Russian National Vulnerability Database Operation Raises Suspicions

Recorded Future says Russias Federal Service for Technical and Export Control has ability to find, weaponize vulnerabilities under cover of doing technology inspections.

The official mission of the organization in charge of maintaining Russias national vulnerability database gives it legitimate cover for inspecting foreign technologies and products for security vulnerabilities that can later be weaponized.
Thats according to Recorded Future, which Monday released a report summarizing its analysis of the vulnerability disclosure practices and mission of the Federal Service for Technical and Export Control of Russia (FSTEC), the military organization responsible for BDU, the nations official vulnerability database.
The
analysis
revealed that the FSTECs extensive list of responsibilities includes the authority to test and inspect proprietary products and services for issues that could pose a risk to state and critical infrastructure security. That mission is troubling, says Priscilla Moriuchi, director of strategic threat development at Recorded Future.
The primary threat to Western companies is from the technology licensing process, Moriuchi says. During these inspections the Russian military could discover and operationalize vulnerabilities in proprietary products or services, she says.
The threat from having to work with the FSTEC — and by extension the Russian military — is not to the companies directly or to their intellectual property. Rather, what is concerning is the derivative risk for computer users around the world.
Russia has demonstrated during at least two incidents in the past year a willingness to exploit western technologies, companies, and accesses in an attempt to obtain the information or communications of their customers, Moriuchi says.
The two incidents are the April
targeting
of network devices and the more recent attacks involving
VPNFilter
. The [national vulnerability] database provides a legitimate cover under which the Russian government can demand reviews of foreign technologies and products, she notes.
Recorded Future performed a
similar analysis
of Chinas vulnerability disclosure practices last November. The report concluded that Chinas Ministry of State Security likely influences security vulnerability disclosures in the country especially in the case of high-value security flaws that could be used for surveillance and other offensive purposes.
Russias FSTEC publishes only about 10% of the vulnerabilities it knows about and that too about 50 days after the data has been published in the U.S. and 83 days after it appears in Chinas NVD, according to Recorded Future.
A majority of the vulnerabilities in BDU are those that primarily present a threat to Russian state-owned information systems and automated systems for managing technical processes and production and critical infrastructure facilities. The data is publicly accessible and is designed for use by a wide range of people including security professionals, operators of critical infrastructure, and developers.
Unlike Chinas Ministry of State Security, which has a penchant for delaying or hiding data on vulnerabilities that the state can exploit for surveillance and other offensive purposes, Russias FSTC over-reports on vulnerabilities that have been exploited by Russian state-sponsored threat groups. Our analysis reveals that the BDU actually publishes 61% of vulnerabilities utilized by Russian military intelligence groups and does not seek to hide these vulnerabilities.
The number is noteworthy because it is significantly larger than the 10% of other vulnerabilities that the FSTC normally discloses. One reason could be to ensure that owners and operators of government and critical infrastructure systems are properly informed of the threats so they can protect against them.
The FSTEC started publishing vulnerability data only in 2014, about 15 years after the US started the practice. Somewhat unsurprisingly, the BDU contains data on just about 11,000 vulnerabilities compared to the 107,901 in the U.S. NVD — though that could also be the result of the FSTECs habit of occasionally lumping multiple vulnerabilities under a single identifier. Among the vulnerabilities the organization published fastest were those related to browsers and industrial control systems.
Recorded Futures analysis showed that the FSTEC reports on vulnerabilities in some technologies relatively extensively while it under-reports flaws in the case of some other technologies. For instance, the FSTEC discloses a substantially greater proportion of flaws in Adobe, Linux, Microsoft, and Apple than it does with flaws in content management systems and technologies from IBM and Huawei.
What is unclear, however, is why FSTEC is even publishing the data considering just how delayed, state-focused and sparse the data is, Recorded Future noted in its report. In fact, the vulnerability data in the BDU reveals more about Russias state information systems and the FSTECs mission itself than anything else, the vendor said.
Related Content:
Destructive VPNFilter Attack Network Uncovered
Russian APT Compromised Cisco Router in Energy Sector Attacks
Chinas Vulnerability Database Altered to Hide Govt. Influence
8 Nation-State Hacking Groups to Watch in 2018

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Russian National Vulnerability Database Operation Raises Suspicions