3Com to Buy Security Flaws?

Zonoprh writes "CNET reports that 3Com's TippingPoint division is starting a pay-for-vulnerability program called the Zero Day Initiative. It seems 3Com plans to use the vulnerabilities they purchase to fuel signatures in their protection technologies, in addition to sharing the same data with other security vendors. From the article, "Money has increasingly become an incentive for hackers. Program's such as TippingPoint's offer a legitimate way for them to get paid for their bug hunting. There is also an underground market for vulnerabilities. Cybercriminals pay top dollar for previously undisclosed flaws that they can then exploit to break into computer systems, experts have said.""

Comments

"Will deal only with reputable researchers"

[xmas2003]

From the article: Bugs can be reported to TippingPoint through the Zero Day Initiative Web site. TippingPoint investigates all reports and will deal only with reputable researchers, Endler said. "We need to know exactly who we are working with," he said. "We don't want to work with black hats or illegal groups." The term "black hat" is used to describe criminal hackers.

So I gotta wonder how they are gonna determine who is reputable and who is not ...

Re:"Will deal only with reputable researchers"

[}InFuZeD{]

Well... I imagine if they offer X ammount of dollars per flaw in a certain system and the person asks for more money, then they aren't reputable. If a "researcher" was previously getting no money for the bugs they found, they'd probablytake the little money they can get (I'm guessing TippingPoint won't be giving out a whole lot). If they're actually selling the thing to the highest bidder, I'm guessing TP isn't going to join in the bidding.

Re:"Will deal only with reputable researchers"

[cnettel]

Well, for a start, it could indicate that they won't be making any anonymous payments, or payments through proxies.

Give us your identity, and your bug, we give you the money. Sounds fair.

Good idea

[dmurray14]

Much better way to deal with bugs, I'm surprised no one thought about this before. I guess the real test will be to see how they deal with the bugs they "buy"

Wow

[truckaxle]

I knew 3COM was big, but big enough to buy Microsoft? Wow!

Simple solution

[Sierpinski]

If someone is able to break into your system offer to pay them to keep it secure from others like themselves.

What was the famous counterfeiters name that the FBI hired to spot fakes? He was the basis for the movie 'Catch me if you Can'.

Allow them to use their powers for good, because if you don't, they will continue to use their powers, in whichever direction (good or bad) that they can. The big companies might as well use them as a tool (and pay them) to create/maintain better secured software.

Re:Simple solution

[kfg]

Frank Abagnale was the Kevin Mitnick of his time, and although he was a master counterfeiter his chief skill was in "social engineering."

Brazen, fearless and with a personality to charm the socks right off of you, if he had stuck to cons he might well never have been caught (bad paper leaves a paper trail). Having once caught him keeping him caught proved to be a bit of a problem and on one occasion he simply talked his way out of prison

It isn't listed in his IMDB entry (which he has by virtue of being the author of Catch Me if You Can), but he once made an appearance on The Tonight Show with Johnny Carson and so impressed me that it is one of the few Tonight Show interviews that has always stuck with me.

I haven't read the book, so it may well be the blurb that is at fault, but certain discrepencies between the book blurb at Amazon and things he said in that interview suggest to me that he's never really given up the con game and we'll never know what is the truth and what is the self generated myth about him.

He should have gone into politics.

KFG

Clearing house for bugs Nice idea however

[infonography]

They don't share the info on the exploits. With CERT the bug is known even if crucial details are not. With 3Com, it's a murky secret. According to their own data they will sit on them until they have notified every security company first. Only then will they tell the public putting everybody at risk. Worst yet from a business standpoint they can pay of a exploit only to have somebody else notify the world the next day. That's money lost. Unless they want to go an copyright the exploit they are assed out.

So to summarize

[Rosco P. Coltrane]

3Com gets paid to alert its customers of vulnerabilities in near-real-time. Which means, more vulnerabilities fixed == less $$$ for them over time.

Hmmm, great business model...

DIY funding

[James McGuigan]

How long till someone finds a security flaw in 3com's online payment system and assigns themselves a financial reward for discovering the security flaw.

Obligatory comment

[jurt1235]

If Microsoft would do this, they would go broke (-:

yes, it worked for me...

[scotty777]

20 years ago I wrote a security system, and offered the staff a free lunch if they could find any "undocumented behavior". It's a quick and cheap way to build confidence. I had a couple of takers, but both quit their spiel while they were laying out their case... Seem they didn't RTFM! ; )

Are they building up Intellectual Property

[uid000]

If they "buy" a software vulnerability, and build a signature for it, will somebody else who builds a signature (e.g., snort) for it be violating some IP right like copyright or patent?

Re:Are they building up Intellectual Property

[Anonymous Coward]

The answer is no.

From their FAQ (http://www.zerodayinitiative.com/faq.html):

Why are you giving advance notice of the vulnerability information you've bought to other security vendors, including competitors?

We are sharing with other security vendors in an effort to do the most good with the information we have acquired. We feel we can still maintain a competitive advantage with respect to our customers while facilitating the protection of a customer base larger than our own.

Worse yet

[infonography]

The issue is that if you get paid for finding a flaw, you could get sued for it and there is a nice money trail back to you. 3Com makes no pretense at anonymity or grants any immunity from liablity. While I admit that's not likely, they would sue 3Com first and name you as a co-defendant, your still in it with them. This has happened in the past, I see no reason it's not gonna happen again.

Missing step found!

[SkjeggApe]

Step 1: Create popular, mission critical software that every business will want to install
Step 2: Insert sneaky vulnerabilities
Step 3: Sell bugs to 3COM
Step 4: PROFIT!!!!

No `advanced notice' for open source code?

[shadowspar]

I don't like the sound of this:

What types of security vendors are eligible for the advanced notice?

In order to qualify for advanced notice, the security vendors must be in a position to remediate or provide protection of vulnerabilities with their solution, while not revealing details of the vulnerability itself to customers. The security vendor's product must also be resistant to discovery of the vulnerability through trivial reverse engineering. An example of such a vendor would be an Intrusion Prevention System, Intrusion Detection System, Vulnerability Scanner or Vulnerability Management System vendor.

This clause seems to indicate that no open source projects are going to benefit from this `advanced notification' scheme. Since patches to open source code are, well, open source, they'd be construed as revealing the nature of the vulnerability, and so 3com won't release the vulnerability information. I really don't like the fact that this clause seems to be giving closed-source products and vendors a leg up when it comes to security notifications.