

Useful Searches