Zero-Day Vulnerabilities On the Market 94
Posted
by
CmdrTaco
from the not-as-good-as-my-negative-four-day dept.
from the not-as-good-as-my-negative-four-day dept.
An anonymous reader writes "Zero-day vulnerabilities have become prized possessions to attackers and defenders alike. As the recent China-Google attack demonstrated, they are the basis on which most of the successful attacks are crafted these days. There is an underground market growing around these vulnerabilities, but there are also 'white markets' — set up by VeriSign, TippingPoint, Google — where they buy zero-day flaws and alert the companies so that they can patch their products before the vulnerabilities can be taken advantage of."
Re:I'm surprised white markets aren't more common (Score:4, Informative)
I think it would be a grand strategy in Afghanistan -- build goodwill with farmers through buying their crop at prices better than the Taliban is offering, denying the Taliban a source of income through trafficking and probably having a significant supply reduction in the global heroin market.
This would probably cause a knock-on effect of increasing production in the area, due to the fact that you will be increasing the profits for the poppy growers, and perhaps also encouraging people to start poppy farming; selling to US troops is probably a hell of a lot less scary than selling to the Taliban.
Re:I'm surprised white markets aren't more common (Score:4, Informative)
Re:"Zero-day" is just noise (Score:4, Informative)
0-day means there is no patch available, as opposed to vulns that come out after patches are issued and you could possibly upgrade your system to being secure.
Anything that is patched, but you haven't bothered to update your system and are thus vulnerable to, isn't a 0-day.
Does it matter? (Score:3, Informative)
If you are the company who wrote the software, you now know where the flaw is and can fix it.
If you release a patch, that could be reverse engineered and the bad guys would find the flaw anyway.
Re:Does it matter? (Score:3, Informative)
> If you are the company who wrote the software, you now know where the flaw
> is and can fix it.
But if you are a black hat (or a government: same thing) you want exclusive ownership. Even if you are the company that wrote the software you don't want the exploit sold to black hats who will exploit it between now and the time you deploy your fix (or afterward against the many customers who won't upgrade).
Not a trend. (Score:2, Informative)
The vulnerability contributor program @ Verisign and TippingPoint were setup by the same person. I know this because that person used to work for me. Google is buying simply as a reaction to the China stuff. This isn't a trend...though on the surface, it appears that way.
Re:I'm surprised white markets aren't more common (Score:3, Informative)
Taliban suspected of stockpiling 12,000 tons of poppies [cnn.com]?
What passes for Insightful... (Score:3, Informative)
Uhm, no. What nut jobs like Mullah Omar say, and what they actually do, might overlap, but may not be entirely equivalent.