Now that we’ve completed our first-ever category to Pwn2Own Vancouver, saw in a row, and disclosed a significantly impactful – and that’s just a few of the highlights. We awarded more than $1.5 million in cash and prizes throughout 2019, and if January is any indicator, 2020 will be an amazing year as well.
Of course, our program relies on external contributors, and we couldn’t do our job without the input and talent of our global community of independent researchers. Their work and submissions are key to our success, and we thank them for their continued trust in our program. Our program also wouldn’t work without vendors generating and releasing fixes for the vulnerabilities we report to them. The ZDI would not be able to sustain this level of advisories – and thus, better protections for Trend Micro customers – without the contributions of researchers and vendors, and we thank them for all they do.
By the Numbers
As of now, the ZDI has published 1,035 advisories for 2019. We usually see notifications from vendors early in the new year of vulnerabilities patched late in the previous year (but where advisories were not coordinated). Because of this, the actual number of 2019 advisories will eventually increase. We’ll update this blog with the final numbers when we have them. Here’s how that number of advisories stacks up year-over-year.
Figure 1 - Advisories published from 2005 through 2019
You’ll notice the total advisories published are down from last year. That doesn’t mean we were any less busy, or that there were fewer bugs coming into the program. If anything, 2018 was a slight aberration, with multiple vendors having more than 200 advisories. Programmatically, we have shifted our focus to reports with greater impact. This is reflected in the CVSS scores of the published advisories, which show a shift from medium to high severity.
Figure 2 - CVSS scores of published advisories from 2015 through 2019
The increase in low-severity CVSS cases reflects our commitment to information disclosure cases. On their own, they aren’t as impactful. However, when combined with other vulnerabilities, they become an essential piece of an exploit chain. As exploits often rely on info leaks for sandbox escapes and other compromises, these humble info disclosure bugs will continue to be worth purchasing.
Coordinated disclosure of vulnerabilities continues to be a successful venture. A total of 88% of 2019 advisories were published in conjunction with a fix from the vendor. This is in line with disclosure rates from the last few years. The sector that has the most difficulty meeting our disclosure timelines continues to be ICS/SCADA vendors, but perhaps events like Pwn2Own Miami and continued outreach can help change that in 2020.
Figure 3 – Portion of published ZDI advisories with no vendor fix available, by year
Looking at the distribution of vendors affected by our advisories, you’ll notice some familiar names at the top of that list:
Figure 4 - Advisories per vendor for 2019
In years past, many of the Microsoft bugs we purchased were browser related. We’re still buying plenty of those, but this year saw an increase in bugs affecting the OS as well. In particular, we had an increase in bugs impacting font parsing – both in the kernel and in the GDI+ library. The JET database engine also proved to be a popular target for researchers. Similarly, bugs in Adobe software used to be synonymous with Flash, but that’s no longer the case. In 2019, 2 out of 3 Adobe bugs we purchased impact Acrobat and Reader. We did purchase a few Flash bugs, but we actually had more submissions for Photoshop than we did for Flash – five times more. This year also saw an increase in the amount of ICS/SCADA bugs submitted to the program. A little more than 30% of the published advisories were related to an ICS product in some form.
Techniques and Trends
When looking through the submissions, we definitely saw a few trends when it came to root cause as described by the Common Weakness Enumeration ( channel, and follow us on Twitter for the latest updates from the ZDI.
SOCIAL SHARE CARD GENERATOR