8 ms·

The Mercenaries: Ex-NSA hackers are shaping the future of cyberwar

109 points by dthal 12y ago

raesene4 12y ago
FWIW, I think that the idea of software bugs (vulnerabilities) as a product is a scary concept and a bad precedent for overall security. Once you have legitimate corporations who's goal is to find software vulnerabilities, combine them with delivery systems and sell to either specific entities (e.g. the US government) or the highest bidder, I think that the incentives for people involved in software development and testing get odd, and not in a good way. For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak. Another example is, are there incentives now for people who work in development or testing, who aren't perhaps happy in their jobs, to sell knowledge of bugs or flaws to these companies? Given the prices paid, which could be several multiples of peoples annual salary, and the anonymity afforded to people who report the flaws, it could be a low risk way to make a lot of money. And then you have open source software which is heavily used in a lot of commercial products that might get attacked. With this kind of thing there's a big incentive not to report bugs to the project but to sell them to a company who has no incentive to see them fixed...
- gluczywo 12y ago
  I think that the idea of software bugs (vulnerabilities) as a product is a scary concept and a bad precedent for overall security That was my first impression as well however, after giving it some thought I wish there are more vulnerability trading companies. The point is that currently this business is reserved for government sponsored customers: According to three sources familiar with Endgame’s business, nearly all of its customers are U.S. government agencies. Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them. To some extent such outsourcing already exists in the form of pen-testing companies, but it seems like a different league.
  - raesene4 12y ago
    interesting idea, to an extent this already exists with bug bounty programmes that a number of companies have in place. The risk is where either the company doesn't have a programme of that kind, or where the value of the bug is substantially higher to the offensive industry, than the product company...
  - pascal_cuoq 12y ago
    > Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them. I should point out that some companies are already getting vulnerabilities reported to them for free (in the best case, for the price of a symbolic bounty program) and fail to fix them. See http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-want-to-or-how-to-make-your-old-os-x-versions-a-bit-safer/ http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-... for one recent example that comes to mind. Giving them the opportunity to pay market prices for the vulnerabilities is not going to improve the situation. Everything else remaining identical, the only thing the emergence of a free market for vulnerabilities will make efficient is the exploitation of victims that aren't informed of and do not have the capacity to fix them. The only real fix to the current situation starts with legislation that aligns the interests of the companies that rely on vulnerable code and those of their users. Forbidding the trading of vulnerabilities won't help, and encouraging it won't help either. Recent legislation in the EU forcing companies to disclose security breaches they are aware of is a first, baby step in the right direction. There are many essays by Bruce Schneier on this topic, here is one picked at random: https://www.schneier.com/blog/archives/2004/11/computer_securi.html https://www.schneier.com/blog/archives/2004/11/computer_secu...
    - tormeh 12y ago
      It would also help if we got OSes that do not give applications blanket rights to read and write everywhere and use as much processing power as it likes. Abandoning the shared security model would help a lot.
      - tptacek 12y ago
- jackgavigan 12y ago
  t's not a giant leap from "not reporting a bug" to "deliberately inserting a bug" and then selling details of it.
- meowface 12y ago
  This has aleady been going on, publicly, for many years and is the value proposition of several companies. Take a look at TippingPoint ZDI and VUPEN. All they do is find/buy vulnerabilities, privately weaponize (or provide mitigations for) them, and sell the new product to companies and governments.
- emotionalcode 12y ago
  > And then you have open source software which is heavily used in a lot of commercial products that might get attacked. With this kind of thing there's a big incentive not to report bugs to the project but to sell them to a company who has no incentive to see them fixed... Then a lot of people need to revisit their own thoughts on exactly why they use open source, and the consequences of what happens if it goes away. > For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak. That might happen, but it depends on intent. Products may be realized to be weak afterwards, due to a changing software landscape, so the company hiring them is a good thing - the software gets fixed in some way, and a need was fulfilled. Then the question becomes: how likely do you think it is that someone purposefully creates a flawed product in order to make a gain later, after the project has been completed, released; after they have left the job; after they have been hired by these testing companies? It sounds as likely to me as people purposefully putting back-doors into software for future self interest. There exists another outlet for unethical intent, but in my opinion, the problem begins with ethics to begin with. Software is too complex to perfect. There will always be bugs. Regulation of industry and regulation of the regulatory bodies is additionally, very complex. The idea of regulating where knowledge is allowed to flow on top of that horrifies me: i.e., whether a developer is allowed to work at one of these companies eventually, in judgment of prior work. I wish people had greater incentive to maintain a standardization of ethics, but this is all theoretical to begin with, at least from my direct observations. There is nothing to judge unless it happens, and then the best one can do is act.
