Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Security Research and Blackmail

Posted by kdawson on Sun Feb 10, 2008 10:36 PM
from the pay-to-play dept.
harryjohnston alerts us to a story picked up by a few bloggers in the security space. A Russian security research company, Gleg, has discovered a zero-day in the latest version of RealPlayer 11. But they won't reveal details to Real, or to CERT, despite repeated requests. Details are available only to their clients who pay a lot of money for early access to such knowledge. To describe Gleg's business model Daniweb rather cautiously puts forward the word "blackmail." The story was first exposed in Ryan Nariane's Securitywach blog.
+ -
story

Related Stories

This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • by thebear05 (916315) on Sunday February 10 2008, @10:38PM (#22375680)
    Seems fair they have information and want to be paid for it
    • Re: (Score:3, Insightful)

      If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee?

      I'm sure that you'd easily come up with a lot of reasons why it isn't cool.

      On certain superficial moral levels, sure - proprietary closed-source shops would have it coming in a fashion. They make money from hidden information, so hiding information from them until a fee is paid sounds a bit like karma.

      OTOH, that's not how we're supposed to work as a community, for one simple reason:

      • by clarkkent09 (1104833) on Monday February 11 2008, @12:15AM (#22376228)
        If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee? I'm sure that you'd easily come up with a lot of reasons why it isn't cool.

        Honestly, I couldn't. I am sure there are security experts out there who would be able to improve security of my house but I certainly wouldn't expect them to do it for free. This idea that if you find bugs in a software product, you have the responsibility to give that information to the company that makes it, and therefore help them improve their product, for free is completely bogus.

        Sorry, but there's a distinct lack of responsibility and ethics going on here, no matter how much you think the primary target may deserve it.

        I don't see any ethical problems here and its completely irrelevant who the party involved is. I would actually argue that there is more of an ethical problem with testing a company's product for free, as it devalues the work of their own QA personnel, and it encourages companies to release shoddy products too early, with expectation that paying customers will help them fix the bugs.
      • by forgotten_my_nick (802929) on Monday February 11 2008, @12:57AM (#22376478)
        "If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee?"

        That in itself is a fair point. I mean what if you are working in the security industry and are trying to secure someones business. You certainly aren't going to do it for free.

        The issue here is more like after the home owner saying they don't have the money or can't pay that you sell the information to whoever wants it. That I am pretty sure is illegal.
        • Re: (Score:3, Insightful)

          How does your argument differ from the profession of a lock smith? They know how to get in your house, and you can pay them to get you into your house.

          Great analagy! Lets work with that.

          Can you pay a locksmith to open someone elses house for you? Can you pay him to show you how so you can do it yourself?

          Of course not.

          But it goes further than that... locksmiths are both Licensed, and Bonded in most civilised countries to help prevent exactly these sorts of activities, as well as any other sort of unethical a
        • by timeOday (582209) on Sunday February 10 2008, @11:48PM (#22376086)

          How does your argument differ from the profession of a lock smith? They know how to get in your house, and you can pay them to get you into your house.
          Go ahead and advertise a "locksmith" service to open the doors on anybody's home, without the owner's consent, for a fee. Then have fun in jail.

          Here's a better analogy for a legal activity: auto makers who sell SUVs to whomever wants them, then tell the rest of us we need one to keep our families safe in the event of being hit by one. It's a classic arms race, the only real winner is the arms dealer.

            • Re: (Score:3, Insightful)

              Because if they don't, your kid can starve or freeze to death or get cooked in the summer. Babies have died in cars. And letting people off "because they can't pay" is complex and leads to scams and paranoia and all kinds of weird legal confusion so it's easier to just say "Screw this, don't worry about the money" and refuse to take payment at all. I guess some people just find it hard to put a price on someone's life, at least a price on a few dollars of gas and 20 minutes of work time against someone's
                • Re: (Score:3, Informative)

                  See rock meet glass. See glass break. Break glass break !

                  Have you eve tried to break a modern car window?
                  I have, and:
                  1) it's not easy. It takes a LOT of force to crack the window.
                  2) You get little pieces of glass with shard edges EVERYWHERE. They're not long jagged pieces like you would get from a non-laminated glass, but they can still cut you up pretty well.

