EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

05.14.15

VENOM® is Not a Serious Bug, It’s Just a Marketing Campaign From CrowdStrike

Posted in Security at 10:47 am by Dr. Roy Schestowitz

Bugs
Image courtesy of Red Hat, demonstrating lack of correlation between severity and logos/brands

Summary: Many journalists bamboozled into becoming couriers of CrowdStrike, an insecurity firm which tries to market itself using a name and logo for a very old bug

THERE is a disproportionate level of coverage not of Free software but of bugs in Free software. We last wrote about it only days ago

A firm called CrowdStrike (who? Exactly!) is trying to emulate the ‘success’ of previous FUD campaigns. Now is the time to check who’s a real journalist (fact-checking) and who’s just serving PR campaigns like “VENOM”, a shameless FUD campaign from CrowdStrike.

The whole “VENOM” nonsense was covered in a good article titled “VENOM hype and pre-planned marketing campaign panned by experts”. To quote: “On Wednesday, CrowdStrike released details on CVE-2015-3456, also known as Venom. Venom is a vulnerability in the floppy drive emulation code used by many virtualization platforms.

“However, while it’s possible that a large number of systems are impacted by this flaw, it isn’t something that can be passively exploited.

“Several security experts discussed the flaw online, focusing on the marketing and the media attention that it generated – including some over-hyped headlines. Most media organizations were briefed ahead of time about the discovery and gagged by embargo until the Venom website launched, so they had plenty of time to write.

“Many media articles compared Venom to Heartbleed, which is an apples to oranges comparison. If anything, the only commonality is the fact that both flaws had a pre-planned marketing campaign.”

Here comes the “Heartbleed” brand. Yet again. They’re using names that are scary (even all caps, like “GHOST”) because it’s so much easier to sell than “CVE-2015-3456″. Journalists rarely have the technical knowledge to analyse a bug or a flaw, so they assume bugs and logos are indicative of severity.

This patch Tuesday Microsoft revealed 40+ vulnerabilities. Not a single one had a brand name, logo, etc. Here is how IDG covered 46 flaws publicly disclosed by Microsoft just for this Tuesday (Microsoft hides even more flaws). So many flaws were collectively covered in one article and yet there are no logos; none has any branding.

“VENOM” has become the latest example of what we call bugs with branding. This has got to stop because it corrupts journalism and makes the field of computer security almost synonymous with marketing or advertising. CrowdStrike used ALL CAPS (for emphasis rather than acronym) and connotation with poison to market itself, an insecurity firm, after finding a floppy drive bug from over a decade ago. There is a logo too (the first example we found of it), not just branding for this bug, dubbed “VENOM”.

Bug branding (turning number into branding-friendly FUD) seems to have adopted the ALL CAPS convention from “GHOST”, only for extra scare. This FUD has surfaced even in Linux-centric sites, which played along with the marketing campaign. Red Hat [1] and SJVN [2], even Phoronix [3] and Softpedia [4], have covered it by now, despite no focus on security news there.

Branding for bugs leads to stupid headlines that are more poetic than factual and are very light on facts. There is little substance there. This whole recipe (bug+brand name+logo=lots of publicity without much merit) has been repeatedly exploited to give a bad name to FOSS security. A lot of headlines try to connect this to the “Heartbleed” brand. Headlines that we have found so far (links below) include “New Venom bug hits data centers, but it’s hardly Heartbleed”, “Venom bug could allow hackers to take over cloud servers – and experts say it could be worse than Heartbleed”, “New Venom flaw may be worse than Heartbleed, researchers warn”, and “Venom vulnerability more dangerous than Heartbleed, targets most virtual machines”.

Zack Whittaker (former Microsoft staff) covered it like this in the CBS-owned tech tabloid, ZDNet: “Bigger than Heartbleed, ‘Venom’ security vulnerability threatens most datacenters”

Here is that “Heartbleed” brand again. “Please Stop Comparing Every Security Flaw to Heartbleed,” said one good headline from Gizmodo (that’s just how they covered this marketing campaign).

