5 ms·

FWIW, I think that the idea of software bugs (vulnerabilities) as a product is a scary concept and a bad precedent for overall security. Once you have legitima

FWIW, I think that the idea of software bugs (vulnerabilities) as a product is a scary concept and a bad precedent for overall security. Once you have legitimate corporations who's goal is to find software vulnerabilities, combine them with delivery systems and sell to either specific entities (e.g. the US government) or the highest bidder, I think that the incentives for people involved in software development and testing get odd, and not in a good way. For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak. Another example is, are there incentives now for people who work in development or testing, who aren't perhaps happy in their jobs, to sell knowledge of bugs or flaws to these companies? Given the prices paid, which could be several multiples of peoples annual salary, and the anonymity afforded to people who report the flaws, it could be a low risk way to make a lot of money. And then you have open source software which is heavily used in a lot of commercial products that might get attacked. With this kind of thing there's a big incentive not to report bugs to the project but to sell them to a company who has no incentive to see them fixed...

gluczywo 12y ago
I think that the idea of software bugs (vulnerabilities) as a product is a scary concept and a bad precedent for overall security That was my first impression as well however, after giving it some thought I wish there are more vulnerability trading companies. The point is that currently this business is reserved for government sponsored customers: According to three sources familiar with Endgame’s business, nearly all of its customers are U.S. government agencies. Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them. To some extent such outsourcing already exists in the form of pen-testing companies, but it seems like a different league.
- raesene4 12y ago
  interesting idea, to an extent this already exists with bug bounty programmes that a number of companies have in place. The risk is where either the company doesn't have a programme of that kind, or where the value of the bug is substantially higher to the offensive industry, than the product company...
- pascal_cuoq 12y ago
  > Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them. I should point out that some companies are already getting vulnerabilities reported to them for free (in the best case, for the price of a symbolic bounty program) and fail to fix them. See http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-want-to-or-how-to-make-your-old-os-x-versions-a-bit-safer/ http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-... for one recent example that comes to mind. Giving them the opportunity to pay market prices for the vulnerabilities is not going to improve the situation. Everything else remaining identical, the only thing the emergence of a free market for vulnerabilities will make efficient is the exploitation of victims that aren't informed of and do not have the capacity to fix them. The only real fix to the current situation starts with legislation that aligns the interests of the companies that rely on vulnerable code and those of their users. Forbidding the trading of vulnerabilities won't help, and encouraging it won't help either. Recent legislation in the EU forcing companies to disclose security breaches they are aware of is a first, baby step in the right direction. There are many essays by Bruce Schneier on this topic, here is one picked at random: https://www.schneier.com/blog/archives/2004/11/computer_securi.html https://www.schneier.com/blog/archives/2004/11/computer_secu...
  - tormeh 12y ago
    It would also help if we got OSes that do not give applications blanket rights to read and write everywhere and use as much processing power as it likes. Abandoning the shared security model would help a lot.
    - tptacek 12y ago
      I'm having a hard time coming up with an example of a critically important vulnerability that relied on permissions models. Arbitrary code execution is usually game-over no matter what privilege level you have. The exception to this is sandboxing, which is effective (but unreliable) in limited, specific scenarios but not at all effective for the general problem of controlling real, full-featured user programs. Compare the Chrome content sandboxes to the Apple application sandbox.
jackgavigan 12y ago
t's not a giant leap from "not reporting a bug" to "deliberately inserting a bug" and then selling details of it.
meowface 12y ago
This has aleady been going on, publicly, for many years and is the value proposition of several companies. Take a look at TippingPoint ZDI and VUPEN. All they do is find/buy vulnerabilities, privately weaponize (or provide mitigations for) them, and sell the new product to companies and governments.
emotionalcode 12y ago
> And then you have open source software which is heavily used in a lot of commercial products that might get attacked. With this kind of thing there's a big incentive not to report bugs to the project but to sell them to a company who has no incentive to see them fixed... Then a lot of people need to revisit their own thoughts on exactly why they use open source, and the consequences of what happens if it goes away. > For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak. That might happen, but it depends on intent. Products may be realized to be weak afterwards, due to a changing software landscape, so the company hiring them is a good thing - the software gets fixed in some way, and a need was fulfilled. Then the question becomes: how likely do you think it is that someone purposefully creates a flawed product in order to make a gain later, after the project has been completed, released; after they have left the job; after they have been hired by these testing companies? It sounds as likely to me as people purposefully putting back-doors into software for future self interest. There exists another outlet for unethical intent, but in my opinion, the problem begins with ethics to begin with. Software is too complex to perfect. There will always be bugs. Regulation of industry and regulation of the regulatory bodies is additionally, very complex. The idea of regulating where knowledge is allowed to flow on top of that horrifies me: i.e., whether a developer is allowed to work at one of these companies eventually, in judgment of prior work. I wish people had greater incentive to maintain a standardization of ethics, but this is all theoretical to begin with, at least from my direct observations. There is nothing to judge unless it happens, and then the best one can do is act.
tptacek 12y ago
I'm uncomfortable with vulnerability markets for other reasons. But, anyways, you write: For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak. Two things. First, you're not clear on why this would be a bad thing. The flaws are there whether insiders out them or not. The implication in your comment is that we'd be better off with those flaws kept secret. Obviously, we'd all be happier if the vendor outed their own flaws, or if a non-"mercenary" researcher outed them for public consumption. But even private vulnerability sales have the effect of eventually burning the bug. Second, it's a little naive to think that most flaws are known only to insiders. In fact, the advantage insiders have in getting full access to repositories is probably dwarfed by the advantage attackers have in committing entire careers to studying exploitable bugs. For most competent researchers, lack of source code is just a speed bump.
- kabouseng 12y ago
  On your second point... Yes but having a paid insider gives you a major advantage. You can now seed vulnerabilities, and derive a predictable income stream from these seeded vulnerabilities. What is more scary to me is that big money is involved here. What if you can't get a developer to be tempted by money to insert vulnerabilities for you, and you start using a more heavy handed approach (death threats etc). Also by paying developers to insert vulnerabilities, you no longer need experts looking for vulnerabilities. These experts are in short supply, so it might become a more viable path. This is why I am uncomfortable with vulnerability markets...
  - tptacek 12y ago
    First, I thought you were simply talking about insiders who had knowledge of targeted software. Here it seems like you're talking about moles being paid to insert new vulnerabilities. But even then, I don't find this threat particularly credible. After all, what we're talking about here are W2 employees with social security numbers or immigration tracking committing galactically expensive torts against their employers and in all likelihood most of the Fortune 500, in addition to (in all probability) multiple felonies. How much money do you think Endgame can afford to pay these people to shoulder that risk? There's a reason this doesn't actually happen all the time.