                  It is possible with the right kind of tools (heavy blow, small area) to crack the window without blasting pieces everywhere, but with a simple rock, that result is not likely.

                  Shattering a window with a sm

                  • Re: (Score:3, Informative)

                    You did it wrong.

                    Improvised side-auto glass breaking 101:
                    1.) Get an antenna from your car or the nearest one. Break it off.
                    2.) Make it into a U - hold both free ends in your one hand.
                    3.) Place this hand just outside the one corner of the window (your hand on the body of the car) with the rest of your "u" going across the window at an angle. Try to get the tip to hit in the bottom right or left corner of the window, about an inch or 2 from the edge.
                    4.) Pull the tip back with your other hand. Let go.
          • by somersault (912633) on Monday February 11 2008, @06:05AM (#22377640) Homepage Journal
            Your analogy is slightly off. Even from just reading the summary you can see that this is like a locksmith with a list of criminals who subscribe to his mailing list. The locksmith works out the vulnerabilities in your security (most houses are pathetically insecure via lockpicking anyway, if you really want into a house it's not gonna be hard to get in), then lets these criminals know them, but refuses to let you yourself know what the vulnerability is. He doesn't demand payment from you - he refuses to give you the information for any price, because you almost certainly won't pay as much as all his other clients. Because you have millions of houses, with millions of [currency]s worth of currency.

            For some reason when I first read the summary I was thinking of this company's clients as benign, but a second reading made me rethink :P
            • I think you've hit the nail on the head.

              If the company knows of an exploit and wants to sell the information about it to the vendor that's perfectly fine as long as they aren't threatening to tell others about it.

              It's much list noticing my neighbor has an open wifi point advertising his file shares. Nothing wrong with offering to show them exactly what the problem is for a fee. If he doesn't want to pay for my expertise -- well, I told him his wifi point is leaving him open to hackers, so he has been warned. Now if I say I'm going to sell the information to others if he doesn't pay me -- that's extortion.

              I couldn't tell with certainty from the article whether or not the firm is showing the actual exploit to their subscribers or not. They may just be informing their clients of the existence of the exploit and giving guidelines about the severity and potential impact to business operations. If that's all they're doing, I'd say they are playing to win, but playing by the rules.

              On the other hand, if they sold the actual exploit to their subscribers then they're criminals.
                • Re: (Score:3, Insightful)

                  Suppose I run a company that does security work for my clients. One of the things I do for them is run a battery of tests to see if I can break their security via any of their installed software. It seems to me that you are arguing that if I find something I have a moral obligation to inform not just my clients, but the vendor of the software.

                  Well, that's an interesting argument. I'm not sure I agree, but I'm not sure I disagree either.

                  On one hand, making sure the vulnerability is explained in detail to
  • Blackmail eh? (Score:4, Insightful)

    by QuantumG (50515) <qg@biodome.org> on Sunday February 10 2008, @10:38PM (#22375682) Homepage Journal
    How about just "proprietary knowledge".. ya know, like the source code of Real Player?

  • it's tough (Score:3, Interesting)

    by rastoboy29 (807168) * on Sunday February 10 2008, @10:42PM (#22375702) Homepage
    If you're not actually shaking down the vendor, it's not blackmail.  I mean, if you get a piece of information, are you obligated to inform anyone?

    It is sleazy, don't get me wrong, because what other reason would someone other than Real want to purchase the information except to do no good?  But I'm having a hard time feeling sorry for Real, because they suck so fucking bad.  I keep trying to replace them in my mind with some company I like to analyze the situation, but it just keeps switching back to Real.

    I mean, it's not like someone's going to get killed or anything.  Unless, of course, Putin wants that done.
    • Re: (Score:2, Informative)

      But it does come close to racketeering.
      • Mod parent up!

        To elaborate, Evgeny is threatening damage to Real (by this exploit) unless they pay up a sizable sum of money to purchase the exploit (whether or not he'd sell it to Real is another matter, although Real could always pose as a client and then purchase it).

        I know Real has got a pretty scummy reputation, but that's no excuse to condone this behavior.
        • How exactly are they threatening damage?

