Slashdot Log In
Auction Site To Sell Security Vulnerabilities
Posted by
CowboyNeal
on Thu Jul 05, 2007 11:01 PM
from the safety-to-the-highest-bidder dept.
from the safety-to-the-highest-bidder dept.
talkinsecurity writes "A Swiss research lab has built an eBay-like marketplace where hackers and researchers can sell the security vulnerabilities they discover to the highest bidder. WabiSabiLabi could replace the back-room, secret sites where researchers and hackers used to sell their exploits and replace them with a neat, clean way to make money by finding security flaws. Those who have seen the site say they are concerned about how the buyers will be vetted, and how the marketplace will ensure the flaws aren't found through illegal methods."
Related Stories
[+]
Bill Gates Should Buy Your Buffer Overruns 196 comments
Slashdot regular Bennett Haselton has written in with his latest essay. He starts "WabiSabiLabi
generated
some
controversy
recently
by announcing their eBay-like site for security researchers to sell
security exploits to the
highest bidder.
But WabiSabiLabi didn't create the black-and-grey market
for security exploits, they merely helped draw attention to it.
There's nothing that companies like Microsoft can do about the black market
where security exploits
sell for tens of thousands of dollars, but there's one obvious thing they
can do to help protect
users: offer to buy up the security vulnerabilities themselves.
If they did that, then the exploits would probably never make it onto a
black-market auction in the first place,
because the "white hat" researchers would have found them and reported them
first.
Thus I think WabiSabiLabi is doing the world a favor,
by shining a spotlight on the black market that thrives when companies
won't pay for security bug reports." Click that magical little read more link below to continue the thought.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Bidding up (Score:2)
Re:Bidding up (Score:5, Insightful)
Parent
Re: (Score:2)
Re:"illegal methods" ? (Score:4, Informative)
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
Actually most EULA's prohibit this, thus making it illegal,
At best, breach of contract. Even if the EULA is valid, which many aren't. Plus you have to prove that the information was obtained through "illegal" means.
How do you preserve value? (Score:5, Interesting)
I wonder if the people putting this on are actually looking to make a point about software vendors and their products. Any chance that they are looking to do nothing more than score some legal victories for the good of the public?
Regards.
How would you know that it is only sold once? (Score:5, Insightful)
Parent
Re: (Score:2)
If I see the cross platform vulnerability I just bought again, I'm suing!
1. Login to your computer
2. Stand up
3. Put your foot through your monitor
4. PROFIT!
Re:How do you preserve value? (Score:5, Insightful)
Parent
Its simpl;e, really - and why it won't work (Score:5, Insightful)
It reminds me of the joke:
If its a real vulnerability, you can sell it over and over again. None of the buyers is going to leak it - they'd lose their investment, and chance to make $$$.
So, sell it once for $X, or sell it 20 times for $X/2?
This is just someone else with a lame attempt to insert themselves into a market.
Parent
Interesting vulnerabilites on the site (Score:2)
How can anyone exploit a memory leak?
Re:Interesting vulnerabilites on the site (Score:5, Informative)
If you're interested in these things, in my opinion, the best thing you can do is read a good operating system book - in my opinion you're best off with either Tanenbaum [amazon.com] or Silberschatz [amazon.com] - those books describe these problems in detail in terms of debugging your work, but in many cases, compromising a system is about leveraging unfixed bugs (enbugging, if you'll pardon the coining;) as such, a book meant to teach one to fix these is a great way to learn what needs to be protected against, as well as why.
Parent
easy (Score:2)
Next, place a pointer there.
Next, run the kernel out of memory.
Next, ask the kernel to do a getsockopt() call that needs memory. The kernel will get back a NULL. The kernel will keep going, eventually using the NULL pointer to get some critical data like a kernel pointer. (a data pointer in this case, but it could well be a function
sounds good to me (Score:5, Insightful)
I think a free market approach like this is good.
