hi kragen this is an interesting analysis i think that there are a couple of nits i might pick for example i don t expect that the market will be well developed with highest bidders for while i think that the most important issue which is that end users won t be able to fix their systems is almost passed over i know that you know this and you allude to it but your essay is getting passed around so you might want to add to it bits about the sysadmin and others there s one other point which you don t make which i think is very important which is that research into defining and addressing classes of vulnerabilities can t happen without libraries of available vulnerability code i can think of three researchers into automated methods for addressing vulnerabilities who griped uninvited about the quality of the existing vulnerability sites doing research into a set requires that you have enough examples in the open that you can define a set and that the set is added to from time to time so you can make and test predictions i feel fairly confident in saying that without full disclosure we wouldn t have stackguard itsNUMBER nissus or snort and the security admin s job would be a lot harder adam on thu aug NUMBER NUMBER at NUMBER NUMBER NUMBERam NUMBER eugen leitl wrote eugen leitl a href URL leitl a ______________________________________________________________ icbmto nNUMBER NUMBER NUMBER NUMBER eNUMBER NUMBER NUMBER NUMBER URL NUMBEReNUMBERcaNUMBER edeNUMBER NUMBER NUMBER aNUMBERb NUMBERaNUMBER NUMBERaNUMBER aaNUMBER NUMBEReNUMBER NUMBEReNUMBER caNUMBER forwarded message date thu NUMBER aug NUMBER NUMBER NUMBER NUMBER NUMBER edt from kragen sitaker kragen pobox com to fork URL subject the underground software vulnerability marketplace and its hazards on august NUMBERth an entity known as idefense sent out an announcement which is appended to this email briefly idefense which bills itself as a global security intelligence company is offering cash for information about security vulnerabilities in computer software that are not publicly known especially if you promise not to tell anyone else if this kind of secret traffic is allowed to continue it will pose a very serious threat to our computer communications infrastructure at the moment the dominant paradigm for computer security research known as full disclosure people who discover security vulnerabilities in software tell the vendor about them and a short while later after the vendor has had a chance to fix the problem they publish the information including code to exploit the vulnerability if possible this method has proven far superior to the old paradigm established by cert in the late NUMBERs which its proponents might call responsible disclosure never release working exploit code and never release any information on the vulnerability before all vendors have released a patch this procedure often left hundreds of thousands of computers vulnerable to known bugs for months or years while the vendors worked on features and often even after the patches were released people wouldn t apply them because they didn t know how serious the problem was the underground computer criminal community would often discover and exploit these same holes for months or years while the responsible disclosure process kept their victims who had no connections in the underground vulnerable the problem with this is that vulnerabilities that are widely known are much less dangerous because their victims can take steps to reduce their potential impact including disabling software turning off vulnerable features filtering traffic in transit and detecting and responding to intrusions they are therefore much less useful to would be intruders also software companies usually see security vulnerabilities in their software as pr problems and so prefer to delay publication and the expense of fixing the bugs as long as possible idefense is offering a new alternative that appears far more dangerous than either of the two previous paradigms they want to be a buyer in a marketplace for secret software vulnerability information rewarding discoverers of vulnerabilities with cash not long before snosoft a group of security researchers evidently including some criminal elements apparently made an offer to sell the secrecy of some software vulnerability information to the software vendor specifically they apparently made a private offer to hewlett packard to keep a vulnerability in hp s truNUMBER unix secret if hp retained snosoft s consulting services hp considered this extortion and responded with legal threats and snosoft published the information if this is allowed to happen it will cause two problems which together add up to a catastrophe first secret software vulnerability information will be available to the highest bidder and to nobody else for reasons explained later i think the highest bidders will generally be organized crime syndicates although that will not be obvious to the sellers second finding software vulnerabilities and keeping them secret will become lucrative for many more talented people the result will be just as in the responsible disclosure days that the good guys will remain vulnerable for months and years while the majority of current vulnerabilities are kept secret i ve heard it argued that the highest bidders will generally be the vendors of the vulnerable software but i don t think that s plausible if someone can steal NUMBER NUMBER because a software bug lets them the software vendor is never held liable often in fact the people who administer the software aren t liable either when credit card data are stolen from an e commerce site for example knowing about a vulnerability before anyone else might save a web site administrator some time and it might save the software vendor some negative pr but it can net the thief thousands of dollars i think the highest bidders will be those for whom early vulnerability information is most lucrative the thieves who can use it to execute the largest heists without getting caught inevitably that means organized crime syndicates although the particular gangs who are good at networked theft may not yet exist there might be the occasional case where a market leader such as microsoft could make more money by giving their competitors bad pr than a gang could make by theft think of a remote root hole in samba for example right now people who know how to find security exploits are either motivated by personal interest in the subject motivated by the public interest motivated by a desire for individual recognition or personally know criminals that benefit from their exploits creating a marketplace in secret vulnerability information would vastly increase the availability of that information to the people who can afford to pay the most for it spies terrorists and organized crime let s not let that happen this is the original idefense announcement from sunil james mailto sjames URL sent wednesday august NUMBER NUMBER NUMBER NUMBER pm subject introducing idefense s vulnerability contributor program greetings idefense is pleased to announce the official launch of its vulnerability contributor program vcp the vcp pays contributors for the advance notification of vulnerabilities exploit code and malicious code idefense hopes you might consider contributing to the vcp the following provides answers to some basic questions about the program q how will it work a idefense understands the majority of security researchers do not publish security research for compensation rather it could be for any of a number of motivations including the following pure love of security research the desire to protect against harm to targeted networks the desire to urge vendors to fix their products the publicity that often accompanies disclosure the vcp is for those who want to have their research made public to the internet community but who would also like to be paid for doing the work the compensation will depend among other things on the following items the kind of information being shared i e vulnerability or exploit the amount of detail and analysis provided the potential severity level for the information shared the types of applications operating systems and other software and hardware potentially affected verification by idefense labs the level of exclusivity if any for data granted to idefense q who should contribute to the vcp a the vcp is open to any individual security research group or other entity q why are you launching this program a timeliness remains a key aspect in security intelligence contributions to some lists take time before publication to the public at large more often many of these services charge clients for access without paying the original contributor under the idefense program the contributor is compensated idefense labs verifies the issue and idefense clients and the public at large are warned in a timely manner q who gets the credit a the contributor is always credited for discovering the vulnerability or exploit information q when can i contribute the vcp is active you are welcome to begin contributing today to learn more go to URL if you have questions or would like to sign up as a contributor to the vcp please contact us at contributor URL regards sunil james technical analyst idefense idefense is a global security intelligence company that proactively monitors sources throughout the world from technical vulnerabilities and hacker profiling to the global spread of viruses and other malicious code the ialert security intelligence service provides decision makers frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber related threats idefense labs is the research wing that verifies vulnerabilities examines the behavior of exploits and other malicious code and discovers new software hardware weaknesses in a controlled lab environment URL it is seldom that liberty of any kind is lost all at once hume URL 