Re:Ad Vulna: Vulnerable and Aggressive Adware Threatening Mi...
by greenyoda on Tuesday October 08, 2013 @12:36AM
(#6513079)
"I'm curious as to why FireEye chose not to disclose the library."
For the same reason that most responsible security researchers don't disclose zero-day threats: to prevent people from exploiting them before they can be fixed. In this case, they did notify Google, which can pull the compromised apps out of their app store and notify the developers who've used this library that they need to rewrite their apps.
For the same reason that most responsible security researchers don't disclose zero-day threats: to prevent people from exploiting them before they can be fixed. In this case, they did notify Google, which can pull the compromised apps out of their app store and notify the developers who've used this library that they need to rewrite their apps.