- tptacek 12y ago
  I'm uncomfortable with vulnerability markets for other reasons. But, anyways, you write: For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak. Two things. First, you're not clear on why this would be a bad thing. The flaws are there whether insiders out them or not. The implication in your comment is that we'd be better off with those flaws kept secret. Obviously, we'd all be happier if the vendor outed their own flaws, or if a non-"mercenary" researcher outed them for public consumption. But even private vulnerability sales have the effect of eventually burning the bug. Second, it's a little naive to think that most flaws are known only to insiders. In fact, the advantage insiders have in getting full access to repositories is probably dwarfed by the advantage attackers have in committing entire careers to studying exploitable bugs. For most competent researchers, lack of source code is just a speed bump.
  - kabouseng 12y ago
    On your second point... Yes but having a paid insider gives you a major advantage. You can now seed vulnerabilities, and derive a predictable income stream from these seeded vulnerabilities. What is more scary to me is that big money is involved here. What if you can't get a developer to be tempted by money to insert vulnerabilities for you, and you start using a more heavy handed approach (death threats etc). Also by paying developers to insert vulnerabilities, you no longer need experts looking for vulnerabilities. These experts are in short supply, so it might become a more viable path. This is why I am uncomfortable with vulnerability markets...
    - tptacek 12y ago
      First, I thought you were simply talking about insiders who had knowledge of targeted software. Here it seems like you're talking about moles being paid to insert new vulnerabilities. But even then, I don't find this threat particularly credible. After all, what we're talking about here are W2 employees with social security numbers or immigration tracking committing galactically expensive torts against their employers and in all likelihood most of the Fortune 500, in addition to (in all probability) multiple felonies. How much money do you think Endgame can afford to pay these people to shoulder that risk? There's a reason this doesn't actually happen all the time.
deleted 12y ago
[deleted]
JoachimSchipper 12y ago
The company profiled in the article ("ex-NSA") isn't exactly the first player in its space - e.g. VUPEN is a pretty established company (http://www.vupen.com/english/services/lea-index.php http://www.vupen.com/english/services/lea-index.php), and there have been earlier articles on this market (for instance http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/ http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin... is pretty readable). This may be a very good book, worth reading, but it's not really news.
snlacks 12y ago
I just want to make sure I have this right. The government hires these guys and then keeps the vulnerabilities in our software and our businesses' software secret? They then use this to launch attacks and record our communications and actions? I, of course, would have an opinion on this, I just want to make sure I've got this correct. Edit: punctuation.
- tptacek 12y ago
  That is not a very good summary of Endgame or VUPEN.
  - kelvin0 12y ago
    So asking questions is also grounds for being down voted? I am confused ...
    - snlacks 12y ago
      That doesn't matter, people will up or down vote. It was, indeed a question loaded with my preexisting bias, but also a genuine question.
      - arkem 12y ago
        VUPEN and Endgame are companies that employ people to do vulnerability research and develop exploits. They sell a subscription service that provides access to a catalogue of their exploits to Government groups (law enforcement and intelligence agencies mostly). Depending on the company the list of acceptable clients will vary, some of these firms sell only to the federal agencies of 5-Eyes nations, others will sell more broadly than that, some may only sell to ${Local SIGINT agency}. Government groups might do any number of things with these exploits but typically law enforcement will use them to execute warrants to help in their surveillance of suspects. Intelligence agencies may use them in the same way (pursuant to their authorizations). Other customers might somehow try and defend friendly networks with the information but this doesn't work. I'm not sure what in particular tptacek objected to but my guess is characterizing them as part of the Government. The Government isn't keeping any secrets here (except for the ones they're presumably contractually obligated to keep by Endgame / VUPEN / etc) and the vulnerabilities have been discovered before the Government has contracted with the supplier.
Zigurd 12y ago
Allowing this is like allowing the development of engineered bioweapons and an open market selling them to the highest bidder.
- tptacek 12y ago
  And you would stop allowing it how? Serious question. I commented upthread about that problem.
  - Zigurd 12y ago
    How do we not have freelance bioweapons developers? Would it be any more difficult to prohibit the development and auctioning of cyberweapons? I don't mean to be evasive by answering your question with a question, but freelance development of weapons that can cause widespread damage seems to be controllable. Why not quash the development sold-to-the-highest-bidder cyberweapons by the same means?
    - deleted 12y ago
      [deleted]
    - tptacek 12y ago
      Yes, "cyberweapons" (I hate that term but know why people use it) are much harder to control than bioweapons. How would you control them? What would that policy look like? Want to take a stab at one? I'm interested in what people think should be done about this problem.
      - raesene4 12y ago
