EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

05.14.15

VENOM® is Not a Serious Bug, It’s Just a Marketing Campaign From CrowdStrike

Posted in Security at 10:47 am by Dr. Roy Schestowitz

Bugs
Image courtesy of Red Hat, demonstrating lack of correlation between severity and logos/brands

Summary: Many journalists bamboozled into becoming couriers of CrowdStrike, an insecurity firm which tries to market itself using a name and logo for a very old bug

THERE is a disproportionate level of coverage not of Free software but of bugs in Free software. We last wrote about it only days ago

A firm called CrowdStrike (who? Exactly!) is trying to emulate the ‘success’ of previous FUD campaigns. Now is the time to check who’s a real journalist (fact-checking) and who’s just serving PR campaigns like “VENOM”, a shameless FUD campaign from CrowdStrike.

The whole “VENOM” nonsense was covered in a good article titled “VENOM hype and pre-planned marketing campaign panned by experts”. To quote: “On Wednesday, CrowdStrike released details on CVE-2015-3456, also known as Venom. Venom is a vulnerability in the floppy drive emulation code used by many virtualization platforms.

“However, while it’s possible that a large number of systems are impacted by this flaw, it isn’t something that can be passively exploited.

“Several security experts discussed the flaw online, focusing on the marketing and the media attention that it generated – including some over-hyped headlines. Most media organizations were briefed ahead of time about the discovery and gagged by embargo until the Venom website launched, so they had plenty of time to write.

“Many media articles compared Venom to Heartbleed, which is an apples to oranges comparison. If anything, the only commonality is the fact that both flaws had a pre-planned marketing campaign.”

Here comes the “Heartbleed” brand. Yet again. They’re using names that are scary (even all caps, like “GHOST”) because it’s so much easier to sell than “CVE-2015-3456″. Journalists rarely have the technical knowledge to analyse a bug or a flaw, so they assume bugs and logos are indicative of severity.

This patch Tuesday Microsoft revealed 40+ vulnerabilities. Not a single one had a brand name, logo, etc. Here is how IDG covered 46 flaws publicly disclosed by Microsoft just for this Tuesday (Microsoft hides even more flaws). So many flaws were collectively covered in one article and yet there are no logos; none has any branding.

“VENOM” has become the latest example of what we call bugs with branding. This has got to stop because it corrupts journalism and makes the field of computer security almost synonymous with marketing or advertising. CrowdStrike used ALL CAPS (for emphasis rather than acronym) and connotation with poison to market itself, an insecurity firm, after finding a floppy drive bug from over a decade ago. There is a logo too (the first example we found of it), not just branding for this bug, dubbed “VENOM”.

Bug branding (turning number into branding-friendly FUD) seems to have adopted the ALL CAPS convention from “GHOST”, only for extra scare. This FUD has surfaced even in Linux-centric sites, which played along with the marketing campaign. Red Hat [1] and SJVN [2], even Phoronix [3] and Softpedia [4], have covered it by now, despite no focus on security news there.

Branding for bugs leads to stupid headlines that are more poetic than factual and are very light on facts. There is little substance there. This whole recipe (bug+brand name+logo=lots of publicity without much merit) has been repeatedly exploited to give a bad name to FOSS security. A lot of headlines try to connect this to the “Heartbleed” brand. Headlines that we have found so far (links below) include “New Venom bug hits data centers, but it’s hardly Heartbleed”, “Venom bug could allow hackers to take over cloud servers – and experts say it could be worse than Heartbleed”, “New Venom flaw may be worse than Heartbleed, researchers warn”, and “Venom vulnerability more dangerous than Heartbleed, targets most virtual machines”.

Zack Whittaker (former Microsoft staff) covered it like this in the CBS-owned tech tabloid, ZDNet: “Bigger than Heartbleed, ‘Venom’ security vulnerability threatens most datacenters”

Here is that “Heartbleed” brand again. “Please Stop Comparing Every Security Flaw to Heartbleed,” said one good headline from Gizmodo (that’s just how they covered this marketing campaign).

The word/brand “Heartbleed” was made up by a Microsoft-connected firm. Watch coverage from Microsoft-friendly sites and you will find headlines like: “Heartbleed, eat your heart out: VENOM vuln poisons countless VMs”

Dan Goodin, a foe of FOSS (from a security angle), brings in the NSA and Bitcoin to add FUD amid this branded bug/buzz. He wrote about the latest branded bug not once but twice (see links below). He is squeezing the most FOSS FUD out of it (opportunism). Kim Komando chose the headline “New bug taking over the Internet”. No sensationalism here? One press release said “Better Business Bureau Says Most Don’t Need to Worry” [about the branded bug], so there is some objectivity out there too, or an effort to calm people down.

Watch carefully how the bug is marketed in the media: Logo with SVG-like transparency; for a bug! Looks like it was prepared by graphics/marketing professionals. Are insecurity firms now liaising with marketing firms to professionally draw SVG logos for bugs? More logos for simple bugs (we found several, but one main logo) are circulating, usually with photos of snakes. See the complete list [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36] as of this morning. How much more of this FUD is going to circulate before journalists realise that they make a mountain out of a molehill?

Related/contextual items from the news:

  1. VENOM, don’t get bitten.

    CVE-2015-3456 (aka VENOM) is a security flaw in the QEMU’s Floppy Disk Controller (FDC) emulation. It can be exploited by a malicious guest user with access to the FDC I/O ports by issuing specially crafted FDC commands to the controller. It can result in guest controlled execution of arbitrary code in, and with privileges of, the corresponding QEMU process on the host. Worst case scenario this can be guest to host exit with the root privileges.

  2. For Venom security flaw, the fix is in: Patch your VM today

    The QEMU fix itself is now available in source code. Red Hat has been working on the fix since last week.

  3. VENOM Bug In QEMU Escapes VM Security
  4. 11-Year-Old Bug in Virtual Floppy Drive Code Allows Escape from Virtual Machines

    Popular virtualization platforms relying on the virtual Floppy Disk Controller code from QEMU (Quick Emulator) are susceptible to a vulnerability that allows executing code outside the guest machine.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Links 20/3/2019: Google Announces ‘Stadia’, Tails 3.13

    Links for the day



  2. CEN and CENELEC Agreement With the EPO Shows That It's Definitely the European Commission's 'Department'

    With headlines such as “EPO to collaborate on raising SEP awareness” it is clear to see that the Office lacks impartiality and the European Commission cannot pretend that the EPO is “dafür bin ich nicht zuständig” or “da kenne ich mich nicht aus”



  3. Decisions Made Inside the European Patent Organisation (EPO) Lack Credibility Because Examiners and Judges Lack Independence

    The lawless, merciless, Mafia-like culture left by Battistelli continues to haunt judges and examiners; how can one ever trust the Office (or the Organisation at large) to deliver true justice in adherence or compliance with the EPC?



  4. Team UPC Buries Its Credibility Deeper in the Grave

    The three Frenchmen at the top do not mention the UPC anymore; but those who promote it for a living (because they gambled on leveraging it for litigation galore) aren't giving up and in the process they perpetuate falsehoods



  5. The EPO Has Sadly Taken a Side and It's the Patent Trolls' Side

    Abandoning the whole rationale behind patents, the Office now led for almost a year by António Campinos prioritises neither science nor technology; it's all about granting as many patents (European monopolies) as possible for legal activity (applications, litigation and so on)



  6. Where the USPTO Stands on the Subject of Abstract Software Patents

    Not much is changing as we approach Easter and software patents are still fool's gold in the United States, no matter if they get granted or not



  7. Links 19/3/2019: Jetson/JetBot, Linux 5.0.3, Kodi Foundation Joins The Linux Foundation, and Firefox 66

    Links for the day



  8. Links 18/3/2019: Solus 4, Linux 5.1 RC1, Mesa 18.3.5, OSI Individual Member Election Won by Microsoft

    Links for the day



  9. Microsoft and Its Patent Trolls Continue Their Patent War, Including the War on Linux

    Microsoft is still preying on GNU/Linux using patents, notably software patents; it wants billions of dollars served on a silver platter in spite of claims that it reached a “truce” by joining the Open Invention Network and joining the LOT Network



  10. Director Iancu Generally Viewed as a Lapdog of Patent Trolls

    As Director of the Office, Mr. Iancu, a Trump appointee, not only fails to curb patent trolls; he actively defends them and he lowers barriers in order to better equip them with bogus patents that courts would reject (if the targets of extortion could afford a day in court)



  11. Links 17/3/2019: Google Console and IBM-Red Hat Merger Delay?

    Links for the day



  12. To Team UPC the Unified Patent Court (UPC) Has Become a Joke and the European Patent Office (EPO) Never Mentions It Anymore

    The EPO's frantic rally to the very bottom of patent quality may be celebrated by obedient media and patent law firms; to people who actually produce innovative things, however, this should be a worrisome trend and thankfully courts are getting in the way of this nefarious agenda; one of these courts is the FCC in Germany



