3Com to Buy Security Flaws?

Zonoprh writes "CNET reports that 3Com's TippingPoint division is starting a pay-for-vulnerability program called the Zero Day Initiative. It seems 3Com plans to use the vulnerabilities they purchase to fuel signatures in their protection technologies, in addition to sharing the same data with other security vendors. From the article, "Money has increasingly become an incentive for hackers. Program's such as TippingPoint's offer a legitimate way for them to get paid for their bug hunting. There is also an underground market for vulnerabilities. Cybercriminals pay top dollar for previously undisclosed flaws that they can then exploit to break into computer systems, experts have said.""

Comments

"Will deal only with reputable researchers"

[xmas2003]

From the article: Bugs can be reported to TippingPoint through the Zero Day Initiative Web site. TippingPoint investigates all reports and will deal only with reputable researchers, Endler said. "We need to know exactly who we are working with," he said. "We don't want to work with black hats or illegal groups." The term "black hat" is used to describe criminal hackers.

So I gotta wonder how they are gonna determine who is reputable and who is not ...

Re:"Will deal only with reputable researchers"

[}InFuZeD{]

Well... I imagine if they offer X ammount of dollars per flaw in a certain system and the person asks for more money, then they aren't reputable. If a "researcher" was previously getting no money for the bugs they found, they'd probablytake the little money they can get (I'm guessing TippingPoint won't be giving out a whole lot). If they're actually selling the thing to the highest bidder, I'm guessing TP isn't going to join in the bidding.

Re:"Will deal only with reputable researchers"

[cnettel]

Well, for a start, it could indicate that they won't be making any anonymous payments, or payments through proxies.

Give us your identity, and your bug, we give you the money. Sounds fair.

Simple solution

[Sierpinski]

If someone is able to break into your system offer to pay them to keep it secure from others like themselves.

What was the famous counterfeiters name that the FBI hired to spot fakes? He was the basis for the movie 'Catch me if you Can'.

Allow them to use their powers for good, because if you don't, they will continue to use their powers, in whichever direction (good or bad) that they can. The big companies might as well use them as a tool (and pay them) to create/maintain better secured software.

Re:Simple solution

[myspys]

Frank Abagnale Jr is the man you're looking for!

Re:Simple solution

[paranode]

Legitimized extortion? I think the companies that would hire a criminal to secure their network and put full faith in him not to abuse the data he has access to are few, far between, and frankly a little nutty. It's just a publicity stunt when a company does this. There are a lot of very qualified white hat experts with a long resume of experience and referrals that are a lot more trustworthy and probably more knowledgeable than the kid from Finland who used his l33t skillz to run his script from IRC against your server.

Re:Simple solution

[Sierpinski]

You must not get out much. This type of thing happens, and in my opinion makes perfect sense. Who better to secure your network than the person who got in? Calling these guys criminals (now I'm talking about the ones who actually do nothing malicious OTHER than enter a system that they do not own) is a social thing, not necessarily an ethical one. (I wont get into the debate about whether or not someone can walk into your house because the door is open, blah blah blah) but not only would these companies allow them to do what they obviously enjoy, but they would get a nice paycheck to keep them honest.

Your white hat professionals may have taken a class, been taught by a friend, employers, etc, but most of those people will never match up to the teenager to took it upon himself to learn the details of how to enter a system. Thats the difference between having just a 'job', and having a great passion for what you do.

Clearing house for bugs Nice idea however

[infonography]

They don't share the info on the exploits. With CERT the bug is known even if crucial details are not. With 3Com, it's a murky secret. According to their own data they will sit on them until they have notified every security company first. Only then will they tell the public putting everybody at risk. Worst yet from a business standpoint they can pay of a exploit only to have somebody else notify the world the next day. That's money lost. Unless they want to go an copyright the exploit they are assed out.

So to summarize

[Rosco P. Coltrane]

3Com gets paid to alert its customers of vulnerabilities in near-real-time. Which means, more vulnerabilities fixed == less $$$ for them over time.

Hmmm, great business model...

Re:So to summarize

[I8TheWorm]

Not really... now they're paying people to help them earn that money. Someone submits a vuln to 3Com, get's paid a few hundred or thousand dollars, and 3Com gets the many thousands they're already charging their customers. Then they work on a fix, and get some glory on the back end.

Seems a pretty sound business model to me.

Did I read that right?

[$RANDOMLUSER]

Did it really say that a vulnerability detection company was going to pay people to create/discover vulnerabilities so they could be detected???

This reminds me of mob "insurance".
"You know, if you don't pay us to protect you, something bad could happen to you."

Anyone else see a moral issue here?

Re:Did I read that right?

[Rosco P. Coltrane]

Your post makes no sense: what does "pay people to create/discover vulnerabilities so they can be detected" mean? Have you RTFA?

Secondly, there is no mob insurance: 3com won't crash non-subscribers' computers after making threats, they'll tip people who discover already existing vulnerabilities, and get money from other people to tell them early about them. Take your tinfoil hat off already, gee...

DIY funding

[James McGuigan]

How long till someone finds a security flaw in 3com's online payment system and assigns themselves a financial reward for discovering the security flaw.

yes, it worked for me...

[scotty777]

20 years ago I wrote a security system, and offered the staff a free lunch if they could find any "undocumented behavior". It's a quick and cheap way to build confidence. I had a couple of takers, but both quit their spiel while they were laying out their case... Seem they didn't RTFM! ; )

This is a double-edged sword

[confusion]

On one hand, this bounty will motivate "hackers" to disclose vuln's to 3com, who then will work with the vendor to fix the problem - and make themselves look good in the process - which means there is a legitimate way for some of these people to make real money off of their discoveries instead of turning them into worms or viruses.
And on the other hand, there is a lot of potential for abuse. We could see vulnerability stuffing in open source to get a kick-back (I know it's hard to believe it could happen, but remember - there is money involved), we could see 3com dissing people on the bounty checks which could motivate the hacker to turn the vuln into a worm more quickly to get back at 3com and then there is just the fundamental philosophy that 3com is rewarding someone for doing something bad.

We're going to have to wait to see how this plays out over time. It doesn't seem like a good idea to me, but then 3com has to be able to compete with the big boys now that they own Tipping Point.

Jerry
http://www.cyvin.org/

Re:Since they are competing with money...

[Kiryat Malachi]

Because it is *legal* money, requiring no fencing, no laundering, and above all providing no legal risk to the individual finding the vulnerability.

And if you discover a pattern in one of your suppliers wherein a vulnerability they sell you always shows up with the blackhat organizations at the same time... well, that's why you required traceable identity information before you paid them.

The law, in this case, acts as the stick. Money, as always, is the carrot.

No `advanced notice' for open source code?

[shadowspar]

I don't like the sound of this:

What types of security vendors are eligible for the advanced notice?

In order to qualify for advanced notice, the security vendors must be in a position to remediate or provide protection of vulnerabilities with their solution, while not revealing details of the vulnerability itself to customers. The security vendor's product must also be resistant to discovery of the vulnerability through trivial reverse engineering. An example of such a vendor would be an Intrusion Prevention System, Intrusion Detection System, Vulnerability Scanner or Vulnerability Management System vendor.

This clause seems to indicate that no open source projects are going to benefit from this `advanced notification' scheme. Since patches to open source code are, well, open source, they'd be construed as revealing the nature of the vulnerability, and so 3com won't release the vulnerability information. I really don't like the fact that this clause seems to be giving closed-source products and vendors a leg up when it comes to security notifications.