In the aftermath of the Copy Fail bug being (very unceremoniously) disclosed, the security news organization Decipher published a (maybe not serious?) “Mt. Rushmore of branded bugs”. The list is as follows…
And then for fun they mention Stuxnet (which is more of a worm than it is a vuln/exploit).
My Mt. Rushmore of Branded Bugs
I consider myself a bit of a purveyor of branded bugs, and have worked for years (since 2012) in the world of Vulnerability Management—I’ve seen them all come and go. These four are certainly well-known named vulns, but I wouldn’t consider that list exactly, to be the Mt. Rushmore. If I were to make my own top 4 / “Mt. Rushmore” of named vulnerabilities, based on severity, notoriety, flare and my own personal experiences with them, then these are the 4 I’m picking (in chronological order)…
(Note that I’m only choosing named vulns that have a logo, because otherwise how would we chisel their likeness into a cliffside?!)
This one had everything—a logo, its own website, known exploitation, all of it. I also consider it to be the “OG” of named/branded bugs—the one that started it all.
VENOM is an interesting case, and could easily be dethroned by another bug. It had its own logo and website, but no real known exploitaiton ever came from it. That said, the industry concern in the wake of its publishing was the real deal.
Short story time: I was at a security conference when this was first announced/published and I have this vivid memory of all these security engineers, leaders, professionals, etc… all simultaneously taking phone calls, checking emails, ducking out of the room to respond to this bug. Fun times.
Though I haven’t really heard of any cases of practical or real-world exploitation of this bug either, the after-effects of its publishing have been incredibly extensive. Numerous other vulnerabilities (including many further named/branded bugs) have been produced in the wake of Meltdown. Of course it also had its own logo and website ‘n such.
ProxyLogon (CVE-2021-26855 & CVE-2021-27065)
ProxyLogon has its own logo, website, maximum severity level, known exploitation—it was a bruiser for sure!
Honestly I’m not entirely sold on VENOM making the final cut for the Mt. Rushmore of Branded Bugs, but I wanted to pick a final four. Some other potential candidates include KRACK and GHOST. I think that fourth spot is still very much up for the taking. Who knows, maybe even Copy Fail could be considered—we’ll see how it plays out on the world stage in the coming weeks/months… What do you think it should be?
Honorable Mentions
Honorable mentions that don’t have a logo would have to include…