Slashdot Mirror

← Back to Stories (view on slashdot.org)

3Com to Buy Security Flaws?

Posted by Hemos on from the trying-new-models dept.

Zonoprh writes "CNET reports that 3Com's TippingPoint division is starting a pay-for-vulnerability program called the Zero Day Initiative. It seems 3Com plans to use the vulnerabilities they purchase to fuel signatures in their protection technologies, in addition to sharing the same data with other security vendors. From the article, "Money has increasingly become an incentive for hackers. Program's such as TippingPoint's offer a legitimate way for them to get paid for their bug hunting. There is also an underground market for vulnerabilities. Cybercriminals pay top dollar for previously undisclosed flaws that they can then exploit to break into computer systems, experts have said.""

4 of 105 comments (clear)

  1. "Will deal only with reputable researchers" by xmas2003 · · Score: 5, Insightful
    From the article: Bugs can be reported to TippingPoint through the Zero Day Initiative Web site. TippingPoint investigates all reports and will deal only with reputable researchers, Endler said. "We need to know exactly who we are working with," he said. "We don't want to work with black hats or illegal groups." The term "black hat" is used to describe criminal hackers.

    So I gotta wonder how they are gonna determine who is reputable and who is not ...

    --
    Hulk SMASH Celiac Disease
  2. Good idea by dmurray14 · · Score: 5, Interesting

    Much better way to deal with bugs, I'm surprised no one thought about this before. I guess the real test will be to see how they deal with the bugs they "buy"

  3. Clearing house for bugs Nice idea however by infonography · · Score: 5, Insightful

    They don't share the info on the exploits. With CERT the bug is known even if crucial details are not. With 3Com, it's a murky secret. According to their own data they will sit on them until they have notified every security company first. Only then will they tell the public putting everybody at risk. Worst yet from a business standpoint they can pay of a exploit only to have somebody else notify the world the next day. That's money lost. Unless they want to go an copyright the exploit they are assed out.

    --
    Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
  4. DIY funding by James+McGuigan · · Score: 5, Insightful

    How long till someone finds a security flaw in 3com's online payment system and assigns themselves a financial reward for discovering the security flaw.