Slashdot Mirror
3Com to Buy Security Flaws?
Zonoprh writes "CNET reports that 3Com's TippingPoint division is starting a pay-for-vulnerability program called the Zero Day Initiative. It seems 3Com plans to use the vulnerabilities they purchase to fuel signatures in their protection technologies, in addition to sharing the same data with other security vendors. From the article, "Money has increasingly become an incentive for hackers. Program's such as TippingPoint's offer a legitimate way for them to get paid for their bug hunting. There is also an underground market for vulnerabilities. Cybercriminals pay top dollar for previously undisclosed flaws that they can then exploit to break into computer systems, experts have said.""
So I gotta wonder how they are gonna determine who is reputable and who is not ...
Hulk SMASH Celiac Disease
Much better way to deal with bugs, I'm surprised no one thought about this before. I guess the real test will be to see how they deal with the bugs they "buy"
I knew 3COM was big, but big enough to buy Microsoft? Wow!
If someone is able to break into your system offer to pay them to keep it secure from others like themselves.
What was the famous counterfeiters name that the FBI hired to spot fakes? He was the basis for the movie 'Catch me if you Can'.
Allow them to use their powers for good, because if you don't, they will continue to use their powers, in whichever direction (good or bad) that they can. The big companies might as well use them as a tool (and pay them) to create/maintain better secured software.
And they said zombies weren't real!
They don't share the info on the exploits. With CERT the bug is known even if crucial details are not. With 3Com, it's a murky secret. According to their own data they will sit on them until they have notified every security company first. Only then will they tell the public putting everybody at risk. Worst yet from a business standpoint they can pay of a exploit only to have somebody else notify the world the next day. That's money lost. Unless they want to go an copyright the exploit they are assed out.
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
3Com gets paid to alert its customers of vulnerabilities in near-real-time. Which means, more vulnerabilities fixed == less $$$ for them over time.
Hmmm, great business model...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
And have a great bonus program which will pay you a nice bonus, but what they fail to mention is how much a vulnarability is worth. They have all what it needs here just to screw you with:
1. 3-com makes an offer and the researcher (nice name for a change) accepts it, and keeps his mouth closed.
2. Another researcher (who wishes to stay anonymous) already submitted this bug
It would be nice if they said like how much the bases is what they are willing to pay, and that you can look in the bug database (probably just on some kind of specific property so you can recognize the bug).
However I do like the ZDI platinum bonus: Blackhat training in Las Vegas (with the $20.000 bonus, should be a good few days (-: )
My wife's sketchblog Blob[p]: Gastrono-me
How long till someone finds a security flaw in 3com's online payment system and assigns themselves a financial reward for discovering the security flaw.
Your post makes no sense: what does "pay people to create/discover vulnerabilities so they can be detected" mean? Have you RTFA?
Secondly, there is no mob insurance: 3com won't crash non-subscribers' computers after making threats, they'll tip people who discover already existing vulnerabilities, and get money from other people to tell them early about them. Take your tinfoil hat off already, gee...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
If Microsoft would do this, they would go broke (-:
My wife's sketchblog Blob[p]: Gastrono-me
IIRC, Sun did this with the early versions of Solaris. The transtion from SunOS to Solaris was really painful, especially wrt. SunOS binary compatibility. Now that I think about it, it could have just been a bounty on compatibility problems.
(S(SKK)(SKK))(S(SKK)(SKK))
20 years ago I wrote a security system, and offered the staff a free lunch if they could find any "undocumented behavior". It's a quick and cheap way to build confidence. I had a couple of takers, but both quit their spiel while they were laying out their case... Seem they didn't RTFM! ; )
If they "buy" a software vulnerability, and build a signature for it, will somebody else who builds a signature (e.g., snort) for it be violating some IP right like copyright or patent?
The issue is that if you get paid for finding a flaw, you could get sued for it and there is a nice money trail back to you. 3Com makes no pretense at anonymity or grants any immunity from liablity. While I admit that's not likely, they would sue 3Com first and name you as a co-defendant, your still in it with them. This has happened in the past, I see no reason it's not gonna happen again.
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
Step 1: Create popular, mission critical software that every business will want to install
Step 2: Insert sneaky vulnerabilities
Step 3: Sell bugs to 3COM
Step 4: PROFIT!!!!
A lot of hackers will have to put their money where mouth is. A hear a lot of even "black hats" say they do it for sport, for money, etc., but not maliciously. This provides them an outlet to safely do so, let's see if they bite.
insert inflammatory anti-microsoft comment here
On one hand, this bounty will motivate "hackers" to disclose vuln's to 3com, who then will work with the vendor to fix the problem - and make themselves look good in the process - which means there is a legitimate way for some of these people to make real money off of their discoveries instead of turning them into worms or viruses.
And on the other hand, there is a lot of potential for abuse. We could see vulnerability stuffing in open source to get a kick-back (I know it's hard to believe it could happen, but remember - there is money involved), we could see 3com dissing people on the bounty checks which could motivate the hacker to turn the vuln into a worm more quickly to get back at 3com and then there is just the fundamental philosophy that 3com is rewarding someone for doing something bad.
We're going to have to wait to see how this plays out over time. It doesn't seem like a good idea to me, but then 3com has to be able to compete with the big boys now that they own Tipping Point.
Jerry
http://www.cyvin.org/
Maybe I could patent a vulnerability, then sell the patent to SCO.
"Who controls the past controls the future. Who controls the present controls the past." -- George Orwell
Because it is *legal* money, requiring no fencing, no laundering, and above all providing no legal risk to the individual finding the vulnerability.
And if you discover a pattern in one of your suppliers wherein a vulnerability they sell you always shows up with the blackhat organizations at the same time... well, that's why you required traceable identity information before you paid them.
The law, in this case, acts as the stick. Money, as always, is the carrot.
---
Mod me down, you fucking twits. Go ahead. I dare you.
(I read with sigs off.)
Isn't this similar to the Danegeld that the English used to pay to the Vikings, to keep them from pillaging their towns & burning their crops?
(worked for a time, anyway).
Chip H.
I don't like the sound of this:
This clause seems to indicate that no open source projects are going to benefit from this `advanced notification' scheme. Since patches to open source code are, well, open source, they'd be construed as revealing the nature of the vulnerability, and so 3com won't release the vulnerability information. I really don't like the fact that this clause seems to be giving closed-source products and vendors a leg up when it comes to security notifications.
There is a spellbook here; eat it? [ynq]