4 ms·

vupen: "Hey Google, your browser has a very nasty bug that allows for potentially horrible things to happen. We thought we'd share that with the world. If you'd

by rheide 15y ago

vupen: "Hey Google, your browser has a very nasty bug that allows for potentially horrible things to happen. We thought we'd share that with the world. If you'd like to know where it is though, you'd better give us money."

lawnchair_larry 15y ago
Why not? This is highly specialized research that not even well-paid Google employees were able to do. This is actually quite common in recent years for bug hunters and exploit developers. I can think of a dozen or so companies that do the same thing. Immunity is another example. Trying to use a moral argument to get out of compensating someone when you have the resources to do so is shameful. Sorry, but this stuff is worth far more than the (up to) $3133 they are offering. No More Free Bugs, as they say. They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally. Fair is fair. There is no reason this isn't worth compensating but something like pagerank optimizations is.
- blocke 15y ago
  "They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally." What makes you think they don't already? You make it sound like Google doesn't give a shit about security. That clearly isn't the case.
  - tptacek 15y ago
    Google employs several of the best well-known security researchers in the world, and no doubt many more that we haven't heard much about. That doesn't mean they're going to find everything, though. At the end of the day, private companies are perfectly within their rights to do offensive research against Google products, to be selective about how they disclose their results, and to tell the public whatever they want about those results. As long as they aren't lying, there's nothing unethical about it.
- leif 15y ago
  "Why not? This is highly specialized research that not even well-paid Google employees were able to do." Correction: not even well-paid Google employees did. They may yet be able, and an existence proof may be all the help they need to find and fix it. Don't give up hope yet.
  - sswam 15y ago
    I can fix it right now. Delete the flash player - problem solved. Chrome still works.
    - leif 15y ago
      Sadly, one aspect of security is psychological acceptability. If nobody will do the secure thing, it's not secure.
    - watty 15y ago
      I don't see how Flash can be the culprit or solution considering it is sandboxed. Chrome must contain a massive exploit.
      - leif 15y ago
        I thought the point was that they broke the sandboxing.
    - daeken 15y ago
      There's absolutely no evidence that this has anything to do with Flash. In fact, even if it was via Flash, there would still have to be another vulnerability to escape the Chrome sandbox, which could very likely be exploited via other means.
- mauriciob 15y ago
  I doubt Google will hire them. They seem to be a very unprofessional company, even with their skilled people. They may pay to know about this security breach, though.
- _delirium 15y ago
  Publicly announcing a security vulnerability, claiming that you're sharing it with other clients with the intent of using it for "weaponized ... offensive missions", and then demanding a fee to gain the information to protect against said weaponization, sounds an awful lot like extortion. In the offline world, I don't think you can legally run a business with a strategy of: discover a problem in the security at one of Exxon's plants, publicly announce that you've discovered a vulnerability and will be selling the information to third parties, and then demand $N from Exxon for the details.
  - shasta 15y ago
