You've Got Vulnerability: Exploring Effective Vulnerability Notifications
summary
Researchers notify thousands of vulnerable hosts (scans find 45,000 publicly accessible ICS, 8,000 routers and 172,000 servers with inconsistent IPv6 firewalls, and 84,000 DDoS amplifiers) and measure remediation. Contacting WHOIS abuse addresses with whois verbose notifications yields the best result, producing a 10–15% uplift in fixes but still leaves most hosts unpatched; effects concentrate in the first three to four days and repeat notifications do not increase patching. Translated messages reduce remediation, and human replies are largely positive (about 76% thanking the notifier).
AI-written summary · about
chapters (5)
related talks
58mNothing to Risk but Risk Itself: Expanding Vulnerability Risk with Internet-Scale Data
23mFrom Patching Delays to Infection Symptoms: Using Risk Profiles for an Early Discovery of Vulnerabilities Exploited in the Wild
27mVulnerability Response of Last Resort
56mOutpacing Attackers: How Data-Driven Insights Speed Up Vulnerability Remediation
11mVulnerability Supply Chains
57mSeeing the Vulnerable Forest Through the Exploited Trees
33mUnderstanding the Impact of Critical Vulnerabilities in Critical Infrastructure: A De...
24mSecurity Advisories and Vulnerability Prioritization in the Wild