China's Vulnerability Database Altered to Hide Govt. Influence

itman · Mar 9, 2018

Recorded Future says move designed to hide fact that CNNVD routinely delays publication of high-risk flaws so government can assess them for offensive use.

The operators of China's National Vulnerability Database (CNNVD) appear to be systematically delaying publishing information on certain high-threat vulnerabilities so the country's Ministry of State (MSS) can assess them for use in intelligence operations.

That's the assessment of threat-intelligence vendor Recorded Future based on its analysis of some recent changes to the CNNVD.

According to Recorded Future, CNNVD has altered the original publication dates for as many 267 vulnerabilities in the database to make it appear like the information was published weeks before it actually was.

Recorded Future published research last November saying the CNNVD had a policy of delaying publication of certain high value vulnerabilities while the MSS evaluated them for their potential operational utility. The vulnerability publication date changes seem to have been made after this first research was published.
Click to expand...

https://www.darkreading.com/vulnera...altered-to-hide-govt-influence/d/d-id/1331235

Minimalist · Jul 16, 2018

Russia's National Vulnerability Database Slow, Incomplete

After analyzing the national vulnerability databases of the United States and China, Recorded Future has decided to take a look at Russia’s database, known as the BDU. The BDU is maintained by the Federal Service for Technical and Export Control of Russia (FSTEC), an agency whose role is to protect state secrets and provide support for counterespionage and counterintelligence missions.

Researchers discovered significant differences both in the number of vulnerabilities and the time it takes to add them to the database, compared to the databases run by China and the United States. For instance, while the US’s NVD stored information on nearly 108,000 security holes, the BDU only documented just over 11,000 flaws in March, when Recorded Future conducted its analysis.

As for the time it takes for a vulnerability to be included in the BDU, the average is 95 days, much more than in the United States (45 days) and China (11 days).
Click to expand...

https://www.securityweek.com/russias-national-vulnerability-database-slow-incomplete

Log in or Sign up

China's Vulnerability Database Altered to Hide Govt. Influence

itman Registered Member

Minimalist Registered Member

Log in or Sign up

China's Vulnerability Database Altered to Hide Govt. Influence

itman Registered Member

Minimalist Registered Member

Useful Searches