Flock Can Assign CVEs for Its Products, Raising Questions About Trust and Oversight
Summary
Flock has become a CVE Numbering Authority for its products. Security experts question whether it will publish accurate, timely vulnerability records, citing concerns about conflicts of interest, disclosure restrictions, and the company’s track record.
Key points
- Flock can now assign CVE IDs and assess vulnerabilities in its own products as a CVE Numbering Authority.
- The company says the role will speed its response to reports and provide customers with a single source for security information.
- Experts say Flock’s credibility will depend on accurate records that identify affected product versions, risks, and mitigations.
- Flock’s disclosure policy bars testing on live customer deployments and restricts several testing methods; the company has no paid bug bounty program.
- The policy allows Flock to delay publication if it believes disclosure could create a safety risk, prompting concerns about transparency and potential conflicts of interest.
- Researchers previously reported defects in Flock devices that the company considered non-material because exploitation required physical access.
Article Details
- Event Type
- Flock was granted CVE Numbering Authority (CNA) status, allowing it to assign CVE IDs to vulnerabilities in its own products.
- Impact
- Flock can assess and publish vulnerability records for its products. The article reports concerns from experts about the credibility, accuracy, transparency, and potential conflicts of interest involved in a vendor assessing its own products; no specific new vulnerability or confirmed security incident is reported.
People
Chris CastaldoFlock's chief information security officer; described the company's reasons for becoming a CNA.Katie MoussourisFounder at CEO at Luta Security; commented on evaluating Flock's CNA records and the risks of vendor control over vulnerability disclosure.Zach EdwardsSecurity and privacy researcher who expressed doubts about Flock's CNA role and discussed vulnerability disclosures concerning its products.
Vendors
Industries
Law enforcementFlock, the controversial public safety company entangled in controversy amid recurring law enforcement abuse of its products, gained authority to assign CVE IDs to vulnerabilities in its own products and grade thosePublic safetyFlock, the controversial public safety company entangled in controversy amid recurring law enforcement abuse of its products, gained authority to assign CVE IDs to vulnerabilities in its own products and grade those