        The answer is obviously complex and difficult, but I think it's fair to say the current approach isn't working well.. So you need something new to address the problem. I think that the answer is government legislation. To be clear, I think that it's a terrible answer, in fact everything I'm about to write has glaring problems, I just can't come up with a better alternative. So software suppliers have to be held responsible for the security of the products they supply, it would obviously be a long and arduous process, and would likely have serious repercussions on the industry as it stands today. Flip-side is that you try to regulate the market for vulns to reduce their use in malware etc. you could do this by requiring companies to buy discovered vulns and require researchers to sell to the developers. One of the many major issues with this approach is, what do you do about open source software. There's no money, so liability has no meaning. Here, if it's constituted into a commercial product (think all the lovely "appliances" out there) the liability passes to the guy making the money. Where an end-user company directly uses open source, they get the liability to go with it. Along-side this you start slowly ramping up the security compliance requirements for companies and organisations processing transactions or personal data on the Internet. I'd compare this to security becoming like "health & safety" . I don't think most companies really want to spend money on it, and I think a huge amount of money is wasted in unneeded process, but compared to the alternative, it has been seen to be the best approach.
deleted 12y ago
[deleted]
tptacek 12y ago
"A survey of 181 attendees at the 2012 Black Hat USA conference in Las Vegas found that 36 percent of “information security professionals” said they’d engaged in retaliatory hack-backs." What? Black Hat attendance is in the high thousands. A plurality of those attending are IT professionals --- people that wouldn't have the technical capability to take over a botnet even if they wanted to. Even if you broadened the definition of "hacking back", as some people do, to recon activities like port scans. No part of this anecdote makes sense. For my part (I'm a security researcher by background, though that's not what I'm doing now, and I've presented at Black Hat numerous times): not only have I never met a professional who claimed to have "hacked back" anything, but I've never even met one who didn't think that was a crazy idea. There is a difference between major organized efforts to bring down botnets and "hackback" the way the term gets associated with Endgame.
- sarciszewski 12y ago
  > I never met a professional who claimed to have "hacked back" anything, but I've never even met one who didn't think that was a crazy idea. Coming from the amateur side of things, my observations mirror your observations. The only people who think it's a good idea, from what I've seen, are script kiddies-- not professionals.
tptacek 12y ago
Also: the closing grafs in the article, about Cisco's acquisition of Sourcefire, are particularly dumb. Sourcefire is the commercial backer of Snort, the open source network intrusion detection system (and also the owners of ClamAV). The author of this article and his sources express surprise that Cisco would pay big money for an open-source product that anyone can use. Cisco paid just about 10x trailing revenue for Sourcefire, a public company that had managed to dominate enterprise network security and which competed directly with products that had been cash cows for Cisco for over a decade. Cisco has for as long as I've been in the industry --- in fact, for as long as there's been that industry --- been the single most important acquirer of network security companies. They acquired security companies with the same fervor in 1998 as they do today. Cisco's acquisition of Sourcefire might qualify as the single least interesting story in information security in the last 5 years. Want to make a couple hundred million dollars? You too can do what Sourcefire did: start an open source project that appeals to enterprise teams who spend monopoly money to buy products (that is, start any enterprise-relevant open source project). Get thousands of people to use it. Then start a company and hire an inside sales team. Have them call company after company and ask, "Do you use our open-source project?" Sell extra stuff to the people who say "yes".
Kalium 12y ago
I interviewed with Endgame recently. Their arrogance was striking. More topically, there's a basic problem in security - vulnerabilities have value. They have more value to people who want to use them than to people who want to close them. Unless this shifts, the current situation is only going to get worse. Making it illegal isn't going to work. There is already a functional black market. Removing the white market will just drive more groups to the black market. There's no easy answer here. Yesteryear's EFNet junkies have been turned into today's mercenaries and weapon designers. Cyberspace is valuable, and controlling it moreso. It's a dangerous time to have interesting information.
- tptacek 12y ago
  Worth adding: even basic software security engineering services are, compared to other services, spectacularly expensive. In ten years of software security consulting for big companies, I met with very few who didn't get sticker shock from the cost of even a basic web app assessment. Supply/demand is a motherfucker. The solution is probably going to have to focus on the supply side.
  - Kalium 12y ago
    A lot of basic stuff can be automated, but that only goes so far. Security engineering is becoming its own distinct and highly specialized discipline, and the supply is probably always going to be limited. I think a better answer is for companies to take security more seriously from the beginning. This means being willing to invest in developer training and in-house infosec. The expense of outside expertise should be ample reason to bring that inside.
tw04 12y ago
We need to allow corporations to fight back? Why stop at cyberspace, I think we should let multinational corporations field their own private armies as well. What could possibly go wrong? It's not like they'd ever abuse that power!