              • It's one thing for RealMedia to cause damage (release a product with a security flaw in it). It is another thing to actively exacerbate this damage (release an exploit to the blackhat community for large sums of money, and refuse to tell the vendor what the exploit is).
        • I don't see it that way. In my view, they're not "threatening damage" but promising results. They're essentially saying "Hey Real, if you hire us to do a security audit, we can guarantee we will find at least one serious vulnerability, and your money will have been well spent." It's a bit disingenuous to phrase it this way, but it essentially boils down to the same thing.

          Think of it as "we guarantee value for your money" rather than "give us money or we guarantee you'll wish you had," which, if you consi
    • It is sleazy, don't get me wrong, because what other reason would someone other than Real want to purchase the information except to do no good?

      Well, there are malware blocking programs that deal with plugging holes in other programs. Windows, and the various VB running Office programs are one source of bugs. I could see an antimalware company advertising itself as fixing holes in Real/Flash/Other malformed content.

  • Indeed, for individuals, pointing out security problems can be dangerous. It isn't very nice of them, but then again, most software vendors aren't nice either. Calling this blackmail is a bit of a stretch.
  • by enos (627034) on Sunday February 10 2008, @10:48PM (#22375750)
    It's called capitalism, and it's been breaking out in eastern Europe ever since the USSR fell. In unregulated areas (i.e. new markets) they have a much more "pure" concept of it than the west. The public good is a socialist idea. This same thing happens in a lot of places in the west where there are shops that specialize in IP of some sort. They have to make their living somehow. It's just that people are used to security companies giving this stuff away for free.
    • Re: (Score:3, Interesting)

      Way to completely sidestep the word 'ethics' there...

      "In unregulated areas (i.e. new markets) they have a much more "rapacious" concept of it than the west. The public good is an inconvenient idea."

      FTFY
    • by skribe (26534) on Monday February 11 2008, @01:19AM (#22376566) Homepage
      How long before Real change their EULA demanding that licensees reveal any exploits to them within 24 hours of discovery?
  • I don't call it blackmail, I call it a free market...

    Companies have a financial incentive for keeping their products secure, open source projects have less of an issue because the money just isn't in it.
    All this is - is one company spending real money, hiring well paid analysis to plow through machine code or source code and analyse vulnerabilities.
    The reason they can afford to do this is because the market is full of companies willing to pay for this stuff...

    Thats where your code of ethics goes out of the window!

    With open-source projects, there is still a market of companies using that software but at the same time there's a limited timespan before it's usually discovered by somebody else.
    You know very well that if you advertise you've found a security flaw in open source XX product you're going to have hundereds of people scrutinising it and to develop a fix - because it's benificial to everybody (so the code of ethics lives strong).

    It doesn't help that `Real' has a bad reputation, but by doing this and with holding it, Gleg are doing exactly what they set out to do in the first place and doing as any successful business man/woman does: identifying the market and targeting it appropriately.

    This happens every day not just in software security, but in every other industry yet people just consider it a normal day in the office and maybe grumble a bit about it.

    In an ideal situation ethics and social benifit would come first though... yet this is in practice incompatible with the free market, just for the reasons above.
  • Blackmail? (Score:5, Insightful)

    by clarkkent09 (1104833) on Sunday February 10 2008, @10:54PM (#22375786)
    If this is valuable information (as in there are people willing to pay money for it) why should they give it for free? Companies pay good money to consultants to come over and fix problems with their business, why shouldn't they have to pay people who help them fix problems with their software products.
    • Re: (Score:3, Insightful)

      Yeah, screw Real and the others. They create closed source software, how can they expect to get free security consultancy? If this company is spending their resources on finding methods to secure third party insecure software then they have all the right to sell such information. If people at Real want to know about these problems they should 1. Spend their money getting good security consultancy or 2. open source the programs and then maybe people will submit patches for free.

      Just imagine if Microsoft was
      • Re:Blackmail? (Score:4, Insightful)

        by dissy (172727) on Monday February 11 2008, @03:22AM (#22377034)

        It's one thing to inform the vendor that a flaw exists and demanding money for the details of the flaw. It's a whole different thing in my book to sell the details to _anybody_ else than the vendor.
        Indeed. Unfortunatly in the USA, by law if you inform the vendor of the problem, and so much as ask for payment, it falls enough into the legal definition of blackmail to get you in trouble if they push the issue. And you never know if they will push it to court, or thank you for your trouble.
        If I was running a large company with lots of finantual backing, and thought I was in the right (or to be more specific, if my legal team thought i was in the right) then I would definatly go to court to fight it.
        However being an individual, there is no way in hell I would willingly expose myself to that type of risk.