The word/brand “Heartbleed” was made up by a Microsoft-connected firm. Watch coverage from Microsoft-friendly sites and you will find headlines like: “Heartbleed, eat your heart out: VENOM vuln poisons countless VMs”

Dan Goodin, a foe of FOSS (from a security angle), brings in the NSA and Bitcoin to add FUD amid this branded bug/buzz. He wrote about the latest branded bug not once but twice (see links below). He is squeezing the most FOSS FUD out of it (opportunism). Kim Komando chose the headline “New bug taking over the Internet”. No sensationalism here? One press release said “Better Business Bureau Says Most Don’t Need to Worry” [about the branded bug], so there is some objectivity out there too, or an effort to calm people down.

Watch carefully how the bug is marketed in the media: Logo with SVG-like transparency; for a bug! Looks like it was prepared by graphics/marketing professionals. Are insecurity firms now liaising with marketing firms to professionally draw SVG logos for bugs? More logos for simple bugs (we found several, but one main logo) are circulating, usually with photos of snakes. See the complete list [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36] as of this morning. How much more of this FUD is going to circulate before journalists realise that they make a mountain out of a molehill?

Related/contextual items from the news:

  1. VENOM, don’t get bitten.

    CVE-2015-3456 (aka VENOM) is a security flaw in the QEMU’s Floppy Disk Controller (FDC) emulation. It can be exploited by a malicious guest user with access to the FDC I/O ports by issuing specially crafted FDC commands to the controller. It can result in guest controlled execution of arbitrary code in, and with privileges of, the corresponding QEMU process on the host. Worst case scenario this can be guest to host exit with the root privileges.

  2. For Venom security flaw, the fix is in: Patch your VM today

    The QEMU fix itself is now available in source code. Red Hat has been working on the fix since last week.

  3. VENOM Bug In QEMU Escapes VM Security
  4. 11-Year-Old Bug in Virtual Floppy Drive Code Allows Escape from Virtual Machines

    Popular virtualization platforms relying on the virtual Floppy Disk Controller code from QEMU (Quick Emulator) are susceptible to a vulnerability that allows executing code outside the guest machine.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Patent Extremism: Stacking the Panels, the Surveys, the Hearings, the Debates

    Projection tactics would have the public believe that those who oppose corruption are simply radicals; patent polarity has come to the point where if one isn't a "true believer" in blackmail (patent trolls) or opposes bribery, then one is simply a "fringe" and akin to terrorists



  2. Links 24/6/2019: Linux 5.2 RC6, Skrooge 2.20.0, ZFS vs. OpenZFS

    Links for the day



  3. The EPO Needs a President Who Obeys the Law, Not One Who Obeys Battistelli

    Succession based on nepotism at Europe's second-largest institution served to shown how inherently broken things had become and why cover-up of injustices is nowadays paramount (not fixing the flaws/ills but merely perpetuating them)



  4. With Water (Treatment) Already Patented It Won't Take Long for Patents (and Patent Royalties) on Air

    A 'paper economy' is what Europe turns into if the current trajectory is followed (led by lawyers, not producers)



  5. Bill Gates Said He Was on a “Jihad” Against GNU/Linux, But GNU/Linux Users/Developers Engaged in Self-Defense Are Foul-Mouthed 'Microsoft Haters'?

    Microsoft, which routinely commits very serious crimes, tries to come across as some sort of philanthropy whereas those who share their work with the public (for greater good) are described as erratic, rude and unworthy of respect from corporations (outcasts basically, deprived of income source)



  6. What Patents the EPO Has Just Awarded (With a Special Reward), Not Just Granted

    The EPO's practice of elevating some patents over the other patents (European Patents) is perhaps more of a societal liability than the EPO cares to realise



  7. Required Reading: Mental State of Team Battistelli/Campinos

    On the heels of yesterday's article about Team Battistelli/Campinos, here are some recommended/required papers on the problem which likely plagues the Office



  8. Links 23/6/2019: Wine 4.11, FreeBSD 11.3 RC2

    Links for the day



  9. Microsoft Apparently Did a Patrick Durusau on Wim Coekaerts to Broaden Its Control Over GNU/Linux

    Microsoft tactics for defection and takeover of the competition (without coming across as hostile) aren't new tactics; internal documents from Microsoft explain how to achieve this



  10. EPO Directors Would be Wise to Rebel Against Team Campinos While They Still Have the Job

    As the EPO continues its bold journey towards dictatorship (where presidencies are passed between friends and ‘circles’ are former colleagues or close confidants) Techrights urges those who have power to speak out — e.g. EPO judges and Directors — to do something before it’s too late



