17

In the IT/Programming security world, usually people contact the vendor/owner of a particular software if they find a bug or security vulnerability and give them time to patch it before releasing the bug or vulnerability for public scrutiny/awareness. This is usually as a courtesy though unless you're bound by contract. But as asked in If I Find or Create a 0day: What if I find a vulnerability in a widely used piece of software?

Can I be held liable for damages if I release "Proof of Concept" code to the public without giving the vendor time to properly patch and update its vulnerable code?

UPDATE: After having a discussion about this question with some peers, I realized I need to be a bit more specific with the question: Security researchers usually work with the vendor to try and patch (fix) the error/vulnerability. If after sufficient (30 days?) time has passed and the vendor has not fixed the code then a full disclosure is released publicly.

Can I be held liable for damages caused after the release of a "Proof of Concept" code if the software/vendor is open source? What if the vendor/software is closed source?

13

Can you be liable for damages? Under Tort Law, yes.

Let's assume someone developed a virus based on your code. The virus caused millions of dollars of damage. The plaintiff (software vendor) can argue that:

  1. You have a Duty of Care

to avoid acts or omissions which you can reasonably foresee are likely to injure your neighbor

Donoghue v. Stevenson (1932) (UK)

The concept of Duty of Care is also found in U.S. law, for example in MacPerson v. Buick Motor Co. (1916), which established that negligence does not require a contract.

  1. Breach of Duty: A reasonable person can foresee that the "proof of concept" can cause harm. The act of releasing code, therefore, falls short of the expected standard. If you are a IT professional, it is going to be difficult to defend this point.
  2. There is a causation relationship between your code release and the resulted damage.

  3. You are liable for negligence.

  4. Damage: It is likely that users will sue the software vendor for their loses. The software vendor will then sue you, since because of you, the software vendor has to compensate to its customers.

This, of course, depends on what exactly did you release to the public. For example, if significant effort is needed to convert your "proof of concept" to an actual exploit, and you have provided a workaround to avoid this vulnerability, you may defend yourself by arguing that the cause and effect linkage is too remote.


So I must keep the report private? What if the software is open source?

Not really. You should take reasonable measure to ensure that your "proof of concept" is not an actual exploit, and a hacker needs considerable time to develop a functioning malicious software. CVE is a platform where vulnerabilities are publicly shared.


What if you have given the vendor reasonable time to fix the vulnerability?

It does not matter (to you) if time has been given for the vendor to fix the vulnerability. It does matter for the vendor, because if something happens later, the vendor is liable for knowing the problem well in advance and have not allocated the appropriate resources to correct the problem.

To demonstrate a vulnerability exist does not require instruction of how to utilize this vulnerability. For example you can record a video showing the effects of the hack.


Here (link dead, copy on paste-bin) is an interesting read about Motorola taking matters into their own hands after they discovered a vulnerability on the Xerox CP-V system and Xerox did not patch the problem.

  • I've updated the question. I believe the answer would only be applicable to a situation where the vulnerability is in a 'closed-source' software/hardware. – Digital fire May 28 '15 at 17:33
  • The case you cited was a UK case. Since the question was tagged united-states, you may want to explicitly mention that you were citing a UK case (or if the whole answer is based on UK law, say that). – cpast May 28 '15 at 18:12
  • 1
    @cpast I have added a reference to US case. – kevin May 29 '15 at 3:13
  • 2
    Make sure you mention that U.S. case is a state law case. There is no Federal common-law law (although legal scholars can split hairs). Also note that while there is the negligence claim, there is a larger question of standing, that is who is entitled to bring the claim to begin with and there is also the question of damages. So in a negligence claim all are required (1) duty; (2) breach; (3) causation; and (4) damages, and (5) the plaintiff must have standing to bring the claim. – David C. Rankin May 29 '15 at 19:23
  • This answer seems to be a bit backwards -- how come it's the researcher's fault if the programmers of the company who wrote the code can't count and/or type? E.g. off-by-one etc. Likewise, most software comes with no warranty; if the manufacturer specifically decided to provide warranty, it's not your fault that they did so without ensuring their code is not subject to these off-by-one or other straightforward errors. – cnst May 31 '15 at 4:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.