        Selling to everyone else however can't possibly be blackmail, since they can just say no and nothing bad happens to them. It doesn't match either the legal or english definition of the word.

        It's very smart from a legal point of view. Offer your services and 'IP' to everyone that you know wont sue you for it, and avoid the one person/company that could.

        If the laws were different and more sane, then they COULD sell to everyone including the vendor, or perhaps it would be at a price where they can afford to sell to ONLY the vendor.
        Sadly, they arnt.

        Capitalists gotta eat after all!
  • Vista (Score:3, Interesting)

    by Joe U (443617) on Sunday February 10 2008, @10:59PM (#22375828) Homepage Journal
    So, I have one question, does UAC actually help trap exploits like this?

    Not that I would ever install Realplayer outside of a locked down VM anyway. Assume I had a seizure or something and wanted to put this on my host OS.
  • It's not like these guys are really putting anyone in a bind. Real Networks has a responsibility to inspect and maintain their own product, and since they have the source code, there's nothing preventing from doing so. And people who are uninterested in paying them umpteen bazillion dollars for their expertise are welcome to take my advice, given for free:

    Uninstall RealPlayer.
  • When companies ship software with security holes, it's a product defect. If they don't want to be embarrassed by that in public, they should simply not introduce security holes.
  • by AB3A (192265) on Sunday February 10 2008, @11:10PM (#22375894) Homepage Journal
    I have this lovely demonstration, but you have to pay me to show you how it works. How do we know it is a real hack? How do we know it isn't a shake down?

    This is a shade of Fermat's last theorem. Wiles, after he finally proved it, said that he doubted Fermat actually knew a viable proof.

    We don't know what these guys have. Whether it's blackmail or not, it still smells bad. I think the money would be better spent on real security researchers who disclose what they find.
  • by SamP2 (1097897) on Sunday February 10 2008, @11:48PM (#22376088)
    According to Russian copyright law [wikipedia.org], "purely informational reports on events and facts are not copyrightable". The copyright on the code itself belongs to RP (and copyright to all other flaws discovered by this Russian company belong to their respective owners), and the simple informational fact of knowledge about flaw is not subject to copyright.

    RP can legally subscribe to be a "customer" of this security firm, and then just take all information they deliver, and pass it on to all parties involved (in other words, send flaws to all companies whose code has a vulnerability the relevant information). Several companies can team up and split the "subscription fee".

    Consider this to be the security (and legal) version of ripping a pay porn site and dumping the contents on eMule. The Russian company won't go far with a single paying subscriber.
  • by EEPROMS (889169) on Monday February 11 2008, @12:04AM (#22376174)
    If you sell software under a restricted proprietary license you have set the rules for all dealings with with your code as being based purely on monetary gain. So if some programmers figure out a security flaw with your software they like you "don't have to give away their code or IP for nothing" because you also insist on not give away your IP either.
  • by s_p_oneil (795792) on Monday February 11 2008, @12:52AM (#22376448) Homepage
    Does anyone use RealPlayer? I mean, it's worse than QuickTime (and I HATE QuickTime).
  • Nothing's free... (Score:5, Interesting)

    by Quixote (154172) * on Monday February 11 2008, @12:58AM (#22376484) Homepage Journal
    If a pharmaceutical company comes up with a cure for (say) AIDS, should they be forced to give it out to the rest of the world for free? I mean, lives are at stake there, and presumably lives are more valuable than Junior's ability to play the latest Brittney hits.

    If the prevailing logic (that the Russian company should cough up the goods for free) is applied, all pharma companies would be non-profit charities...

  • Why not compromise (Score:3, Informative)

    by martinlp (904606) <martin@NOsPAM.systemadmin.co.za> on Monday February 11 2008, @01:41AM (#22376670)
    This is exactly what the Tippingpoint zero day initiative [zerodayinitiative.com] is for. To give credit and a bit money to researchers who spend time and effort to discover vulnerabilities in software.
    Sure these researches should get money/credit, but what if they become greedy or irresponsible?
  • by Jane Q. Public (1010737) on Monday February 11 2008, @03:48AM (#22377132)
    Hmmmm...

