DEF CON 33 - VDP in Aviation How it shouldn't be done! - Matt Gaffney

Matt Gaffne's presentation reveals the challenging landscape of vulnerability disclosure in aviation, sharing real-world examples and practical guidance for improving collaboration between security researchers and aviation companies.

Key Takeaways:

• Vulnerability disclosure in aviation moves at a glacial pace, with fixes taking years rather than days due to stringent safety requirements and regulatory constraints
• Aviation companies often dismiss valid vulnerabilities (like Gaffne's EFB vulnerability initially called a "feature"), requiring extensive proof and regulatory involvement before addressing issues
• Effective vulnerability disclosure programs need to be more than just web pages—they must be actively monitored with clear communication channels
• Both researchers and companies should prioritize constant communication throughout the disclosure process
• Companies should avoid belittling researchers' concerns, forcing NDAs unnecessarily, or using disclosures as business opportunities
• Researchers should understand aviation's unique timeline constraints, be willing to enter restrictive agreements when necessary, and follow formal channels before escalating

The aviation industry must shift from relying on security by obscurity to establishing transparent vulnerability disclosure processes that recognize researchers as partners in enhancing safety rather than threats to be managed.