5 ms·
'Responsible disclosure' is probably one of the worst things to happen to the cyber-security industry, and the $100K carrot-on-a-stick is only going to make it
by ihsw 13y ago
'Responsible disclosure' is probably one of the worst things to happen to the cyber-security industry, and the $100K carrot-on-a-stick is only going to make it worse.
Selling exploits to customers who don't intend on fixing the exploit (buying a hacker's silence) is exactly the nightmare that came to light regarding MS releasing exploit information to NSA prior to releasing publicly-available bugfixes, and these kinds of monetary incentives to the security community will only make things worse.
Read more: https://www.eff.org/deeplinks/2012/03/zero-day-exploit-sales-should-be-key-point-cybersecurity-debate https://www.eff.org/deeplinks/2012/03/zero-day-exploit-sales...
These exploits are effectively high-tech weaponry and they should be treated similarly.
- tptacek 13y agoWhere's a professional vulnerability researcher I can read making the same case? My feed is full of researchers saying how great this is, and how big an accomplishment it was that Katie Moussouris and her team managed to pull it off after Microsoft publicly declared itself opposed to bug bounties. The work required to build reliable exploits against hardened Windows can take months. Why shouldn't researchers be compensated for that work? If you don't want to accept payment for it, that's fine; don't. But why is it bad for other people to do so?
- ihsw 13y agoI'm not arguing about compensation, I'm arguing about public safety. People and organizations selling exploits are effectively complicit in the damage resulting from their sales.
- tptacek 13y agoThese are people selling vulnerability research to the only company in the world that is capable of effectively fixing those vulnerabilities.
- ihsw 13y agoThat's exactly my point, which is why it's dangerous. If the exploits were made public as soon as possible (full disclosure) then MS will have incentive to release bugfixes as soon as possible to the general public.
- tptacek 13y agoIf you want to release your vulnerabilities publicly, Microsoft isn't stopping you.
- dvmmh 13y agoBy taking the cash, I am sure you are bound by secrecy enforced by jail time. I see these increased payments as hush money to keep researchers quiet while they feed them to the NSA for zero day exploits.
- tptacek 13y agoMicrosoft can't jail anybody.
- lawnchair_larry 13y agoYou're either a bad troll or you would make a bad co-conspirator. Just commit a security bug to your own product and save the 100k, duh.
- sliverstorm 13y agoWhy would Microsoft sell the NSA exploits some black hat came up with against their own operating system? They can just install a backdoor.
- davorak 13y agoThey do not have to pay a programmer to put in a back door who may one day talk about it. Fewer people need to know about the program in general. By default a naturally occurring exploit probably upon inspection looks less intentional then one put there on purpose.
- danielweber 13y agoWhat is the damage to public safety if I find a way to exploit Windows and tell Microsoft about it?
- ihsw 13y agoMicrosoft releases this exploit information to governments as a matter of policy, and the governments accordingly conduct clandestine operations and cyber-attacks using this exploit information. MS is in the unique position of being the only ones able to fix the exploit so they are a single-point-of-failure, which diminishes the security of everybody using Windows operating systems.
- tptacek 13y agoNo, Microsoft releases vulnerability information to the government along with private companies in the antivirus and intrusion prevention space. They do this because they have a coordinated patch schedule that creates windows of known vulnerability. Microsoft does not have the in-house expertise to feed exploits to anyone.
- lawnchair_larry 13y ago> Microsoft does not have the in-house expertise to feed exploits to anyone. I agree with you everywhere else in this thread, but you are clearly not up to speed on who works there if you believe that to be accurate. Some of the best exploit writers, who have pioneered new classes of techniques, work at Microsoft (because Microsoft went on a recruiting spree to target them).
- tptacek 13y agoI know who works there and believe my statement to be accurate; remember, we're talking about the total volume of all vulnerabilities discovered in Microsoft products.
- 13y ago
- bluepanda_ 13y agoYou just ruined my hopes of making an annual salary in an evening. > The work required to build reliable exploits against hardened Windows can take months.
- lostnet 13y agoGroups brokering exploits is definitely scary stuff. But the non-privatized government researchers have existed long before them and are better at keeping silent and therefore largely perpetual exploits. Under it all, the current model remains a by obscurity model, where anyone with orders of more magnitude of resources can certainly do enough reverse engineering to find the weak links and break in without planting backdoors. Vendors reaching the point where they can offer bounties without contemplating bankruptcy implies considerably more resources are going into secure by design software and will continue to flow if they plan to remain solvent and unembarrassed (equally emabarassed?) I've been playing with a chromebook and I am delighted to see frivolous and even fairly significant features were dropped to develop a secure boot model with a reasonable opt out. I'm sure it will still be broken, but 5-10 years ago it would have been trivially breakable to meet some last minute corporate request for tftp booting, marketing demo, or what have you.. Similar to the drug market, you can not drop the open market and expect everything to stop. Instead you must capture as many resources as you can and direct them to the right goal. I would hope that goal is secure kernels that expand out towards today's features, since the opposite clearly does not work with the resources at hand.