gluczywo 12y ago

I think that the idea of software bugs (vulnerabilities) as a product is a scary concept and a bad precedent for overall security That was my first impression as well however, after giving it some thought I wish there are more vulnerability trading companies. The point is that currently this business is reserved for government sponsored customers: According to three sources familiar with Endgame’s business, nearly all of its customers are U.S. government agencies. Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them. To some extent such outsourcing already exists in the form of pen-testing companies, but it seems like a different league.

raesene4 12y ago
interesting idea, to an extent this already exists with bug bounty programmes that a number of companies have in place. The risk is where either the company doesn't have a programme of that kind, or where the value of the bug is substantially higher to the offensive industry, than the product company...
pascal_cuoq 12y ago
> Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them. I should point out that some companies are already getting vulnerabilities reported to them for free (in the best case, for the price of a symbolic bounty program) and fail to fix them. See http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-want-to-or-how-to-make-your-old-os-x-versions-a-bit-safer/ http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-... for one recent example that comes to mind. Giving them the opportunity to pay market prices for the vulnerabilities is not going to improve the situation. Everything else remaining identical, the only thing the emergence of a free market for vulnerabilities will make efficient is the exploitation of victims that aren't informed of and do not have the capacity to fix them. The only real fix to the current situation starts with legislation that aligns the interests of the companies that rely on vulnerable code and those of their users. Forbidding the trading of vulnerabilities won't help, and encouraging it won't help either. Recent legislation in the EU forcing companies to disclose security breaches they are aware of is a first, baby step in the right direction. There are many essays by Bruce Schneier on this topic, here is one picked at random: https://www.schneier.com/blog/archives/2004/11/computer_securi.html https://www.schneier.com/blog/archives/2004/11/computer_secu...
- tormeh 12y ago
  It would also help if we got OSes that do not give applications blanket rights to read and write everywhere and use as much processing power as it likes. Abandoning the shared security model would help a lot.
  - tptacek 12y ago
    I'm having a hard time coming up with an example of a critically important vulnerability that relied on permissions models. Arbitrary code execution is usually game-over no matter what privilege level you have. The exception to this is sandboxing, which is effective (but unreliable) in limited, specific scenarios but not at all effective for the general problem of controlling real, full-featured user programs. Compare the Chrome content sandboxes to the Apple application sandbox.