As for vetting buyers and sellers, I don't think that's either necessary or desirable. If people find security holes through "illegal means" (whatever that means), it's a matter for the police and courts. And if the mafia outbids Microsoft, well, then Microsoft will have to live with the consequences or pay more next time. Companies like Microsoft should be exposed to the true costs of their security vulnerabilities, and they will be exposed to that only if the "bad guys" are in on the bidding, because vulnerabilities aren't worth a lot to the other "good guys".
If prices and damages get high enough, companies will invest enough in software development to stop creating security vulnerabilities in the first place.
Re:sounds good to me (Score:5, Insightful)
I think a free market approach like this is good.
Oh yea, free market always works! Especially when the bidders in this case would actually gain financial benefit from said "goods" by illegal access to people's machines.
Software companies that produce products will be forced to "pay up" or let the vulnerability go to said parties above.
Other free markets that work just fine, and bidding works miracles in there:
* Human Organ Markets
* Internet domains
* Fire Weapons, Biological Weapons, Missiles
* Kidnapping journalists in Iraq for bounty
* De-regulated utility monopolies
* Open Market Health Insurances
The world is full of amazing examples where the best thing EVAH to do, was just sit there in awe and think "it's perfect"!
Parent
Now bidding (Score:5, Funny)
Flaw - You name it
Bid - 1 beeeeellllion dollars
Ripoff Central? (Score:3, Insightful)
While someone dumb enough to, say, screw over a Russian Mafiya buywer, I can see where there would be more than enough idiots out there who would happily try (and hiding behind eGold and proxies, etc for payments... it may even be feasible )
Not like there would be much in the way of honor among theives when it comes to a near-total-anonymous thing like malware and malware kiddies...
(besides, all one would really have to do to make a killing as a seller is to dredge through securityfocus' vulns DB... the smart crims would avoid bidding on it, and the dumb ones? Well...)
Exploit name, Outlook (Score:2)
Self Exploitation (Score:5, Funny)
Laws Are _Not_ Universal (Score:3, Insightful)
and how the marketplace will ensure the flaws aren't found through illegal methods.
"""
In which country?
Sell the same 0-day several times? (Score:3, Interesting)
Sounds good to me, but don't the buyers feel cheated? I can't see anything to stop this from happening, so it doesn't seem like much of an _auction_ to me.
Also, consequently, after you buy an exploit you could auction it off to a bunch of other people and potentially make all your money back and more.
I don't really see how the auction format can support non-tangible items, is all I'm saying.
I give it a month. (Score:3, Insightful)
-jcr
Wabisabi is a cool concept (Score:3, Informative)
Had this type of subject come up in class (Score:5, Interesting)
Question- what do you do if you come upon a security hole?
Answer- ?
Case in point, some grad student in physics accidentally came across a vulnerability in the engineering dept's site. He reported it to his adviser the same day. (Yes, it was all proven). Adviser told the engineering dept., they fixed it, high fives all around. About a year later, the psych dept. gets broken into with a quasi-semi like exploit. Who does the uni and cops go straight after as a suspect? Yup, the kid who turned in the engineering vulnerability. Eventually was cleared, but how great is it to be a "Good Samaritan"?
So now you are student who comes across a commercial exploit. Now what? Auction is off for some moohla, let the company know, sit tight? If you auction it off and don't get sued by the company, does the school have a right to kick you out due to "unethical behavior"? If you let the company know, what kind of exposure do you have then? Can they accuse of being a hacker? If something similar in the future happens, can they come back to you? If you're a fan (or fanboy) of the company and sit tight, and later it gets hit by the same exploit, how is your conscience?
Now ramp the whole thing up to be a person in the commercial field. Tell your boss, etc.?
Now ramp it up to government level. Tell.... ? (underpant gnomes- had to fit that in somewhere)
Now ramp it up to classified level. Wait... nah, you cool as long as you tell your boss so -they- can exploit it.
As an individual at home, you'll probably be fine as long as you don't use the exploit to your advantage, and if you report it to a security site or the company I would think you would be fine.
Personally, I wouldn't touch this site with a 6 foot pole.