    I am in the lawn care business. I know why your lawn is dying. I will make it green, for a fee.

    I am in the computer tech business. I know why your sound card has a problem. I will fix it... for a fee.

    I am in the computer tech business. I know how to fix the virus(es) in your computer. For a fee.

    I am a chef. I know how to cook your dinner. Do you expect the recipe for free?

    And so on. It would be "giving to the community" to give them the information for free, but this kind of business model *IS* all around us. No point in singling them out.
  • by flyingfsck (986395) on Monday February 11 2008, @05:01AM (#22377360)
    Real has the source code. They don't need to pay anybody else to find the bug, they can do their own code review.
  • by mapkinase (958129) on Monday February 11 2008, @08:36AM (#22378372) Homepage Journal
    Seems like not a bad price for a company whose software runs in millions and millions of copies around the world.

    If we assume that $10,000 is for a year: that is the cost of one tenth of a full time internally hired security expert.

    I think Real should consider subscribing to the services of Gleg.
  • How else are they... (Score:3, Interesting)

    by fozzmeister (160968) on Monday February 11 2008, @10:18AM (#22379342)
    How else are they going to get paid? They did work, Real expect them to donate their work for free. I don't see it as unreasonable to ask for payment, whether Real think the price is too high is a matter for them (and their customers?)
    • I think you're missing the point...

      What if this article concerned 'VLC' and 'daresay others' ?
        • true... but there are x patent violations in 'Linux' if you believe Microsoft... and yet nobody has found any of them and Microsoft is staying hush, is this not the same thing?
    • Re:But... (Score:5, Informative)

      by techno-vampire (666512) on Monday February 11 2008, @12:21AM (#22376264) Homepage
      But who does use RealPlayer anyway, that this could possibly affect?


      All the Aunt Tillies out there who use Windows because it came installed on their computers and have no idea what an operating system is. They use IE for the same reason, and when they want to hear an audio file, guess what IE tells them to install? One hint: it won't be VLC.

    • Re:I for one ... (Score:5, Insightful)

      by mysidia (191772) on Sunday February 10 2008, @10:59PM (#22375824)

      Not blackmail. But poorly designed software tends to have security bugs.

      These bugs pose a problem for users of the software. It makes sense that third party services exist that scour software for bugs like this, for the benefit of the software's users and prospective users.

      So they can know whether to use the software or whether to take extra precautions/refrain from using it.

      The cost of performing this type of analysis is high. Much time and energy is required.

      It makes sense that you need to pay to review their findings in detail, or to review them before they are publicly released (for free).

      If they merely submit their findings to the software vendor, then they have provided the vendor with high-quality, costly labor for free.

      Why should the software vendor get free labor from security researchers, and be able to freely follow poor design practices in the design of their software, while relying on the public to find and report the issues gradually? (For them to lazily fix _after_ the defect is drawn to their attention)

      If the security researcher wishes to serve the community, then they have the option of practicing full disclosure, but they may be more fairly compensated for their work by providing paying customers with key information in advance, so their customers can mitigate the problem, before it has become public (and known to the bad guys).

      One way you mitigate the problem is very simple: uninstall the defective real player 11. Re-install the fixed version, when it becomes available.

      • Re:I for one ... (Score:5, Interesting)

        by cdrguru (88047) on Sunday February 10 2008, @11:31PM (#22376006) Homepage
        Yes, but you have missed the key point.

        There are three classes of potential customers: product owners, users, and criminals. If the researcher makes it clear they are willing to sell their information to the third class - criminals - then it matters little if they are also willing to sell to the other two classes or not.

        Clearly, the implication is they do not want to sell to the product owner class as that would be a single sale. By selling the information to users and criminals they ensure that they have a substantial number of potential sales as well as motivating the users to buy rapidly or else they will be victims of the criminal class.
        • Re: (Score:3, Informative)

          Plenty of pen testers use 0day when evaluating companies. The theory is that busting a single machine on the corporate network should not give you the "keys to the kingdom". Properly implemented security architecture should be able to mitigate single point failures. Immunity and core (American companies) both buy and sell 0day without informing the vendor. Wabisabilabi has a very convenient marketplace for such transactions as well. It's all supply and demand. Sure it's sketchy, but aren't you glad th