Cyberattacks often exploit vulnerabilities in IT systems, yet these vulnerabilities frequently go unnoticed by system operators, who may also underestimate their significance.
Previous research has advocated for proactive notifications to system operators about both exploited vulnerabilities and misconfigurations that could lead to compromises or data breaches.
However, large-scale vulnerability notification campaigns, where security vulnerabilities are disclosed to a large number of vulnerable system operators, have proven to be surprisingly challenging.
The various vulnerability notification experiments conducted in this area have yielded mixed and sometimes contradictory results, leaving the reader with the impression that there are no conclusive recommendations on how to effectively reach out to vulnerable system operators.
Consequently, our work seeks to identify and address research gaps in previous work, aiming to present a comprehensive picture of the effectiveness of vulnerability notification campaigns and to offer evidence-based recommendations for those who find vulnerabilities.
Our work aims to provide a structured guide for researchers and practitioners on how to design effective vulnerability notification campaigns.
Research Questions
Some interesting research questions that have already been answered are:
What are suitable senders that system operators deem trustworthy and which of these trustworthy senders has what impact on the remediation of a vulnerability?
Which framing has what impact on the remediation of a vulnerability and do interaction effects exist between the sender and the framing of a vulnerability notification?
How does an interactive self-test tool increase remediation compared to textual information and do interaction effects exist between the sender of the vulnerability notification and the provider of the self-test tool?
How do system operators reacto to vulnerability notifications and what reasons do they provide for non-remediation even after being notified?
Further research questions arising from previous own and related work are:
Which legal and technical conditions allow for the use of a legal sender or framing in the context of vulnerability notifications?
How are data protection protection authorities currently involved in vulnerability disclosure processes?
Which factors increase the likelihood that notifications are processed by recipients and which of these factors may also influence the recipients' response behavior?
Informational Material
In cooperation with Muthmedia, mindUp Web & Intelligence GmbH and BDO AG, a video was produced to raise awareness for unauthorized malicious website redirects.
The video is split in two parts.
The goal of the first video is to make website owners aware of unauthorized malicious website redirects.
It contains a description of the hacking and tips on how to identify it, as well as information on the hackers' intentions, possible attack vectors and possible consequences for website operators and visitors.
The goal of the second video is to help those affected by unauthorized malicious website redirects to remediate the hacking themselves and ideally to make their future behavior more secure.
It contains in-depth information on how to identify the hacking and what measures can be taken to remediate and protect against future attacks.