  11. American Front Group Open Invention Network (Riding the Linux Brand) is a Proponent of Software Patents in Europe

    The impact of American multinationals in Europe is difficult to deny; in fact, we're observing the same old lobbying/lobbies still working hard albeit more covertly (typically using front groups)



  12. Say 'Hey Hi' to Software Patents

    Using the “AI” (“HEY HI”) hype the ‘community’ of patent maximalists hopes that every little (and possibly very old) algorithm will suddenly sound amazing and innovative — to the point where it becomes unthinkable to deny a patent monopoly on it



  13. A Personal Note From Ted MacReilly (How Microsoft Works Against GNU/Linux)

    A tongue-in-cheek write-up highlighting the ways Microsoft insiders think and how they strategise against GNU/Linux and Free/libre software



  14. The Linux Foundation's New Vice Chair, Wim Coekaerts, Worked for Microsoft

    The Linux Foundation is boosting the Microsoft boosters and calls that "community"



  15. Links 21/6/2019: GNOME 3.33.3, 32-Bit Support Further Neglected, DragonFlyBSD 5.6.1 Released

    Links for the day



  16. Leaked: Harassment of EPO Directors by Team Campinos

    “New BIT organisation and staff changes,” a novel kind of newspeak, means that Directors are being severely punished without due process at all (“hidden disciplinary measure without disciplinary proceedings”)



  17. Patent Professionals in Europe Have Devolved Into a Marketing Industry

    Lies, buzzwords and hype waves is all that the patent bubble in Europe boils down to these days; loads of bogus patents get granted only for European judges to smack these down (if one can afford the court battle)



  18. Almost Six Months After Iancu Said He Would Make Software Patents Great Again Nothing Has Actually Changed

    We're just a fortnight away from the ludicrous plan of Iancu celebrating 6 months (without accomplishing anything)



  19. Links 20/6/2019: Kubernetes 1.15, Alpine 3.10.0 and Librem 5 June Software Update

    Links for the day



  20. Ignore the EPO's Dumb Festival and Focus on the Abuses Against the Workforce and Its Quality of Work

    Don’t lose sight of the appalling behaviour of the management of the EPO; the last thing it wants is press coverage about its gross abuses and corruption — an aspect it spent literally millions of euros to bury (gaming the news cycle)



  21. Microsoft Attempting to Destroy the Careers of Its Critics, Including Free Software Proponents

    Microsoft isn't changing and has not changed; the tactics described above are still being used, even by its "Open Source" (or "Open at Microsoft") people, who did this to me



  22. Links 19/6/2019: Linux Mint Vs Vista 10, Qt 5.13 Released

    Links for the day



  23. The Linux Foundation's Business Model

    The Linux Foundation's plan, illustrated



  24. Links 18/6/2019: i386 Abandoned by Canonical and a New osquery 'Community'

    Links for the day



  25. Indifference or Even Hostility Towards Patent Quality Results in Grave Injustice

    The patent extravaganza in Europe harms small businesses the most (they complain about it), but administrative staff at patent offices only cares about the views of prolific applicants rather than the interests of citizens in respective countries



  26. Links 18/6/2019: CentOS 8 Coming Soon, DragonFly BSD 5.6 Released

    Links for the day



  27. 'AI Taskforce' is Actually a Taskforce for Software Patents

    The mainstream media has been calling just about everything "HEY HI!" (AI), but what it typically refers to is a family of old algorithms being applied in possibly new areas; patent maximalists in eastern Asia and the West hope that this mainstream media's obsession can be leveraged to justify new kinds of patents on code



  28. Patent Maximalism is Dead in the United States

    Last-ditch efforts, or a desperate final attempt to water down 35 U.S.C. § 101, isn't succeeding; stacked panels are seen for what they really are and 35 U.S.C. § 101 isn't expected to change



  29. Links 18/6/2019: Linux 5.2 RC5 and OpenMandriva Lx 4

    Links for the day



  30. Weaponising Russophobia Against One's Critics

    Response to smears and various whispering campaigns whose sole purpose is to deplete the support base for particular causes and people; these sorts of things have gotten out of control in recent years


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts