论文标题
说话的特洛伊木马：分析整个行业披露
Talking Trojan: Analyzing an Industry-Wide Disclosure
论文作者
论文摘要
虽然脆弱性研究通常集中在技术发现和公共发布后的工业响应上，但我们提供了故事的其余部分：从发现到公众发布的协调披露过程。整个行业范围内的“ Trojan Source”漏洞影响了大多数编译器，口译员，代码编辑和代码存储库提供了一个有趣的自然实验，使我们能够比较公司与非营利组织的响应以及管理自己的响应与外包公司的公司的响应。我们记录了与漏洞赏金计划，政府披露援助，学术同伴审查和新闻报道等主题的互动。我们将对源代码攻击的响应与对使用机器学习技术的NLP系统的可比攻击的响应进行了比较。我们最终提出了改善全球协调披露系统的建议。
While vulnerability research often focuses on technical findings and post-public release industrial response, we provide an analysis of the rest of the story: the coordinated disclosure process from discovery through public release. The industry-wide 'Trojan Source' vulnerability which affected most compilers, interpreters, code editors, and code repositories provided an interesting natural experiment, enabling us to compare responses by firms versus nonprofits and by firms that managed their own response versus firms that outsourced it. We document the interaction with bug bounty programs, government disclosure assistance, academic peer review, and press coverage, among other topics. We compare the response to an attack on source code with the response to a comparable attack on NLP systems employing machine-learning techniques. We conclude with recommendations to improve the global coordinated disclosure system.