    This is probably why they keep repeating that their customer is the government. You could probably sell Exxon's security vulnerabilities to the government and demand $N dollars from them to show them how to fix the problem. It's advertising the vulnerability with posts like this that seems most questionable (similar to extortion) to me.
    - _delirium 15y ago
      Yeah, that's the part that seemed odd to me as well, though someone knowledgeable in this area of law (at least in the better-settled offline case) could give some better info. I believe it'd be okay, and probably actually happens, for a private security consultant to do threat assessments for a (non-criminal) client, e.g. prepare a report for DHS on the security of U.S. oil installations. But it seems like they'd be crossing a line if they posted a press release trumpeting a major vulnerability they discovered, mentioning by name which company and approximately where the vulnerability was located, but then refused to disclose it to the company in question. I'm not sure how much it survives, but I believe there was traditionally even a common-law "duty to warn" if you were aware of significant risks to someone's person or property.
      - chopsueyar 15y ago
        Google could easily sue them into oblivion for libel. They would be forced to reveal the exploit during proceedings to prove their innocence.
trotsky 15y ago
The "no more free bugs" campaign has gained a fair amount of support: http://trailofbits.com/2009/03/22/no-more-free-bugs/ http://trailofbits.com/2009/03/22/no-more-free-bugs/
code_duck 15y ago
I'm tired of doing volunteer work for corporations, personally.
- nitrogen 15y ago
  Don't think of it as volunteer work -- think of it as a non-financial exchange of value. You provide beta testing in exchange for significantly more affordable software and/or earlier access. If you want rock solid reliability, there are companies and operating systems that provide it, with the price tag and turnaround time to match.
  - code_duck 15y ago
    I'm not talking about open source or beta programs. What is VUPEN getting out of giving the fruits of their research to Google for free? They would receive neither more affordable software nor earlier access. The 100% unhackable browser and OS... how much does it cost? I think the turnaround time is going to be infinite. I'm not sure what you're saying. These companies have employees, who have a nice situation with a financial exchange of value. Let them do their own work. If I'm going to do something their employees should be doing, they're free to hire me or pay me as a consultant.
- deleted 15y ago
  [deleted]
orblivion 15y ago
I think you'd be biting off the hand that feeds you. If you eliminate what is arguably a distasteful arrangement here, you also eliminate the incentive to continue doing it. You might get this bug for free, but you get a hidden loss, a bunch of future bugs that you'll never hear about. Think about the audacity of farmers, who make a profit for food, which you need to live. But nobody thinks like that for some reason. Earning profit just means you've done something for someone who really wanted it done. It's a necessary signal.
- syllogism 15y ago
  I felt the same way until this comment below: > http://www.vupen.com/english/services/ http://www.vupen.com/english/services/ > As the world leader in vulnerability research, VUPEN Security provides weaponized and highly sophisticated exploits specifically designed for Law Enforcement and Intelligence Agencies to help them achieve their offensive missions using tailored and unique codes created in-house by VUPEN for vulnerabilities discovered by our researchers. Note also the "under contract with VUPEN" part of the disclosure bit.

by rheide 15y ago

lawnchair_larry 15y ago

Why not? This is highly specialized research that not even well-paid Google employees were able to do. This is actually quite common in recent years for bug hunters and exploit developers. I can think of a dozen or so companies that do the same thing. Immunity is another example. Trying to use a moral argument to get out of compensating someone when you have the resources to do so is shameful. Sorry, but this stuff is worth far more than the (up to) $3133 they are offering. No More Free Bugs, as they say. They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally. Fair is fair. There is no reason this isn't worth compensating but something like pagerank optimizations is.

blocke 15y ago
"They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally." What makes you think they don't already? You make it sound like Google doesn't give a shit about security. That clearly isn't the case.
- tptacek 15y ago
  Google employs several of the best well-known security researchers in the world, and no doubt many more that we haven't heard much about. That doesn't mean they're going to find everything, though. At the end of the day, private companies are perfectly within their rights to do offensive research against Google products, to be selective about how they disclose their results, and to tell the public whatever they want about those results. As long as they aren't lying, there's nothing unethical about it.
leif 15y ago
"Why not? This is highly specialized research that not even well-paid Google employees were able to do." Correction: not even well-paid Google employees did. They may yet be able, and an existence proof may be all the help they need to find and fix it. Don't give up hope yet.
- sswam 15y ago
  I can fix it right now. Delete the flash player - problem solved. Chrome still works.
  - leif 15y ago
    Sadly, one aspect of security is psychological acceptability. If nobody will do the secure thing, it's not secure.
  - watty 15y ago
    I don't see how Flash can be the culprit or solution considering it is sandboxed. Chrome must contain a massive exploit.
    - leif 15y ago
      I thought the point was that they broke the sandboxing.
  - daeken 15y ago
    There's absolutely no evidence that this has anything to do with Flash. In fact, even if it was via Flash, there would still have to be another vulnerability to escape the Chrome sandbox, which could very likely be exploited via other means.
mauriciob 15y ago
I doubt Google will hire them. They seem to be a very unprofessional company, even with their skilled people. They may pay to know about this security breach, though.
_delirium 15y ago
Publicly announcing a security vulnerability, claiming that you're sharing it with other clients with the intent of using it for "weaponized ... offensive missions", and then demanding a fee to gain the information to protect against said weaponization, sounds an awful lot like extortion. In the offline world, I don't think you can legally run a business with a strategy of: discover a problem in the security at one of Exxon's plants, publicly announce that you've discovered a vulnerability and will be selling the information to third parties, and then demand $N from Exxon for the details.
- shasta 15y ago
  This is probably why they keep repeating that their customer is the government. You could probably sell Exxon's security vulnerabilities to the government and demand $N dollars from them to show them how to fix the problem. It's advertising the vulnerability with posts like this that seems most questionable (similar to extortion) to me.
  - _delirium 15y ago
    Yeah, that's the part that seemed odd to me as well, though someone knowledgeable in this area of law (at least in the better-settled offline case) could give some better info. I believe it'd be okay, and probably actually happens, for a private security consultant to do threat assessments for a (non-criminal) client, e.g. prepare a report for DHS on the security of U.S. oil installations. But it seems like they'd be crossing a line if they posted a press release trumpeting a major vulnerability they discovered, mentioning by name which company and approximately where the vulnerability was located, but then refused to disclose it to the company in question. I'm not sure how much it survives, but I believe there was traditionally even a common-law "duty to warn" if you were aware of significant risks to someone's person or property.
    - chopsueyar 15y ago
      Google could easily sue them into oblivion for libel. They would be forced to reveal the exploit during proceedings to prove their innocence.

trotsky 15y ago

The "no more free bugs" campaign has gained a fair amount of support: http://trailofbits.com/2009/03/22/no-more-free-bugs/ http://trailofbits.com/2009/03/22/no-more-free-bugs/

code_duck 15y ago

I'm tired of doing volunteer work for corporations, personally.

nitrogen 15y ago
Don't think of it as volunteer work -- think of it as a non-financial exchange of value. You provide beta testing in exchange for significantly more affordable software and/or earlier access. If you want rock solid reliability, there are companies and operating systems that provide it, with the price tag and turnaround time to match.
- code_duck 15y ago
  I'm not talking about open source or beta programs. What is VUPEN getting out of giving the fruits of their research to Google for free? They would receive neither more affordable software nor earlier access. The 100% unhackable browser and OS... how much does it cost? I think the turnaround time is going to be infinite. I'm not sure what you're saying. These companies have employees, who have a nice situation with a financial exchange of value. Let them do their own work. If I'm going to do something their employees should be doing, they're free to hire me or pay me as a consultant.
deleted 15y ago
[deleted]

orblivion 15y ago

I think you'd be biting off the hand that feeds you. If you eliminate what is arguably a distasteful arrangement here, you also eliminate the incentive to continue doing it. You might get this bug for free, but you get a hidden loss, a bunch of future bugs that you'll never hear about. Think about the audacity of farmers, who make a profit for food, which you need to live. But nobody thinks like that for some reason. Earning profit just means you've done something for someone who really wanted it done. It's a necessary signal.

syllogism 15y ago
I felt the same way until this comment below: > http://www.vupen.com/english/services/ http://www.vupen.com/english/services/ > As the world leader in vulnerability research, VUPEN Security provides weaponized and highly sophisticated exploits specifically designed for Law Enforcement and Intelligence Agencies to help them achieve their offensive missions using tailored and unique codes created in-house by VUPEN for vulnerabilities discovered by our researchers. Note also the "under contract with VUPEN" part of the disclosure bit.