109 points by dthal 12y ago

FWIW, I think that the idea of software bugs (vulnerabilities) as a product is a scary concept and a bad precedent for overall security. Once you have legitimate corporations who's goal is to find software vulnerabilities, combine them with delivery systems and sell to either specific entities (e.g. the US government) or the highest bidder, I think that the incentives for people involved in software development and testing get odd, and not in a good way. For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak. Another example is, are there incentives now for people who work in development or testing, who aren't perhaps happy in their jobs, to sell knowledge of bugs or flaws to these companies? Given the prices paid, which could be several multiples of peoples annual salary, and the anonymity afforded to people who report the flaws, it could be a low risk way to make a lot of money. And then you have open source software which is heavily used in a lot of commercial products that might get attacked. With this kind of thing there's a big incentive not to report bugs to the project but to sell them to a company who has no incentive to see them fixed...

gluczywo 12y ago
I think that the idea of software bugs (vulnerabilities) as a product is a scary concept and a bad precedent for overall security That was my first impression as well however, after giving it some thought I wish there are more vulnerability trading companies. The point is that currently this business is reserved for government sponsored customers: According to three sources familiar with Endgame’s business, nearly all of its customers are U.S. government agencies. Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them. To some extent such outsourcing already exists in the form of pen-testing companies, but it seems like a different league.
- raesene4 12y ago
  interesting idea, to an extent this already exists with bug bounty programmes that a number of companies have in place. The risk is where either the company doesn't have a programme of that kind, or where the value of the bug is substantially higher to the offensive industry, than the product company...
- pascal_cuoq 12y ago
  > Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them. I should point out that some companies are already getting vulnerabilities reported to them for free (in the best case, for the price of a symbolic bounty program) and fail to fix them. See http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-want-to-or-how-to-make-your-old-os-x-versions-a-bit-safer/ http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-... for one recent example that comes to mind. Giving them the opportunity to pay market prices for the vulnerabilities is not going to improve the situation. Everything else remaining identical, the only thing the emergence of a free market for vulnerabilities will make efficient is the exploitation of victims that aren't informed of and do not have the capacity to fix them. The only real fix to the current situation starts with legislation that aligns the interests of the companies that rely on vulnerable code and those of their users. Forbidding the trading of vulnerabilities won't help, and encouraging it won't help either. Recent legislation in the EU forcing companies to disclose security breaches they are aware of is a first, baby step in the right direction. There are many essays by Bruce Schneier on this topic, here is one picked at random: https://www.schneier.com/blog/archives/2004/11/computer_securi.html https://www.schneier.com/blog/archives/2004/11/computer_secu...
  - tormeh 12y ago
    It would also help if we got OSes that do not give applications blanket rights to read and write everywhere and use as much processing power as it likes. Abandoning the shared security model would help a lot.
    - tptacek 12y ago
jackgavigan 12y ago
t's not a giant leap from "not reporting a bug" to "deliberately inserting a bug" and then selling details of it.
meowface 12y ago
This has aleady been going on, publicly, for many years and is the value proposition of several companies. Take a look at TippingPoint ZDI and VUPEN. All they do is find/buy vulnerabilities, privately weaponize (or provide mitigations for) them, and sell the new product to companies and governments.