jackgavigan 12y ago

t's not a giant leap from "not reporting a bug" to "deliberately inserting a bug" and then selling details of it.

meowface 12y ago

This has aleady been going on, publicly, for many years and is the value proposition of several companies. Take a look at TippingPoint ZDI and VUPEN. All they do is find/buy vulnerabilities, privately weaponize (or provide mitigations for) them, and sell the new product to companies and governments.

emotionalcode 12y ago

> And then you have open source software which is heavily used in a lot of commercial products that might get attacked. With this kind of thing there's a big incentive not to report bugs to the project but to sell them to a company who has no incentive to see them fixed... Then a lot of people need to revisit their own thoughts on exactly why they use open source, and the consequences of what happens if it goes away. > For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak. That might happen, but it depends on intent. Products may be realized to be weak afterwards, due to a changing software landscape, so the company hiring them is a good thing - the software gets fixed in some way, and a need was fulfilled. Then the question becomes: how likely do you think it is that someone purposefully creates a flawed product in order to make a gain later, after the project has been completed, released; after they have left the job; after they have been hired by these testing companies? It sounds as likely to me as people purposefully putting back-doors into software for future self interest. There exists another outlet for unethical intent, but in my opinion, the problem begins with ethics to begin with. Software is too complex to perfect. There will always be bugs. Regulation of industry and regulation of the regulatory bodies is additionally, very complex. The idea of regulating where knowledge is allowed to flow on top of that horrifies me: i.e., whether a developer is allowed to work at one of these companies eventually, in judgment of prior work. I wish people had greater incentive to maintain a standardization of ethics, but this is all theoretical to begin with, at least from my direct observations. There is nothing to judge unless it happens, and then the best one can do is act.

tptacek 12y ago

I'm uncomfortable with vulnerability markets for other reasons. But, anyways, you write: For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak. Two things. First, you're not clear on why this would be a bad thing. The flaws are there whether insiders out them or not. The implication in your comment is that we'd be better off with those flaws kept secret. Obviously, we'd all be happier if the vendor outed their own flaws, or if a non-"mercenary" researcher outed them for public consumption. But even private vulnerability sales have the effect of eventually burning the bug. Second, it's a little naive to think that most flaws are known only to insiders. In fact, the advantage insiders have in getting full access to repositories is probably dwarfed by the advantage attackers have in committing entire careers to studying exploitable bugs. For most competent researchers, lack of source code is just a speed bump.

kabouseng 12y ago
On your second point... Yes but having a paid insider gives you a major advantage. You can now seed vulnerabilities, and derive a predictable income stream from these seeded vulnerabilities. What is more scary to me is that big money is involved here. What if you can't get a developer to be tempted by money to insert vulnerabilities for you, and you start using a more heavy handed approach (death threats etc). Also by paying developers to insert vulnerabilities, you no longer need experts looking for vulnerabilities. These experts are in short supply, so it might become a more viable path. This is why I am uncomfortable with vulnerability markets...
- tptacek 12y ago
  First, I thought you were simply talking about insiders who had knowledge of targeted software. Here it seems like you're talking about moles being paid to insert new vulnerabilities. But even then, I don't find this threat particularly credible. After all, what we're talking about here are W2 employees with social security numbers or immigration tracking committing galactically expensive torts against their employers and in all likelihood most of the Fortune 500, in addition to (in all probability) multiple felonies. How much money do you think Endgame can afford to pay these people to shoulder that risk? There's a reason this doesn't actually happen all the time.