5 ms·

> Note the language: finding the vulnerability. You're probably referring to http://www.schneier.com/crypto-gram-0108.html#1 http://www.schneier.com/crypto-gra

> Note the language: finding the vulnerability. You're probably referring to http://www.schneier.com/crypto-gram-0108.html#1 http://www.schneier.com/crypto-gram-0108.html#1 where Schneier criticizes eEye for publishing (not finding) a vulnerability with potential for a large-scale worm outbreak while selling a product that protects against that vulnerability. The blame is for leaving everyone but their own customers out in the cold, not for finding the vulnerability. The blame for the flaw gets directed to MS, where it deserves. This quote from The Register sheds some light on this: > eEye makes several good security products for Windows and IIS, and has been responsible for finding and aggressively publicizing a number of holes in Microsoft products, especially IIS. > But the business of searching for and publicizing security holes while at the same time selling the solutions is a tricky and controversial business, not unlike the model pursued by anti-virus companies. We note, for example, that eEye has yet to publicize an IIS hole that its SecureIIS product won't defeat. Their discoveries inevitably support the claim that SecureIIS is a very wise investment. (from http://www.theregister.co.uk/2001/07/20/internet_survives_code_red/ http://www.theregister.co.uk/2001/07/20/internet_survives_co...) IMHO the chide is well deserved. They could have handled that better.

tptacek 14y ago
eEye discovered MS01-033 (the flaw later used by Code Red) and was thanked by Microsoft in their advisory for it. Schneier, in the very post we're responding to here, claims to stick up for publishing vulnerabilities; it was "the only way" to handle them. But of course, Schneier didn't come to his current opinion easily; no, he detoured through a prolonged period of using his status in the industry to slander companies who handled the vulnerabilities they found with their own labor in ways he disapproved of. The Register piece you cited doesn't even make logical sense. "Oh ho!", it trumpets. "I see eEye has yet to release a bug their own product doesn't defend against! Surely, if they were ethical, they would cripple their own product to give competing products a fighting chance!" People who don't practice vulnerability research have a very had habit of incorrectly attributing vulnerabilities. Vulnerability researchers don't create them.
- btilly 14y ago
  People who don't practice vulnerability research have a very had habit of incorrectly attributing vulnerabilities. Vulnerability researchers don't create them. Historically true, but will it remain so? Schneier's point is that the existence of vulnerability markets means that there are incentives for there to be "vulnerability researchers" who are selling the bugs that they themselves created. It is the security version of, "I'm gonna code me up a minivan!"
  - tptacek 14y ago
    The Venn diagram of vulnerability researchers and product developers has only a sliver of overlap. Most researchers are not professional developers. No vulnerability that anyone knows about has ever been attributed to product sabotage. If there exists an incentive to sabotage products on behalf of governments or organized crime, that incentive exists with or without formal vulnerability markets. Markets allow vendors to participate and discover vulnerabilities. They are in that sense a uniquely bad setting for internal saboteurs to sell access to code; there is a non-negligible chance that the organization who ends up with your work will be able to "git blame" you. I'm not a supporter of vulnerability markets, but this strikes me as a particularly dumb argument against them.
    - btilly 14y ago
      Chicken, meet egg. Egg meet chicken. Historically economic incentives did not encourage the selling of vulnerabilities that you created. And we have no demonstrated history of the creation of vulnerabilities for sale. Not surprising with the lack of incentives, and not evidence that it won't happen in the future. But disgruntled IT people do all sorts of remarkable stuff. Take the case of Terry Childs, who locked everyone else out of San Francisco's network. Or a friend of a friend of mine who took out his frustration at a previous company by translating a chunk of their code to Latin and then implementing his project in Latin. (Yes, there is a Perl module that lets you program in Latin. No, this is not recommended in production code...) There are a lot of IT people. And some do stupid things. Or interesting things. For instance there is a persistent rumor that http://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html http://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html was not hypothetical, and that Thompson was actually observed using it in the wild. Really cool security hole. (And good luck doing a "git blame" for a bug that appears nowhere in your source code.) But you're right that it is not the best argument against vulnerability markets. Given the quality of most company's code bases, there is no need to add security holes. It is easy and much safer to find the ones that are already there. However when you leak source code for private analysis, then don't report the bugs you find, the result is more 0-days and bugs not getting fixed. This makes us all less secure. Of course with the increasing interest in compromising systems, this is happening regardless of whether or not there is a formal market for them. The present is insecure, and the future is guaranteed to be less so.

tptacek 14y ago

eEye discovered MS01-033 (the flaw later used by Code Red) and was thanked by Microsoft in their advisory for it. Schneier, in the very post we're responding to here, claims to stick up for publishing vulnerabilities; it was "the only way" to handle them. But of course, Schneier didn't come to his current opinion easily; no, he detoured through a prolonged period of using his status in the industry to slander companies who handled the vulnerabilities they found with their own labor in ways he disapproved of. The Register piece you cited doesn't even make logical sense. "Oh ho!", it trumpets. "I see eEye has yet to release a bug their own product doesn't defend against! Surely, if they were ethical, they would cripple their own product to give competing products a fighting chance!" People who don't practice vulnerability research have a very had habit of incorrectly attributing vulnerabilities. Vulnerability researchers don't create them.

btilly 14y ago
People who don't practice vulnerability research have a very had habit of incorrectly attributing vulnerabilities. Vulnerability researchers don't create them. Historically true, but will it remain so? Schneier's point is that the existence of vulnerability markets means that there are incentives for there to be "vulnerability researchers" who are selling the bugs that they themselves created. It is the security version of, "I'm gonna code me up a minivan!"
- tptacek 14y ago
  The Venn diagram of vulnerability researchers and product developers has only a sliver of overlap. Most researchers are not professional developers. No vulnerability that anyone knows about has ever been attributed to product sabotage. If there exists an incentive to sabotage products on behalf of governments or organized crime, that incentive exists with or without formal vulnerability markets. Markets allow vendors to participate and discover vulnerabilities. They are in that sense a uniquely bad setting for internal saboteurs to sell access to code; there is a non-negligible chance that the organization who ends up with your work will be able to "git blame" you. I'm not a supporter of vulnerability markets, but this strikes me as a particularly dumb argument against them.
  - btilly 14y ago
    Chicken, meet egg. Egg meet chicken. Historically economic incentives did not encourage the selling of vulnerabilities that you created. And we have no demonstrated history of the creation of vulnerabilities for sale. Not surprising with the lack of incentives, and not evidence that it won't happen in the future. But disgruntled IT people do all sorts of remarkable stuff. Take the case of Terry Childs, who locked everyone else out of San Francisco's network. Or a friend of a friend of mine who took out his frustration at a previous company by translating a chunk of their code to Latin and then implementing his project in Latin. (Yes, there is a Perl module that lets you program in Latin. No, this is not recommended in production code...) There are a lot of IT people. And some do stupid things. Or interesting things. For instance there is a persistent rumor that http://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html http://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html was not hypothetical, and that Thompson was actually observed using it in the wild. Really cool security hole. (And good luck doing a "git blame" for a bug that appears nowhere in your source code.) But you're right that it is not the best argument against vulnerability markets. Given the quality of most company's code bases, there is no need to add security holes. It is easy and much safer to find the ones that are already there. However when you leak source code for private analysis, then don't report the bugs you find, the result is more 0-days and bugs not getting fixed. This makes us all less secure. Of course with the increasing interest in compromising systems, this is happening regardless of whether or not there is a formal market for them. The present is insecure, and the future is guaranteed to be less so.