emotionalcode 12y ago
> And then you have open source software which is heavily used in a lot of commercial products that might get attacked. With this kind of thing there's a big incentive not to report bugs to the project but to sell them to a company who has no incentive to see them fixed... Then a lot of people need to revisit their own thoughts on exactly why they use open source, and the consequences of what happens if it goes away. > For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak. That might happen, but it depends on intent. Products may be realized to be weak afterwards, due to a changing software landscape, so the company hiring them is a good thing - the software gets fixed in some way, and a need was fulfilled. Then the question becomes: how likely do you think it is that someone purposefully creates a flawed product in order to make a gain later, after the project has been completed, released; after they have left the job; after they have been hired by these testing companies? It sounds as likely to me as people purposefully putting back-doors into software for future self interest. There exists another outlet for unethical intent, but in my opinion, the problem begins with ethics to begin with. Software is too complex to perfect. There will always be bugs. Regulation of industry and regulation of the regulatory bodies is additionally, very complex. The idea of regulating where knowledge is allowed to flow on top of that horrifies me: i.e., whether a developer is allowed to work at one of these companies eventually, in judgment of prior work. I wish people had greater incentive to maintain a standardization of ethics, but this is all theoretical to begin with, at least from my direct observations. There is nothing to judge unless it happens, and then the best one can do is act.
tptacek 12y ago
I'm uncomfortable with vulnerability markets for other reasons. But, anyways, you write: For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak. Two things. First, you're not clear on why this would be a bad thing. The flaws are there whether insiders out them or not. The implication in your comment is that we'd be better off with those flaws kept secret. Obviously, we'd all be happier if the vendor outed their own flaws, or if a non-"mercenary" researcher outed them for public consumption. But even private vulnerability sales have the effect of eventually burning the bug. Second, it's a little naive to think that most flaws are known only to insiders. In fact, the advantage insiders have in getting full access to repositories is probably dwarfed by the advantage attackers have in committing entire careers to studying exploitable bugs. For most competent researchers, lack of source code is just a speed bump.
- kabouseng 12y ago
  On your second point... Yes but having a paid insider gives you a major advantage. You can now seed vulnerabilities, and derive a predictable income stream from these seeded vulnerabilities. What is more scary to me is that big money is involved here. What if you can't get a developer to be tempted by money to insert vulnerabilities for you, and you start using a more heavy handed approach (death threats etc). Also by paying developers to insert vulnerabilities, you no longer need experts looking for vulnerabilities. These experts are in short supply, so it might become a more viable path. This is why I am uncomfortable with vulnerability markets...
  - tptacek 12y ago
    First, I thought you were simply talking about insiders who had knowledge of targeted software. Here it seems like you're talking about moles being paid to insert new vulnerabilities. But even then, I don't find this threat particularly credible. After all, what we're talking about here are W2 employees with social security numbers or immigration tracking committing galactically expensive torts against their employers and in all likelihood most of the Fortune 500, in addition to (in all probability) multiple felonies. How much money do you think Endgame can afford to pay these people to shoulder that risk? There's a reason this doesn't actually happen all the time.

deleted 12y ago

[deleted]

JoachimSchipper 12y ago

The company profiled in the article ("ex-NSA") isn't exactly the first player in its space - e.g. VUPEN is a pretty established company (http://www.vupen.com/english/services/lea-index.php http://www.vupen.com/english/services/lea-index.php), and there have been earlier articles on this market (for instance http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/ http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin... is pretty readable). This may be a very good book, worth reading, but it's not really news.

snlacks 12y ago

I just want to make sure I have this right. The government hires these guys and then keeps the vulnerabilities in our software and our businesses' software secret? They then use this to launch attacks and record our communications and actions? I, of course, would have an opinion on this, I just want to make sure I've got this correct. Edit: punctuation.

tptacek 12y ago
That is not a very good summary of Endgame or VUPEN.
- kelvin0 12y ago
  So asking questions is also grounds for being down voted? I am confused ...
  - snlacks 12y ago
    That doesn't matter, people will up or down vote. It was, indeed a question loaded with my preexisting bias, but also a genuine question.
    - arkem 12y ago
      VUPEN and Endgame are companies that employ people to do vulnerability research and develop exploits. They sell a subscription service that provides access to a catalogue of their exploits to Government groups (law enforcement and intelligence agencies mostly). Depending on the company the list of acceptable clients will vary, some of these firms sell only to the federal agencies of 5-Eyes nations, others will sell more broadly than that, some may only sell to ${Local SIGINT agency}. Government groups might do any number of things with these exploits but typically law enforcement will use them to execute warrants to help in their surveillance of suspects. Intelligence agencies may use them in the same way (pursuant to their authorizations). Other customers might somehow try and defend friendly networks with the information but this doesn't work. I'm not sure what in particular tptacek objected to but my guess is characterizing them as part of the Government. The Government isn't keeping any secrets here (except for the ones they're presumably contractually obligated to keep by Endgame / VUPEN / etc) and the vulnerabilities have been discovered before the Government has contracted with the supplier.

Zigurd 12y ago

Allowing this is like allowing the development of engineered bioweapons and an open market selling them to the highest bidder.

tptacek 12y ago
And you would stop allowing it how? Serious question. I commented upthread about that problem.
- Zigurd 12y ago
  How do we not have freelance bioweapons developers? Would it be any more difficult to prohibit the development and auctioning of cyberweapons? I don't mean to be evasive by answering your question with a question, but freelance development of weapons that can cause widespread damage seems to be controllable. Why not quash the development sold-to-the-highest-bidder cyberweapons by the same means?
  - deleted 12y ago
    [deleted]
  - tptacek 12y ago
    Yes, "cyberweapons" (I hate that term but know why people use it) are much harder to control than bioweapons. How would you control them? What would that policy look like? Want to take a stab at one? I'm interested in what people think should be done about this problem.
    - raesene4 12y ago
      The answer is obviously complex and difficult, but I think it's fair to say the current approach isn't working well.. So you need something new to address the problem. I think that the answer is government legislation. To be clear, I think that it's a terrible answer, in fact everything I'm about to write has glaring problems, I just can't come up with a better alternative. So software suppliers have to be held responsible for the security of the products they supply, it would obviously be a long and arduous process, and would likely have serious repercussions on the industry as it stands today. Flip-side is that you try to regulate the market for vulns to reduce their use in malware etc. you could do this by requiring companies to buy discovered vulns and require researchers to sell to the developers. One of the many major issues with this approach is, what do you do about open source software. There's no money, so liability has no meaning. Here, if it's constituted into a commercial product (think all the lovely "appliances" out there) the liability passes to the guy making the money. Where an end-user company directly uses open source, they get the liability to go with it. Along-side this you start slowly ramping up the security compliance requirements for companies and organisations processing transactions or personal data on the Internet. I'd compare this to security becoming like "health & safety" . I don't think most companies really want to spend money on it, and I think a huge amount of money is wasted in unneeded process, but compared to the alternative, it has been seen to be the best approach.

deleted 12y ago

[deleted]

tptacek 12y ago

"A survey of 181 attendees at the 2012 Black Hat USA conference in Las Vegas found that 36 percent of “information security professionals” said they’d engaged in retaliatory hack-backs." What? Black Hat attendance is in the high thousands. A plurality of those attending are IT professionals --- people that wouldn't have the technical capability to take over a botnet even if they wanted to. Even if you broadened the definition of "hacking back", as some people do, to recon activities like port scans. No part of this anecdote makes sense. For my part (I'm a security researcher by background, though that's not what I'm doing now, and I've presented at Black Hat numerous times): not only have I never met a professional who claimed to have "hacked back" anything, but I've never even met one who didn't think that was a crazy idea. There is a difference between major organized efforts to bring down botnets and "hackback" the way the term gets associated with Endgame.

sarciszewski 12y ago
> I never met a professional who claimed to have "hacked back" anything, but I've never even met one who didn't think that was a crazy idea. Coming from the amateur side of things, my observations mirror your observations. The only people who think it's a good idea, from what I've seen, are script kiddies-- not professionals.

tptacek 12y ago

Also: the closing grafs in the article, about Cisco's acquisition of Sourcefire, are particularly dumb. Sourcefire is the commercial backer of Snort, the open source network intrusion detection system (and also the owners of ClamAV). The author of this article and his sources express surprise that Cisco would pay big money for an open-source product that anyone can use. Cisco paid just about 10x trailing revenue for Sourcefire, a public company that had managed to dominate enterprise network security and which competed directly with products that had been cash cows for Cisco for over a decade. Cisco has for as long as I've been in the industry --- in fact, for as long as there's been that industry --- been the single most important acquirer of network security companies. They acquired security companies with the same fervor in 1998 as they do today. Cisco's acquisition of Sourcefire might qualify as the single least interesting story in information security in the last 5 years. Want to make a couple hundred million dollars? You too can do what Sourcefire did: start an open source project that appeals to enterprise teams who spend monopoly money to buy products (that is, start any enterprise-relevant open source project). Get thousands of people to use it. Then start a company and hire an inside sales team. Have them call company after company and ask, "Do you use our open-source project?" Sell extra stuff to the people who say "yes".

Kalium 12y ago

I interviewed with Endgame recently. Their arrogance was striking. More topically, there's a basic problem in security - vulnerabilities have value. They have more value to people who want to use them than to people who want to close them. Unless this shifts, the current situation is only going to get worse. Making it illegal isn't going to work. There is already a functional black market. Removing the white market will just drive more groups to the black market. There's no easy answer here. Yesteryear's EFNet junkies have been turned into today's mercenaries and weapon designers. Cyberspace is valuable, and controlling it moreso. It's a dangerous time to have interesting information.

tptacek 12y ago
Worth adding: even basic software security engineering services are, compared to other services, spectacularly expensive. In ten years of software security consulting for big companies, I met with very few who didn't get sticker shock from the cost of even a basic web app assessment. Supply/demand is a motherfucker. The solution is probably going to have to focus on the supply side.
- Kalium 12y ago
  A lot of basic stuff can be automated, but that only goes so far. Security engineering is becoming its own distinct and highly specialized discipline, and the supply is probably always going to be limited. I think a better answer is for companies to take security more seriously from the beginning. This means being willing to invest in developer training and in-house infosec. The expense of outside expertise should be ample reason to bring that inside.

tw04 12y ago

We need to allow corporations to fight back? Why stop at cyberspace, I think we should let multinational corporations field their own private armies as well. What could possibly go wrong? It's not like they'd ever abuse that power!