4 ms·

I think that the idea of software bugs (vulnerabilities) as a product is a scary concept and a bad precedent for overall security That was my first impression

I think that the idea of software bugs (vulnerabilities) as a product is a scary concept and a bad precedent for overall security That was my first impression as well however, after giving it some thought I wish there are more vulnerability trading companies. The point is that currently this business is reserved for government sponsored customers: According to three sources familiar with Endgame’s business, nearly all of its customers are U.S. government agencies. Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them. To some extent such outsourcing already exists in the form of pen-testing companies, but it seems like a different league.

raesene4 12y ago
interesting idea, to an extent this already exists with bug bounty programmes that a number of companies have in place. The risk is where either the company doesn't have a programme of that kind, or where the value of the bug is substantially higher to the offensive industry, than the product company...
pascal_cuoq 12y ago
> Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them. I should point out that some companies are already getting vulnerabilities reported to them for free (in the best case, for the price of a symbolic bounty program) and fail to fix them. See http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-want-to-or-how-to-make-your-old-os-x-versions-a-bit-safer/ http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-... for one recent example that comes to mind. Giving them the opportunity to pay market prices for the vulnerabilities is not going to improve the situation. Everything else remaining identical, the only thing the emergence of a free market for vulnerabilities will make efficient is the exploitation of victims that aren't informed of and do not have the capacity to fix them. The only real fix to the current situation starts with legislation that aligns the interests of the companies that rely on vulnerable code and those of their users. Forbidding the trading of vulnerabilities won't help, and encouraging it won't help either. Recent legislation in the EU forcing companies to disclose security breaches they are aware of is a first, baby step in the right direction. There are many essays by Bruce Schneier on this topic, here is one picked at random: https://www.schneier.com/blog/archives/2004/11/computer_securi.html https://www.schneier.com/blog/archives/2004/11/computer_secu...
- tormeh 12y ago
  It would also help if we got OSes that do not give applications blanket rights to read and write everywhere and use as much processing power as it likes. Abandoning the shared security model would help a lot.
  - tptacek 12y ago
    I'm having a hard time coming up with an example of a critically important vulnerability that relied on permissions models. Arbitrary code execution is usually game-over no matter what privilege level you have. The exception to this is sandboxing, which is effective (but unreliable) in limited, specific scenarios but not at all effective for the general problem of controlling real, full-featured user programs. Compare the Chrome content sandboxes to the Apple application sandbox.
- tptacek 12y ago
  The fundamental problem with trying to retard vulnerability markets is that vulnerability research is expensive. There aren't that many people who can do it(†). You could conceivably ban overt vulnerability sales. But that doesn't actually fix anything, because the firms that want to buy bugs now will simply retain researchers directly instead of licensing their work product. You could even conceivably ban commercial vulnerability research. ACLU's vulnerability markets guy has come close to suggesting that in the past. But that also won't fix anything. Firms that are using vulnerabilities illegally would continue to (now illegally) fund vulnerability research --- an activity that is far harder to monitor than actual hacking, which is already hard to monitor. The net effect would be to clear the industry of everyone doing "benevolent" research --- no more Metasploit, but lots more VUPEN(††)-type stuff. † Where "it" means the kind of vulnerability research that commands 5-6 figure premiums, virtually none of which is web app security work †† Full disclosure: I know fuck-all about VUPEN and am just using the name as a shorthand for "the vulnerability boogeyman".
  - raesene4 12y ago
    As another slightly less draconian approach than actually trying to ban vulnerability research, what about mandating a market where researchers have to sell to the developers and developers are obliged to buy from the researcher, with a middle-party setting the prices. That might serve to provide incentives to the vendors who aren't already working actively on their security to do so, and also reduce (although obv. it wouldn't eliminate) the number of vulns going straight to offensive products.

raesene4 12y ago

interesting idea, to an extent this already exists with bug bounty programmes that a number of companies have in place. The risk is where either the company doesn't have a programme of that kind, or where the value of the bug is substantially higher to the offensive industry, than the product company...

pascal_cuoq 12y ago

> Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them. I should point out that some companies are already getting vulnerabilities reported to them for free (in the best case, for the price of a symbolic bounty program) and fail to fix them. See http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-want-to-or-how-to-make-your-old-os-x-versions-a-bit-safer/ http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-... for one recent example that comes to mind. Giving them the opportunity to pay market prices for the vulnerabilities is not going to improve the situation. Everything else remaining identical, the only thing the emergence of a free market for vulnerabilities will make efficient is the exploitation of victims that aren't informed of and do not have the capacity to fix them. The only real fix to the current situation starts with legislation that aligns the interests of the companies that rely on vulnerable code and those of their users. Forbidding the trading of vulnerabilities won't help, and encouraging it won't help either. Recent legislation in the EU forcing companies to disclose security breaches they are aware of is a first, baby step in the right direction. There are many essays by Bruce Schneier on this topic, here is one picked at random: https://www.schneier.com/blog/archives/2004/11/computer_securi.html https://www.schneier.com/blog/archives/2004/11/computer_secu...

tormeh 12y ago
It would also help if we got OSes that do not give applications blanket rights to read and write everywhere and use as much processing power as it likes. Abandoning the shared security model would help a lot.
- tptacek 12y ago
  I'm having a hard time coming up with an example of a critically important vulnerability that relied on permissions models. Arbitrary code execution is usually game-over no matter what privilege level you have. The exception to this is sandboxing, which is effective (but unreliable) in limited, specific scenarios but not at all effective for the general problem of controlling real, full-featured user programs. Compare the Chrome content sandboxes to the Apple application sandbox.
tptacek 12y ago
The fundamental problem with trying to retard vulnerability markets is that vulnerability research is expensive. There aren't that many people who can do it(†). You could conceivably ban overt vulnerability sales. But that doesn't actually fix anything, because the firms that want to buy bugs now will simply retain researchers directly instead of licensing their work product. You could even conceivably ban commercial vulnerability research. ACLU's vulnerability markets guy has come close to suggesting that in the past. But that also won't fix anything. Firms that are using vulnerabilities illegally would continue to (now illegally) fund vulnerability research --- an activity that is far harder to monitor than actual hacking, which is already hard to monitor. The net effect would be to clear the industry of everyone doing "benevolent" research --- no more Metasploit, but lots more VUPEN(††)-type stuff. † Where "it" means the kind of vulnerability research that commands 5-6 figure premiums, virtually none of which is web app security work †† Full disclosure: I know fuck-all about VUPEN and am just using the name as a shorthand for "the vulnerability boogeyman".
- raesene4 12y ago
  As another slightly less draconian approach than actually trying to ban vulnerability research, what about mandating a market where researchers have to sell to the developers and developers are obliged to buy from the researcher, with a middle-party setting the prices. That might serve to provide incentives to the vendors who aren't already working actively on their security to do so, and also reduce (although obv. it wouldn't eliminate) the number of vulns going straight to offensive products.