  13. Links 16/3/2019: Knoppix Release and SUSE Independence

    Links for the day



  14. Stopping António Campinos and His Software Patents Agenda (Not Legal in Europe) Would Require Independent Courts

    Software patents continue to be granted (new tricks, loopholes and buzzwords) and judges who can put an end to that are being actively assaulted by those who aren't supposed to have any authority whatsoever over them (for decisions to be impartially delivered)



  15. The Linux Foundation Needs to Speak Out Against Microsoft's Ongoing (Continued) Patent Shakedown of OEMs That Ship Linux

    Zemlin actively thanks Microsoft while taking Microsoft money; he meanwhile ignores how Microsoft viciously attacks Linux using patents, revealing the degree to which his foundation, the “Linux Foundation” (not about Linux anymore, better described as Zemlin’s PAC), has been compromised



  16. Links 15/3/2019: Linux 5.0.2, Sublime Text 3.2

    Links for the day



  17. The EPO and the USPTO Are Granting Fake Patents on Software, Knowing That Courts Would Reject These

    Office management encourages applicants to send over patent applications that are laughable while depriving examiners the freedom and the time they need to reject these; it means that loads of bogus patents are being granted, enshrined as weapons that trolls can use to extort small companies outside the courtroom



  18. CommunityBridge is a Cynical Microsoft-Funded Effort to Show Zemlin Works for 'Community', Not Microsoft

    After disbanding community participation in the Board (but there are Microsoft staff on the Board now) the "Linux Foundation" (or Zemlin PAC) continues to take Microsoft money and polishes or launders that as "community"



  19. Links 14/3/2019: GNOME 3.32 and Mesa 19.0.0 Released

    Links for the day



  20. EPO 'Results' Are, As Usual, Not Measured Correctly

    The supranational monopoly, a monopoly-granting authority, is being used by António Campinos to grant an insane amount of monopolies whose merit is dubious and whose impact on Europe will be a net negative



  21. Good News Everyone! UPC Ready to Go... in 2015!

    Benoît Battistelli is no longer in Office and his fantasy (patent lawyers' fantasy) is as elusive as ever; Team UPC is trying to associate opposition to UPC with the far right (AfD) once again



  22. Links 13/3/2019: Plasma 5.15.3,Chrome 73 and Many LF Press Releases

    Links for the day



  23. In the Age of Trumpism EFF Needs to Repeatedly Remind Director Iancu That He is Not a Judge and He Cannot Ignore the Courts

    The nonchalance and carelessness seen in Iancu's decision to just cherry-pick decisions/outcomes (basically ignoring caselaw) concerns technologists, who rightly view him as a 'mole' of the litigation 'industry' (which he came from)



  24. Links 12/3/2019: Sway 1.0 Released, Debian Feuds Carry On

    Links for the day



  25. Microsoft is Complaining About Android and Chrome OS (GNU/Linux) Vendor Not Paying for Microsoft Patents (Updated)

    Microsoft, which nowadays does the patent shakedown against GNU/Linux by proxy, is still moaning about companies that don’t pay ‘protection’ money (grounds for antitrust action or racketeering investigation)



  26. Watchtroll Has Redefined "Trolls" to Mean Those Who Oppose Software Patents (and Oppose Trolls), Not Those Who Leverage These for Blackmail Alone

    The controversial change to 35 U.S.C. § 101 guidance is being opposed by the public (US citizens who oppose American software patents), so patent maximalists like Janal Kalis (“PatentBuddy”) and extremists like Gene Quinn (Watchtroll) want us to believe that the public is just “EFF” and cannot think for itself



  27. EPO's Latest 'Results' Show That António Campinos Has Already Given Up on Patent Quality and is Just Another Battistelli

    The patent-granting machine that the EPO has become reports granting growth of unrealistic scale (unless no proper examination is actually carried out)



  28. Links 11/3/2019: Linux 5.0.1, Audacity 2.3.1, GNU Coreutils 8.31

    Links for the day



  29. US Patent Law Currently Not Changing Much and Software Patents Are Still in Limbo

    Surveying the news, as we still meticulously do (even if we don't write about it), it seems clear that American courts hardly tolerate software patents and proponents of such patents are losing their voice (or morale)



  30. EPO Examiner: “I Have Been Against Software Patents and Eventually 3/4 of My Job is Examining Software Patent Applications.”

    Overworked examiners aren't being given the time, the tools and the freedom to reject patents, based on prior art, patent scope and so on; it is beginning to resemble a rubber-stamping operation, not an examining authority


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts