MS Excel exploit on auction

geo_2677 writes "Someone had put up for auction on eBay the details of an exploit in Microsoft Excel according to a recent article on Securityfocus. According to the article Microsoft has confirmed that this vulnerability exists, but in the meantime the original listing on eBay has been pulled. " The now pulled auction, but it does appear that Microsoft has confirmed the vulnerability in an eweek article.

Comments

More information and a few questions:

[TripMaster Monkey]

First, in the interest of stimulating more informed discusion, here is some more information concerning the auction:

• The actual article on SecurityFocus (not the abbreviated discussion article referenced in TFS).
  
• The full text of the auction, courtesy of the good folks at the OSVDB blog.
  
• The screenie of the actual eBay auction, again courtesy of OSVDB.

From the auction text:

The lot: One 0-day Microsoft Excel Vulnerability

Up for sale is one (1) brand new vulnerability in the Microsoft Excel application. The vulnerability was discovered on December 6th 2005, all the details were submitted to Microsoft, and the reply was received indicating that they may start working on it. It can be assumed that no patch addressing this vulnerability will be available within the next few months. So, since I was unable to find any use for this by-product of Microsoft developers, it is now available for you at the low starting price of $0.01 (a fair value estimation for any Microsoft product).

A percentage of this sale will be contributed to various open-source projects.

Second, two questions:

1. As the seller did in fact report this vulerability to Microsoft first, would his subsequent attempt to call attention to the vulnerability by posting it for auction on eBay be considered 'irresponsible'?
   
2. Exactly which eBay rule did this auction break?

Discuss.

Re:More information and a few questions:

[generic-man]

The seller violated eBay's policy of Don't Fuck With Microsoft.

Re:More information and a few questions:

[Zeinfeld]

As the seller did in fact report this vulerability to Microsoft first, would his subsequent attempt to call attention to the vulnerability by posting it for auction on eBay be considered 'irresponsible'?

No, criminal profiteering. The only type of person who could make use of the information apart from Microsoft is a criminal.

EBay has a right and a duty to stop trade in vulnerabilities same as they have a right and duty to stop trade in any other illegal material.

This is not 'full disclosure', its selling information to the criminals.

Re:More information and a few questions:

[Ph33r th3 g(O)at]

You mean a security researcher or corporate security officer couldn't have used that information? People who believe that the suppression of information is okay because it could be misused are heading down a dark road, the price of return from which will have to be paid in blood someday by a future generation.

Re:More information and a few questions:

[sh00z]

2. Exactly which eBay rule did this auction break?

Probably the restriction on downloadable media, because the seller stated intent to e-mail the file, but did not explicitly state that he is the copyright owner of the electronic file(s) for sale. It seems that M$ would have had a court injunciton to prove criminal intent.

Re:More information and a few questions:

[Anonymous Coward]

rebate for MS was offered, auction-password would be "LINUXRULZ".. talk about adding insult to injury :)

Re:More information and a few questions:

[TripMaster Monkey]

No, criminal profiteering. The only type of person who could make use of the information apart from Microsoft is a criminal.

So you're asserting that a security professional could not use the information to create a patch or fix for this vulnerability?

EBay has a right and a duty to stop trade in vulnerabilities same as they have a right and duty to stop trade in any other illegal material.

I'm having a hard time finding the exact violation on eBay's prohibited and restricted items page. Think you could point it out for me?

Re:More information and a few questions:

[RaymondInFinland]

No, criminal profiteering. The only type of person who could make use of the information apart from Microsoft is a criminal.
What about the system administrator trying to secure his networks? There are plenty of legitimate reasons why someone would want to know exactly what the vulnerability is so they are able to stop people from using it.

EBay has a right and a duty to stop trade in vulnerabilities same as they have a right and duty to stop trade in any other illegal material.
So vulnerabilities are now illegal material? Better call the cops and the feds to shut down Microsoft because they seem to be producing a lot of them.

This is not 'full disclosure', its selling information to the criminals.
Wouldn't that depend of the person who would have won the auction? See also point 1).

Re:More information and a few questions:

[Orgazmus]

Hopefully this one. It will be a good lession in not shitting in your own nest.
Let the revolution begin, i say.

Re:More information and a few questions:

[radja]

anyone who has excel can use this knowledge to make a choice: do I continue to use excel, or do I use something else? the guy did nothing criminal.

Re:More information and a few questions:

[krgallagher]

"This is not 'full disclosure', its selling information to the criminals."

Cosidering that the opening bid was set at $0.01, I doubt he really expected to profit. Instead he probably just wanted to call public attention to the exploit and force Microsoft to address it quickly.

Re:More information and a few questions:

[timeOday]

Exactly which eBay rule did this auction break?

I guess Ebay rules are just like actual laws: it doesn't really matter whether you actually broke one; there are so many laws, some very vague, that almost anything can fall under one law or another with a bit of rationalization. Just look at the Constitution, today's federal govt. is completely different from that of 1788, even though the federal govt. is supposedly established by the Constitution which has hardly changed at all.

Re:More information and a few questions:

[jcr]

The only type of person who could make use of the information apart from Microsoft is a criminal.

On what do you base this assertion?

-jcr

Re:More information and a few questions:

[Anonymous Coward]

Special offers:

Microsoft representatives get 10% off the final price. To qualify, you MUST provide @microsoft.com e-mail address and MUST mention discount code LINUXRULZ during checkout.

coo.

Re:More information and a few questions:

[apparently]

The only type of person who could make use of the information apart from Microsoft is a criminal. Yes, an anti-virus, IDS, or other vendor could not at all use this information to create a definition package capable of preventing the exploitation of this patch. You sir, are a tool.

Re:More information and a few questions:

[AaronCampbell]

After reading the full text of the article from the parent's link, a couple things stick out to me. First, he provides 2 excel files, one which he admits causes the exception to occur, but he says does NOT do anything malicious. Do you really trust him?

Secondly, he seems to be unable to count. He says you can claim to be "THE ONLY ONE IN THE WORLD possessing the knowledge about the vulnerability." He says Microsoft (whom he told) doesn't count. Seems to me that still leaves him and the buyer. I was always taught that 1+1=2

Just food for thought.

Re:More information and a few questions:

[ultranova]

No, criminal profiteering. The only type of person who could make use of the information apart from Microsoft is a criminal.

Criminals, yes, and everyone who is considering which program to use, as well as anyone who uses Excel - after all, knowing an exploit might help one avoid situations where one might be vulnerable.

EBay has a right and a duty to stop trade in vulnerabilities same as they have a right and duty to stop trade in any other illegal material.

If information about vulnerabilities is illegal, then Slashdot became quilty by posting this story.

This is not 'full disclosure', its selling information to the criminals.

Or anyone else who might benefit from knowing Excels vulnerabilities, including at least its users, administrators and people who decide whether to use Excel or some other program.

Re:More information and a few questions:

[onedotzero]

Actually, a great many auctions start at the minimum in any given currency. One of eBay's listing fees is a proportion of the starting bid.

Re:More information and a few questions:

[skarphace]

The eBay seller ID was fearwall so for the hell of it I checked out http://www.fearwall.com/ and of course the first words were "Linux Rulez!!"(same as in the eBay auction body). There's a photo of the kid too!

He has also recently changed his ebay ID to smk778.

Re:More information and a few questions:

[Xerp]

$0.01? A bit of an over-estimation, surely?

Re:More information and a few questions:

[Anonymous Coward]

"A percentage of this sale will be contributed to various open-source projects."

Oblig. Simpsons quote:

Newspaper editor: And to protect Mother Earth, each copy contains a certain percentage of recycled paper.
Lisa: And what percent is that?
Newspaper editor: Zero. Zero's a percent!

Re:More information and a few questions:

[rbochan]

No, criminal profiteering. The only type of person who could make use of the information apart from Microsoft is a criminal...

Bullshit.
To paraphrase one of the full-disclose list participants...
It's ok for cert to sell 0-days or idefense to buy 0-days and sell info to clients? Because that's whay they do, but that's ok?

EBay has a right and a duty to stop trade in vulnerabilities same as they have a right and duty to stop trade in any other illegal material...

Just what, exactly, is this alleged "illegal material" you're referring to?

Re:More information and a few questions:

[Fayth]

The -selling- of vulnerabilities in software is criminal activity any way you shake it. This kind of information should be posted in the right place.

Why should an admin have to -pay- for the information? ...sounds kinda like blackmail in a sense. O_o

I assume the guy was actually selling the info on how to exploit, therefore putting valid users and companies at risk....hmm...kinda sounds a tad bit little illegal to me...

So yes, eBay did the right thing here, imo.

Re:More information and a few questions:

[DaFallus]

How is this any different from LEGALY being able to buy books that tell you step for step how to convert semi-automatic pistols and rifles into fully automatic, or how to build a silencer?

Re:More information and a few questions:

[anonymous22]

He's not transfering the program itself, only information on how to use it. So technically speaking, the copyright for the file he would have emailed is his.

Re:More information and a few questions:

[Anonymous Coward]

Things are not "criminal" or "illegal" because you don't like them, nor because you've decided they ought to be. They are so by virtue of specific laws. Point out what specific laws this auction would violate or shut the hell up.

Re:More information and a few questions:

[Anonymous Coward]

Come on, vulerabilities coming from Microsoft are a dime a dozen. $0.10 / 12 is less than $0.01, so he was actually starting the bidding high.

Re:More information and a few questions:

[quanticle]

If he wanted to bring attention to this vulnerability, why didn't he post details on a public forum (e.g. bugtraq)? If he'd already notified Microsoft, why the secrecy?

Re:More information and a few questions:

[Fordiman]

1) Actually, not irresponsible at all. It was BRILLIANT. Look at how quickly Microsoft responded when they found out the amount of interest (as in actual dollars) in the exploit! Meanwhile, it opens up a new concept: error markets. Call it an economic model of closed-source debugging. Those who ferret out and learn an exploit for a piece of software put it on an open market.

The software companies responsible compete at the small-fee level with various others to determine how much that error has cost them (determined by the market's demand for the exploit, rather than the potential damage it could do). The exploit's posting, say a minimum of seven days, is enough notice to demand a company do something about it. If they're too apathetic to pay something like $100 for a serious risk, they face the consequences of their inaction - as the buyer would likely place it in the public domain, use it surreptitiously (say, as spyware), etc. Give a mandatory final-price discount to the owner of the affected software, and you're set.

Meanwhile, it gives a very good incentive for the less-scrupled end of the hacker community to be responsible - as there is a reward for their trouble.

I think it's brilliant, seriously.

Re:More information and a few questions:

[Fordiman]

Or moreover, you mean a 'legitimate' spyware, adware, or other intrusive software company coundn't use something like this?

I mean, those such companies haven't been shut down yet, how illigitimate could they be?

Re:More information and a few questions:

[Anonymous Coward]

Actually, illegal or not, its irrelevant, there is no freedom of speech on a private company's website, they could choose to ban all David Hasselhoff related merchandise or paraphernalia, they could choose to ban bibles, they could choose to ban computers running Linux and computers sold without an operating system (for Linux)

It's 100 percent up to the company, don't like it? Don't shop there.

Re:More information and a few questions:

[Anonymous Coward]

As the seller did in fact report this vulerability to Microsoft first, would his subsequent attempt to call attention to the vulnerability by posting it for auction on eBay be considered 'irresponsible'?

With that silly mindset... a bank vault mysteriously explodes and leaves its contents exposed to the public for the taking. So long as the police are notified first, is it okay to begin looting it?

Re:More information and a few questions:

[StikyPad]

Think you could point it out for me?

Sure, right here.: "Without limiting other remedies, we may limit, suspend, or terminate our service and user accounts, prohibit access to our website, remove hosted content, and take technical and legal steps to keep users off the Site if we think that they are creating problems, possible legal liabilities, or acting inconsistently with the letter or spirit of our policies."

And right here: "eBay alone will exercise its judgment in deciding which listings are not permissible."

Re:More information and a few questions:

[Alsee]

The -selling- of vulnerabilities in software is criminal activity any way you shake it.

Ah yes, and a reporter who writes an exposè on rotten airport security and SELLS it to the New York Times is criminal activity any way you shake it.

You have a a bizzare definition of "criminal" and "illegal", and you have no grasp of law. The law does NOT equal "I don't like it".

By the way, if anyone wants to make Nitroglycerine here's how...
Ingredients:
Glycerine
Concentrated sulphuric acid
Concentrated nitric acid

Glycerine can be bought off the shelf at your local drugstore. Sulphuric acid is better known as car battery acid, though you would need to distill ordinary car batter acid to higher concentration. Nicrtic acid is a bit harder to come across, but it's not that hard to make. Nitric acid is the primary component of ordinary acid rain.

Simply mix the three ingredients VERY SLOWLY, over an ICE BATH.
Waring - this reaction produces heat. Hot nitroglycerine is very very bad. It tends to go BOOM. Mix it as slowly as possible, and keep it as ice-cold as possible.

After mixing, and assuming you haven't killed yourself in the process, there will be an oily brown liquid floating on top. This oily brown liquid is nitroglycerine.

Undoubtedly you think that I should not have posed that information. *YOU* apparantly think that was illegal, and that I am a criminal for doing so. And you'd apparently also think it illegal for me to SELL that recipe on e-Bay.

However You Are Wrong.
In fact (assuming we are discussing American law) it would be UNCONSTITUTIONAL for you to attempt to create a law against it. I invite you to read this Unityed Stated Department of Justice report to the Senate. The Senate asked for a report on the constitutionality and limits of their ability to create a law restriction bomb making information. The DOJ explain that such a law would be a violation of the First Amendment. That publishing such information CANNOT be illegal in the US. The limits of what can be criminalized is basically (1) acting with EXPLICIT INTENT to cause a crime to occurr, or (2) aiding and abbetting someone with EXPLICIT KNOWLEDGE that you are aiding and abbetting a crime.

I assume the guy was actually selling the info on how to exploit, therefore putting valid users and companies at risk....hmm...kinda sounds a tad bit little illegal to me

I just published nitroglycerine making information. It is, in your words, "therefore putting valid users and companies at risk". It is not illegal and CANNOT be illegal in the US. I have no intent for anyone to commit a crime with that information. No one has asked me to supply it to them for the purpose of committing a crime.

Why should an admin have to -pay- for the information? ...sounds kinda like blackmail in a sense.

Blackmail is when you THREATEN someone.

If I created a copyrighted work, one that happens to teach this information, you certainly cannot require me to give it to anyone for free. I have every right to remain silent and tell no one. If somebody wants me to teach them this information, then I can every right to ask for money before I sell them a copy of the instructional text I created.

One would presume that Microsoft will... sooner or later... publish this information itself. If you want to wait for that then you can get the information free then. How about you bitch at Microsoft for not giving anyone this info for free now?

If you want this info now, and if Microsoft refuses to give it to you, this guy is offering to give you a copy now. You apparently want this info. You apparently consider it valuable. If you want this guy to do work and send it to you then you have the choice of paying for it. Or not.

So yes, eBay did the right thing here, imo.

If you mean in terms of avoiding the hassle and expense of

Re:More information and a few questions:

[Anonymous Coward]

In case you hadn't noticed, posting it on e-Bay has generated at least a hundred times as much attention as posting it on bugtraq.

If that was the intent then it has worked brilliantly.

Re:More information and a few questions:

[StikyPad]

Except those issues are completely devoid of relevance. This isn't the Supreme Court deciding whether the auction should be legal because of "substantial noninfringing uses." This is solely an incident of a private entity deciding not to do business with another private entity. eBay is entitled to deny any listing for any reason it chooses, and the only measure of whether that decision was right or wrong is whether or not it protects eBay's interests. The only justification they need is that they didn't like the listing, and the only possible repercussions are the possible alienation of the massive vulnerability-purchasing demographic.

On the other hand, they could have let the listing stand and exposed themselves to possible private or public legal action, tarnished their public image, and further encouraged people to test the proverbial waters with equally or exceedingly unconventional listings.

But the good news, if you believe that eBay is eschewing a substantial opportunity, is that you have the chance to step in and serve the exploding market for software vulnerabilities by creating your own auction site. Maybe you'll get rich, or maybe you'll get sued so hard by Microsoft that you can't walk straight for weeks.. there's only one way to find out!

What was the grounds for pulling the auction?

[Ph33r th3 g(O)at]

eBay is infested with public domain repackagers and sellers of "information" that they seem to do nothing about. But if Microsoft doesn't like an auction, it's gone, apparently.

Re:What was the grounds for pulling the auction?

[umeboshi]

They've done this for microsoft before when people were selling windows cd's. This was about five years ago.

Re:What was the grounds for pulling the auction?

[mrRay720]

----
eBay is infested with public domain repackagers and sellers of "information" that they seem to do nothing about. But if Microsoft doesn't like an auction, it's gone, apparently
----

I don't see anything wrong in charging a nominal fee for redistributing public domain work. It's not as if it's not still free somewhere else, it just saves you the effort of going out and rounding it up yourself. In a world of 'money first', allowing this can only help that little bit extra to keep said work alive. How is this different to the books of Dickens still being printed and charged for? The words themselves are free now, but you're paying for them to be wrapped up in a little paper package for you.

Anyone spending money on an auction for info on how to get a 'free ipod' deserves to get ripped off.

Quite how either of those are like someone trying to make a profit from selling info of a vulnerability potentionally harming millions to a virus writer is beyond me though.

One is making a bit of money (indirectly) helping to keep public domain work alive, the other is trying to profit from the harm of others.

Re:What was the grounds for pulling the auction?

[boarder8925]

But if Microsoft doesn't like an auction, it's gone, apparently.

Maybe it has something to do with this?

Re:What was the grounds for pulling the auction?

[Ph33r th3 g(O)at]

Repackaging public domain stuff is fine, but misrepresenting it and claiming copyright on it is not, which is what the vast majority of "information brokers" on eBay are doing. In the case of this and your "free iPod" example, sure, only the less-than-bright get hooked, but that's no reason for eBay to facilitate this by not policing its site.

Re:What was the grounds for pulling the auction?

[ultranova]

Anyone spending money on an auction for info on how to get a 'free ipod' deserves to get ripped off.

No they don't. The naive and/or stupid don't deserve to get ripped off any more than old people deserve to get their hipbones broken, or people who don't do martial arts deserve to get beaten up by muggers. These all happen, but they are not right, just nor the way things should be. That someone is weak is not sufficient justification for others to prey on him.

I really hate this callous attitude of "If someone can't protect themselves, they deserve to have bad things happen to them, especially if it helps someone else to line their pockets". Especially since the people saying so are the first ones to complain when a bigger bastard, be it government or big business, makes them the ones who get ripped off.

I guess it is fashionable today to preach about "personal responsibility" and pervert that to mean an attitude of utter pitilessness towards other human beings. Notice how these people are talking about others personal responsibility as an excuse for their heartlessness. They demand that their property is protected by law, but when that same law is used to provide food and shelter to other human beings - indeed, as soon as they are not the ones getting the benefits - these people start to loudly complain about "nanny state", "communism" or other similar things.

Sorry for the offtopic rant, but I'm just so sick of this nonsense.

Re:What was the grounds for pulling the auction?

[mabu]

I love how Microsoft characterizes scenarios where companies use their products as "evidence", as if it seems crminal. How apropos.

Re:What was the grounds for pulling the auction?

[don_bear_wilkinson]

I'm sick of it too.

Most people function within a similar social hierarchy to that which you see in chimpanzees or bonobos. They are bullies to smaller monkeys and victims of the bigger ones.

I personally wish that there was a way for Karma or some other Just power to not only turn the tables on these kinds of asswipes, but to TELL them that their current suffering is a direct consequence of their former lapses in humanity.

They say "what goes around comes around". But, without someone telling you that your current woes are payback for being an asshole, most assholes will simply take their displeasure and use it to fuel yet more ugliness.

Makes me sad and angry.

Re:What was the grounds for pulling the auction?

[Just Some Guy]

They demand that their property is protected by law, but when that same law is used to provide food and shelter to other human beings - indeed, as soon as they are not the ones getting the benefits - these people start to loudly complain about "nanny state", "communism" or other similar things.

I agree with much of what you say, but I think that you chose a bad example above. In the first case, those people are happy that the government is "allowing" them to use their property as they see fit. In the second case, they're angry that the government is taking their property (in the form of taxes) and not allowing them to use it at their will. Even if you disagree with their opinion, those seem to be consistent positions.

Heh...

[the_skywise]

Now THAT'S capitalism!

(Or at least a good demonstration of Ferengi behavior...)

Re:Heh...

[Oliver Wendell Jones]

Ferengi rule of aquisition #193:
If you're not a part of the solution, there's good money to be made in prolonging the problem.

Re:Heh...

[Hokkage]

Rule if acquisition ___
A friend in need is worth three times as much.

Re:Heh...

[rwise2112]

Actually that's from the consulting de-motivator from http://despair.com/viewall.html

Heh

[voice_of_all_reason]

Can't think of a better way to get people to learn about/abuse an exploit than to draw massive attention to it by yanking the auction. Way to go, ebay!

Re:Heh

[borawjm]

I'm sure the bias on /. doesn't help either.

Re:Heh

[sbrown123]

Your right. We should just cover these things up like stinky poo and ignore that they exist. That will make them go away!

Re:Old News

[Anonymous Coward]

so you're the seller?

You can buy anything on Ebay

[ATeamMrT]

Someone had put up for auction on eBay the details of an exploit in Microsoft Excel

I'll buy that one as soon as I buy the product which tells me how to remove all spyware by formatting my hard drive. It's only $7.95, and he sends the PDF file as soon as payment is recieved. Now if only I knew how to open a PDF file. :(

Maybe I'll search ebay, and someone can sell me a product which tells me how to open a PDF file. :) :)

But first, I need to bid on this guy who claims he can teach me how to get Plasma TV's for free from the manufacturers. He says in his ebay auction that manufacturers don't have enough people to test their product and they want me to help them!

Ebay is more good than bad, but how can these people sell garbage?

If the guy is selling information on how to exploit software, doesn't that violate the DCMA?

I guess I should not complain. Ebay is the only place I know of that has everything, the worlds largest flea market.

Re:You can buy anything on Ebay

[xoip]

Ebay is more good than bad, but how can these people sell garbage?
One man's Garbage is Anothers Gold.

Re:You can buy anything on Ebay

[Anonymous Coward]

If the guy is selling information on how to exploit software, doesn't that violate the DCMA?

I don't know, what's the DCMA?

Re:You can buy anything on Ebay

[eldavojohn]

Ebay is the only place I know of that has everything, the worlds largest flea market.

You know, you're right. But I remember when I was a wee little nooblet, a lil' bastard at the computer (maybe 15 years old) and I would find endless amounts of entertainment at the number of channels on mIRC.

And some of these channels would have "hackorz" and/or "warez" in the titles. Now, I'm not sure what the 'z' meant but they sure the hell were interesting channels.

A particular channel, you could go in and say something like "www.englishstrumpets.com $5, paypal." And a few minutes later, someone with ops would say "englishstrumpets cracked, i_am_a_hackor@hotmail.com" and you would pay the five dollars to his paypal account and he would private message you the info to get into the site. Seeing as I didn't have a credit card, paypal account or any money, all I would do is list impossible sites to hack until I was booted. Ahhh, the days of little lil' bastardry, how I miss them.

Anyways, this article reminded me of those forgotten channels.

Re:You can buy anything on Ebay

[Anonymous Coward]

If the guy is selling information on how to exploit software, doesn't that violate the DCMA?

I rather doubt that the exploit circumvents anything that could be described as a copyright protection mechanism. That's what the DMCA's anti-circumvention language is about.

Re:You can buy anything on Ebay

[Anonymous Coward]

The Digital Millenium Copyright Act, of course. It's French, hence Digitale Copitarrif du Millenie Act.

Re:You can buy anything on Ebay

[IIH]

Including a picture of an XBox 360, sold for the princly sum of £470, according to an article in the register.

Re:You can buy anything on Ebay

[Robmonster]

I did wonder why you were so interested in trumpets until I re-read your message.

Re:You can buy anything on Ebay

[MrNougat]

Ebay is the only place I know of that has everything, the worlds largest flea market.

If you go to a flea market, you're bound to run into some fleas.

Re:You can buy anything on Ebay

[smoker2]

including a picture of an XBox 360

get them while they're hot !

sorry

Poking fun?

[omeg]

The seller openly taunts the software giant, poking fun at the company's delays in providing fixes for known security bugs. "It can be assumed that no patch addressing this vulnerability will be available within the next few months. So, since I was unable to find any use for this by-product of Microsoft developers, it is now available for you at the low starting price of $0.01 (a fair value estimation for any Microsoft product),"

Wait, so this is all just a taunt and not true?

Bad auction

[mrRay720]

Looking at the motivation this guy has, I can't really see how it can be good.

So, it was submitted to Microsoft on the 6th, and since then he's recieved a reply stating they'll probably be working on a fix. That was LESS THAN A WEEK AGO. Releasing vulnerabilities is something that, IMO, should only be done if (a) there is some specific need for everyone to know about it right now, or (b) requests for fixes have fallen on deaf ears or otherwise failed for an extended period of time.
This meets neither of those criteria.

- looking to make a profit from releasing details of a vulterability
- phrasing the auction in a way that makes it clear he wants the buyer to do something bad - "It can be assumed that no patch addressing this vulnerability will be available within the next few months"

Sounds to me more like some dumb little script kiddy that got lucky finding a small hole, but doesn't have the ability to do anything with it. Working from an illogical hatred of MS he's trying to get someone else to unleash a virus on the world on his behalf.

What a great guy.

Re:Bad auction

[Billosaur]

Just as with auctions of body parts and stolen merchandise, eBay reserves the right to pull any auction that it deems is against the best interests of eBay and the community it serves. It's like "at-will" hiring; if they think there's a liability involved (and when it come to Microsoft, how could there be any doubt BG is on the phone to his lawyers) they'll yank it. They also have a habit of reporting these things to the authorities, so the script kiddie involved may get a knock on the door from the FBI. Merry Christmas!

Re:Bad auction

[timeOday]

Looking at the motivation this guy has, I can't really see how it can be good.

What? Are you implying that greed is not always good? It's elementary Econ. 101: he has the supply, and spammers have the demand. Were he not to unleash this vulnerability on all of us, he'd be violating his sacred fiduciary responsibility to maximize shareholder value. Besides, he and the buyer are both consenting adults, what right do we have to interfere with their freedom? Don't you think the invisible hand will solve this issue for us?

Re:Bad auction

[fufinache]

I think the the seller was trying to get microsoft's patch team into 2nd gear. It sounds like he just thought that making a bit of money out of it would be a side effect for him (look at the original posting price, 1 cent is hardly any profit).

Releasing vulnerabilities is something that, IMO, should only be done if (a) there is some specific need for everyone to know about it right now, or (b) requests for fixes have fallen on deaf ears or otherwise failed for an extended period of time.

Does that mean that if most of the parents in the world (say 80%) never used curse words, that their children will never swear? As long the remaining 20% parents are swearing, all the kids will eventually learn. I can think of 2 ways of solving such problem, either you fix the root of the problem (not the messenger) or you educate others on problem and how they can avoid it themselves.

That was LESS THAN A WEEK AGO

It's called responsibility, it comes with life, tasks that are seemingly impossible with very tight deadlines will pop up, and you will have to do them. Stop complaining and get back to work.

I believe what he's done is rather smart; microsoft had a week to fix the hole (which is what they should be doing) + they could always bid on the auction themselves to keep the seller's mouth shut if they need the more time and hire more employees.

Re:Bad auction

[nolife]

A lot of people and companies make money off of others security problems. Those same people and companies also have detailed exploit/hole/workings for many unpatched problems and poor work practices.

I am going to go against the /. group think here but anyway..
Put down a script kiddie if it makes you feel better about yourself but an exploit is an expliot regardless of a persons hacking/cracking backgroud or reputation. Your company or the equipment your are responsible for maintaining will suffer equal damage from a script kiddie or an experienced hacker with malicious intentions, regardless of your opinion of the person. Try telling your boss, yes, I know our mail servers were owned but it was done by a teenage script kiddie with a 0-day. Do you think that will make a difference in the outcome or your work required to recover? Bottom line, the person may have information that would be valuable to someone.

Re:Bad auction

[SanityInAnarchy]

So, it was submitted to Microsoft on the 6th, and since then he's recieved a reply stating they'll probably be working on a fix. That was LESS THAN A WEEK AGO.

So? The open-source world fixes vulnerabilities in one or two days. Where's the patch for Excel?

Microsoft has more money, developers, and R&D facilities than I care to count. They have several orders of magnitude more than it would take to fix these vulnerabilities quickly. They choose not to.

(b) requests for fixes have fallen on deaf ears or otherwise failed for an extended period of time.

For a company of this size, anything less than a fix the same day is irresponsible, yet they often wait months before even acknowledging that a problem exists. An "extended period of time" for Microsoft is saying "We'll work on it. Maybe. If we feel like it." and then doing nothing for two or three days.

Is my hatred of MS so illogical?

Re:Bad auction

[Matt_Joyce]

Don't assume he was targetting nefarious hackers.
That advert would work quite well if selling the info to a software vendor looking to make money selling protection from it.

Who is the bigger sucker here?

[digitaldc]

Who is the bigger sucker?

The people who bid on an exploit to make Excel crash? Or those who believed that this was a critical security flaw? Or Ebay for posting it in the first place?

If you really want to know how to make Excel crash, pick your poison - here is a free link:
http://search.microsoft.com/search/results.aspx?st =b&na=88&View=en-us&qu=excel+crash

Re:Who is the bigger sucker here?

[porkThreeWays]

The bug is believe to be a buffer overflow. This makes it a perfect canidate to execute malicious code within excel. Imagine being able to send an excel file to another company you don't think is being truthful with you and r00ting some of their boxen. You could pretty much spy on them all day without antivirus or antispyware picking you up. Imagine sending the excel file to a game developer and stealing source code for an upcoming game *hint* *hint*. 0-day exploits and unknown exploits are a serious problem because most companies think they are safe with anti-virus. Anti-virus supplies little/no protection against these kinds of attacks.

Re:Who is the bigger sucker here?

[Anonymous Coward]

Gee, I just thought he was selling the magic cookie to unlock the Excel 2000 Spy Hunter game easter egg.

Re:Who is the bigger sucker here?

[ultranova]

Imagine sending the excel file to a game developer and stealing source code for an upcoming game *hint* *hint*.

Why would a game development firm have the programmers open incoming e-mail ? They are busy enough trying to get the game out before christmas. PR department opens the e-mail - you just can't trust the developers to think of PR when responding to some flamebait letter after an all-nighter. And why, oh why would the programmer have Excel on the development machine ?

Re:Who is the bigger sucker here?

[Anonymous Coward]

Who is the bigger sucker?

The people who bid on an exploit to make Excel crash? Or those who believed that this was a critical security flaw? Or Ebay for posting it in the first place?

It is certainly possible that the bug can be exploited to allow code execution, not just to make crash Excel. Either you have specific details about the bug to back up your assertion that it can only make Excel crash, or you are talking out of your uneducated ass.

Re:Who is the bigger sucker here?

[ymgve]

Why would a game development firm have the programmers open incoming e-mail ? They are busy enough trying to get the game out before christmas. PR department opens the e-mail - you just can't trust the developers to think of PR when responding to some flamebait letter after an all-nighter. And why, oh why would the programmer have Excel on the development machine ?

Why don't you ask Valve those questions?

Censorship?

[canuck57]

...meantime the original listing on eBay has been pulled.

Why should not one be able to sell a vulnerability since they are in fact commodities?

If you can profit from making them, profit from dealing with them then why not profit by discovering them? There are precidents like this, the patent system has companies that hold patents for no other reason than to sue other companies when they trip on a patent.

All this will do is force the practice underground. Mind you, it does let the world know it is going on.

Re:Censorship?

[lowid (24) _________]

Replace "a vulnerability" with "drugs."

Re:Censorship?

[Stoopid-Guy0]

Why should not one be able to sell a life since they are in fact commodities?

If you can profit from working for them, profit from healing them, then why not profit by killing them? There are precidents like this, the patent system has companies that hold patents for no other reason than detecting when someone is dead.

All this will do is force the practice underground. Mind you, it does let the world know it is going on.

Re:Censorship?

[DynamicPhil]

Hm, doen't this depend on *who* you are selling the vulnerability to?

I mean, if you "sell" it to the company involved, then maybe it would be ok, but in selling it to random spammer , columbian druglord, phedophile network BOFH or next "slammer worm" author is not ok.

Re:Censorship?

[Trolling4Columbine]

"All this will do is force the practice underground."

Because purveyors of viruses, spyware, and worms currently prefer to operate out in the open.

Re:Censorship?

[CmdrGravy]

But they're not drugs so what sense would that make ?

Re:Censorship?

[jotok]

...because his basic argument is that everything is a commodity, and all commodities can and should be bought and sold, case closed. The replying poster was pointing out that the assumptions of the argument were not valid in some cases (drugs), therefore the conclusions were also not universally valid.

It's called logic. Your library has books on the topic.

Re:Censorship?

[xtieburn]

You give your post the name Censorship. This is nothing of the sort. Censorship would be if MS sued or threatened the guy if he posted the vulnerability on a web site. If he just put the information online to read somewhere that would be fine. Kind of like telling everyone how you can break in to a house so you can better secure your house from burglers.

He didnt, he's profiteering from a weakness in someones defences not fighting for freedom of speech. Sticking with the analogy this is no different to somebody trying to sell someone elses lost house keys to criminals before they can get the locks changed.

It wouldnt bother me so much but people use anti-censorship as some all powerful law that can be used to dismiss even the most immoral of acts. (Just look at the media.)

I dont agree with sharing bugs within software with anyone but the people who made it, but if someone wants to make the information freely available because they believe it will make MS improve there standards or some such then fair enough. This case, however, clearly has nothing to do with information and everything to do with abuse of what very little power this ebayer managed to dredge up for himself.

Re:Censorship?

[CmdrGravy]

His argument was that vulnerabilities are commodities which can be bought and sold freely.

Drugs are commodities which cannot always be bought and sold freely because with some of them it is illegal to do this. I don't think it's illegal to sell information about vulnerabilities in software.

The grandparent was trying to say that the selling of vulnerabilities is illegal, which it isn't.

Re:Censorship?

[jotok]

I dunno. I think you're assuming what you're trying to prove and that the criticism was valid. Just because information about a vulnerability is more available than drugs, it doesn't follow that it's not illegal to sell that information. Incidentally I'm not aware of any law, either, that would prohibit their sale. I'm only commenting on the previous post.

Re:Censorship?

[canuck57]

You give your post the name Censorship. This is nothing of the sort. Censorship would be if MS sued or threatened the guy if he posted the vulnerability on a web site.

http://en.wikipedia.org/wiki/Censorship

It does look to me to be suppression of ideas. There isn't a law forbidding the sale of the knowledge about vulnerability and all sorts of different stuff is sold on eBay.

He didnt, he's profiteering from a weakness in someones defences not fighting for freedom of speech. Sticking with the analogy this is no different to somebody trying to sell someone elses lost house keys to criminals before they can get the locks changed.

People sell and profit from cars, bullets, drugs, F18's, cruise missiles and knives. Even though if you are facing the criminal use of one of these tools we do not prosecute the seller when the sale is open and not illegal to do so. Nor should we prosecute those who would sell the vulnerabilities to legitimate parties. If sold to known criminals it could be called conspiracy. But if McAfee, Trend or Sophros buys it to get the leg up then it is free eneterprise.

There is also the factor of due diligence and effort on the seller of software today, Microsoft is not as much the victim as one might suspect. More is spent on marketing security than actually practicing it and it shows. This isn't just Microsoft, hundreds of products (UNIX too) have security problems in them 2500 miles wide and 1 light year deep. Few are really doing much about it. I know of vendors that have known of problems for 3 years and done squat to fix it.

Maybe this, like nature is a check. Maybe companies need to be objectively white-hacked to effectively get their security up to par. And the white-hacker needs to eat and so far the software vendors are generally poor at doing this. So why can they not sell this?

It wouldn't bother me so much but people use anti-censorship as some all powerful law that can be used to dismiss even the most immoral of acts. (Just look at the media.)

While it is true freedom of expression and anti-censorship has its perceived drawbacks when you don't agree with others behaviors, by not letting the freedom occur is opening the door for abuse of freedom itself. There will be those that choose illicit use of freedom, but by them being free we are also free from their ability to impose their views on us. God even gives us this as a choice.

What isn't a choice is going to Best Buy or Circuit City and buyig a computer with a more secure OS (at prices mortals can afford) without paying a M$ tax. That is enough freedom erosion for me thanks.

Re:Censorship?

[Anonymous Coward]

Hm, doen't this depend on *who* you are selling the vulnerability to?

I mean, if you "sell" it to the company involved, then maybe it would be ok, but in selling it to random spammer , columbian druglord, phedophile network BOFH or next "slammer worm" author is not ok.

Yep, just like stingers, F16's, cars, boats, kitchen knives, firearms, ammunition, gasoline, deisel fuel (w. nitrates), heroin, pot, morphine, zanex, (lets just include the drug store), anthrax and more.

It all depends on how it was aquired (taxes paid), how it was distributed (licensed) and who is buying it for what purpose (not regulated incase a polician wants it).

Pricing?

[DynamicPhil]

Actually, a much more intresting dussion is the:

How would you go about setting the price of a security hole? What is the worth?

"By monetary value of what could be lost exploiting the hole", or something else? Estimation of possible gains (user data like credit card info) through usage of the hole - the perpetrators view?

Because, lets face it: There are people out there willing to pay for information like this.
(and I'm not saying its right - just stating the fact). There are also others wondering how some things come to pass, and the damage bad code review actually causes.

ok, sorry - possibly OT. But I *am* intrested in /. ers reasoning about "the value/possible cost of security holes".

Re:Pricing?

[m50d]

Estimation of possible gains (user data like credit card info) through usage of the hole - the perpetrators view?

That's what I'd say it's worth (minus the cost of exploiting of course), since it's the perpetrator who'll be paying for it. It doesn't matter if it costs someone else a lot more than you make - consider how you price say property development rights, not by how much value the houses nearby lose but by how much you can sell what you build for.

Re:Pricing?

[Anonymous Coward]

It's worth exactly what someone is willing to pay, no more, no less. Auctions tend to be a good way of determining value.

Re:Pricing?

[Anonymous Coward]

Two academic papers argue that markets/auctions for vulnerabilities provide a logical and useful way of measuring the security of a software product.

"Bug Auctions: Vulnerability Markets Reconsidered." Andy Ozment, 2004 [pdf]

"How to Buy Better Testing: using competition to get the most security and robustness for your dollar" Stuart E. Schechter, 2002 [pdf]

slashdottet?

[legalize.ganja.now.]

hmmm. it seems like the server is running excel...
hereis another article covering this...

Re:slashdottet?

[CmdrGravy]

Er no, Excel is a spreadsheet application and a part of Microsofts Office Productivity suite and is not used for running an Internet Server.

If you bothered to read Microsofts own guidelines you would see that IIS is the one you need to host the internet, it is also an excellent choice for 'intranets' ( they are like the internet but for companies to tell their staff how many new yachts the sales team have bought and advise on whether the current economic climate will allow the the on-going pay freeze to finally thaw )

Re:slashdottet?

[Anonymous Coward]

'scuse me, I'm offtopic here, but I think your sage advise is somewhat wasted on a guy named 'legalize.ganja.now'.
Even just a quick glance at the subject line would show that he's in the middle of some 'research'...

Re:slashdottet?

[legalize.ganja.now.]

IIS as an intranet server? i don't think that would be such a good idea. but IIS as an internet server? you can't be serious! even excel would be a better choice, i guess...

Re:slashdottet?

[legalize.ganja.now.]

c'mon - don't be that pedantic! dotted, dottet, does that really matter?
DOWN WITH THE CONVENTIONS! :-)

Microsoft cannot handle the competition

[erroneus]

People are already paying for vulnerabilities in Microsoft software. They get them as part of the purchase of software licenses. (Now, having actual KNOWLEDGE of such vulnerabilities is another matter I suppose...)

Fire under microsoft

[muindaur]

I dont think it was very irresponsible, maybe only a little, it just lights that fire under Microsoft to fix it. Considering my lack of using unkown excel files I'm not too worried about it. Like some other posts say, it brought much less attention to the exploit than e-bay pulling it did.

Re:Fire under microsoft

[penguinoid]

I think the point is that MS would rather a very big noise about pulling this from ebay, than for ebay to become the standard place to sell MS vulnerabilities. I don't see why, though, as I'm pretty sure it would be much easier to track the person down if the vulnerability was exploited than if they did it in some obscure corner of the internet.

I'll save ya tha money...

[FlopEJoe]

The exploit is: Press Alt-F4, click the "No" button if it asks if you want to save. Dude... everything they had in the sheet will be gone!!! Is that 133t or what?

obAlphaCentauriQuote

[meringuoid]

People who believe that the suppression of information is okay because it could be misused are heading down a dark road, the price of return from which will have to be paid in blood someday by a future generation.

"As the Americans learned so painfully in Earth's final century, free flow of information is the only safeguard against tyranny. The once-chained people whose leaders at last lose their grip on information flow will soon burst with freedom and vitality, but the free nation gradually constricting its grip on public discourse has begun its rapid slide into despotism. Beware of he who would deny you access to information, for in his heart he dreams himself your master."

-- Commissioner Pravin Lal

Re:obAlphaCentauriQuote

[TrappedByMyself]

People who believe that the suppression of information is okay because it could be misused are heading down a dark road, the price of return from which will have to be paid in blood someday by a future generation.
------
"As the Americans learned so painfully in Earth's final century, free flow of information is the only safeguard against tyranny. The once-chained people whose leaders at last lose their grip on information flow will soon burst with freedom and vitality, but the free nation gradually constricting its grip on public discourse has begun its rapid slide into despotism. Beware of he who would deny you access to information, for in his heart he dreams himself your master."
-- Commissioner Pravin Lal

Oh dear god no... Someone let lose the high drama nerds.
Run for your lives, quick, before they start quoting Shakespeare!

Re:obAlphaCentauriQuote

[Anonymous Coward]

George? Is that you?

IMPOSTOR! Filthy hhu-mon!

[TripMaster Monkey]

...but according to The Ferengi Rules of Acquisition:

193. Klingon women don't dance tango.

^_^

I Don't think you read the RTFA

[djdavetrouble]

and shame on the moderators as well. This is obviously either a publicity stunt or this guy is just
having some fun and saying fuck you M$ in a very public arena. Did you read this hilarious part?

Special offers:
Microsoft representatives get 10% off the final price. To qualify, you MUST provide @microsoft.com e-mail address and MUST mention discount code LINUXRULZ during checkout.

parent says: phrasing the auction in a way that makes it clear he wants the buyer to do something bad

No, specifically forbidden by auction text, with no winks or smilies or anything ironic.
Your bid indicates that you agree to the following:
1. You may not use this information for malicious or illegal purposes. The information you receive is for educational and
research purposes only.
2. The seller reserves the right to refuse delivery to anyone (a full refund will be issued).
3. The seller will accept no responsibility for anything you do with this information.
4. The seller cannot be held liable under any circumstances.
5. Absolutely no refunds will be provided except for the reason mentioned above.

Parent says: Looking at the motivation this guy has, I can't really see how it can be good.

It calls to attention that a critical vulnerability will go unpatched for months after it has been properly disclosed. That is the way that it can be good.

Argh!

[JRHelgeson]

The auction was canceled and I was the high bidder too!
Here's a mirror of the auction.

Joel

Re:Argh!

[Anonymous Coward]

Why does it go to a member called smk778 when you try to look up fearwall?

Re:Argh!

[Cow Jones]

Why does it go to a member called smk778 when you try to look up fearwall?

Because he changed his user name.

A honest days pay for an honest days work

[CmdrGravy]

It seems to me that E-Bay are behaving somewhat unfairly in pulling this auction. The seller has clearly devoted some time and effort into discovering this piece of information and has behaved responsibly by informing Microsoft of the problem in their software.

I see no reason why he shouldn't be compensated for the work he's done here and if Microsoft aren't paying him then it's only fair that he offers his work to the highest bidder, it's perhaps unfortunate for Microsoft that he can leverage the most value for his work before they have had a chance to patch the problem but the seller doesn't have any obligation to Microsoft and their problems are no concern of his.

Re:A honest days pay for an honest days work

[one_bad_rover]

Yeah, cause ebay has always been completely fair in all their other dealings... Youre forgetting they dont care about the seller or the buyer, they care about collecting fees, and I for one, hope that Google Base "http://base.google.com/" gets online and grows enough to drive them into obscurity.

Re:A honest days pay for an honest days work

[Anonymous Coward]

+1 Truedat.

The funniest part...

[krbvroc1]

From the auction: Microsoft representatives get 10% off the final price. To qualify, you MUST provide @microsoft.com e-mail address and MUST mention discount code LINUXRULZ during checkout

Re:The funniest part...

[Anonymous Coward]

That's why it was pulled... a 10% discount was offered. I've had an auction pulled b/c I offered a discount if Paypal was not used.

Re:The funniest part...

[Anonymous Coward]

That's in either paypal or ebay rules, that you can't charge a different price if paying by paypal. I've seen it once, I looked a little but didn't see it again. I think this was after they changed the rules that you need to accept credit card payments if you say you accept paypal... People were saying there was a 3% fee or something if paying by PayPal...

Feedback

[IainMH]

:¦:-:*'""*:.-:¦:-*Super EBuyer!!*-:¦:-:*'''''*:-:¦:-*Thanks BillyG1955!!*-:¦

OT: Ebay terms and conditions

[thePowerOfGrayskull]

I was reading through ebay T&C, because the article made me curious.

I, for one, am very disappointed that I cannot list a prohibited country for sale:

You can set the proper price at public auction

[Anonymous Coward]

Imagine that.

seller's feedback list

[bach37]

http://feedback.ebay.com/ws/eBayISAPI.dll?ViewFeed back&userid=fearwall

Looks like the seller just bought a keystroke logger.... :)

Re:seller's feedback list

[bach37]

Correction: he just sold a keystroke logger.

Re:seller's feedback list

[arkanes]

He also sold a whole ton of Ericsson data cables for a penny each to the same user who posted a ton of identical postive feedback. I ain't saying he's a feedback farmer, but...

ebay will pull any auction

[digitallysick]

ebay loves to stop any auction once someone doesnt agree with it. He should have been able to sell the information, microsoft was notified of the issue. Better yet, maybe he should have just put the whole exploit in the auction for everyone to read!

This could be a good way to set time limits?

[rianman]

This could be the start of a good way to embarrass companies into fixing bugs AND punishing bad people. Evil person wants to use the exploit, so they bid. Microsoft don't want the exploit usable, so they fix it (run with me on this one for a moment) The clever bit is, the Seller (who is honest, intelligent and socially responsible) sets the auction expiry time far enough into the future to cause a race between the two. M$ are put on public notice when the exploit becomes usable. If they win the race, Evil Person has to pay for no benefit (or M$ would give them a bad ebay rating - that'd hurt, right?). If they lose the race, public humiliation ensues. This is sort of like the Bounty system, in reverse. Or just plain blackmail. Either way, it would be fun to watch.

Re:This could be a good way to set time limits?

[Phroggy]

The clever bit is, the Seller (who is honest, intelligent and socially responsible) sets the auction expiry time far enough into the future to cause a race between the two.

eBay limits when you can set an auction to expire; I believe the maximum allowed is ten days.

Also note that an exploit Microsoft has already patched can still be dangerous, since most people don't update that often.

I Think it's Pretty Funny

[kadathseeker]

I'm pretty sure it was meant as a joke, he just took a chance to jab at MS. Don't take it too seriously. After all, he only wanted 1 cent for it.

Trumpet Vrs. Strumpet

[eldavojohn]

What's the difference? They're both fun to put your mouth on but all the noise they make is boring.

Well, except for Miles but he's dead. His trumpet I mean.

Even Maynerd Furgeson is getting old. In more ways than one.

Supression of information is a necessary

[ThinkFr33ly]

So is it OK for me to provide a detailed description of how to make a suitcase nuclear weapon, including people to contact to get the materials used in its production? How about the nuclear launch codes and how to use them? How about some top secret security codes used for encryption of data regarding national security? How about the security codes to your house alarm?

Supression of information is a necessary fact of life in a world where information can be used to harm others.

This does not justify supression of any information a goverment feels like supressing. Each case must be examined carefully, but to say that there is never a justifiable reason to supress information is dangerous and clearly at odds with reality.

Re:Supression of information is a necessary

[Anonymous Coward]

So is it OK for me to provide a detailed description of how to make a suitcase nuclear weapon, including people to contact to get the materials used in its production?

Various law enforcement agencies would find the contact info useful...

How about the nuclear launch codes and how to use them? How about some top secret security codes used for encryption of data regarding national security?

I'd rather have leaked codes public and changed then known in a limited group (same for any other "secret" codes.) Anyway, I hope you need physical access to make use of them...

Re:Supression of information is a necessary

[Ph33r th3 g(O)at]

In the first case, yes. In fact, that right has already been upheld and Esquire (IIRC) published an article that describes how to make a nuclear weapon. In the second case, you're talking about classified material that only those with clearances who agreed not to disclose it would be privy to, and that's not a valid comparison. I find it ironic that someone with the name "think freely" would argue in favor of suppression of information.

Re:Supression of information is a necessary

[John Hurliman]

There's an obvious distinction between someone's security code for their alarm system, and a fundamental flaw in the particular alarm system that allows you to bypass the security code. The latter should definitely become public information after the vendor is able to address the issue, or if they choose to ignore it.

Re:Supression of information is a necessary

[ThinkFr33ly]

What is the difference? Both are pieces of information that would allow you to gain entry to the person's home.

Perhaps you saw the person type in that security code. If you saw them type it in, is there not a chance that somebody else did as well? Perhaps the owner of the home doesn't take his system seriously enough and occasionally tells people his code.

By releasing this information, and making sure you know he released it, he will be more likely to change that security code... in the same way the maker of the security system would be more likely to fix the problem.

Seems to me your distinction is somewhat arbitary.

Re:Supression of information is a necessary

[ThinkFr33ly]

In fact, that right has already been upheld and Esquire (IIRC) published an article that describes how to make a nuclear weapon.

Do you have links?

In the second case, you're talking about classified material that only those with clearances who agreed not to disclose it would be privy to

Isn't that somewhat circular logic? It's OK to supress information that's classified, but only because it's classified as top secret by the government? Why is it top secret? Isn't that the reason it's classified?

I find it ironic that someone with the name "think freely" would argue in favor of suppression of information.

My name is meant to convey my skeptical outlook on life. I don't tend to think it sweeping generalisms like "all information needs to be free".

Re:Supression of information is a necessary

[aitikin]

Big difference. If I gave out my security code to people, accidentally or purposefully, it would be my fault that my house was broken into. If the company has a flaw with their security system, it's their fault that my house is broken into. If it's public knowledge that there is this security flaw, I could possibly keep it from occuring in my house as well as complain to the company to try to get it fixed.

Re:Supression of information is a necessary

[Anonymous Coward]

So is it OK for me to provide a detailed description of how to make a suitcase nuclear weapon, including people to contact to get the materials used in its production?

Read the bill of rights of the USA. Oh hell, I'll just C/P part of it for you:

Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances.

It's pretty simple. It is legal because it is impossible to make illegal. It's that simple.

How about the nuclear launch codes and how to use them?

If you were given them with permission to publish, yes, not a problem. Nuclear launch codes are a state trade secret and, like all trade secrets, as long as you don't make them public they are protected as your personal property by law. I'm pretty sure the "owner" of the codes would be the president. Ask him if he would give you permission to publish them.

How about some top secret security codes used for encryption of data regarding national security?

Again, as above, if the encryption codes aren't a trade secret, or were given to you with permission to publish, awesome. I somehow doubt you'll get permission to publish them, though.

That all being said FOIA will make them free, eventually. Give it a few more decades and you can read all the old encryption codes and old nuclear launch codes you like. I think all the active ones will remain trade secrets, though.

How about the security codes to your house alarm?

Same as above. If you want to give them out for publishing, awesome. If not, read above.

Supression of information is a necessary fact of life in a world where information can be used to harm others.

The information is not "suppressed", as in there's a specific law that says "thou shalt not know the USA's nuclear codes". The information is "suppressed" in a much more general sense of "I built it. I own it. I'll let YOU figure it out."

If you managed to figure out said codes without pirating them, then yes, you could publish them. It's no different than Compaq making a compatible IBM BIOS in a clean room. Of course, one would hope nuclear codes weren't so easy to duplicate...

Re:Supression of information is a necessary

[ThinkFr33ly]

How does that make any difference regarding the supression of the information? Why does it matter whose "fault" it is?

If your security code is public knowledge, are you not more likely to change it?

It's an arbitary distinction.

Re:Supression of information is a necessary

[Ph33r th3 g(O)at]

The magazine was actually The Progressive. Here's a link to Wikipedia's summary.

You considered the classified information argument circular because you disregarded the fact that such information is kept secret by agreement of the parties with whom it is shared. Information that is already out of government control can't be effectively classified TOP SECRET or anything else.

Re:Supression of information is a necessary

[ThinkFr33ly]

Ah, interesting. So information can be supressed as long as all parties that are privy to the information agree to keep that information secret.

I disagree with your conclusions, but I now understand your distinction.

I think that the world is a better place because some information is kept secret. I don't view this as a "slipery slope" because I don't view it as an all or nothing question.

Re:Supression of information is a necessary

[not_a_george]

Of the other side of the coin, I can kill someone with a knife. Should I not know how to make a knife or any other sharp object because it is lethal? How exactly am I going to use those nuclear launch codes? If the security code leaked in the first place, then the system is flawed. Its not about the information someone has, it's what they do with it that makes them a "bad guy."

Re:Supression of information is a necessary

[aitikin]

The difference is in the number affected. If the one person has it happen that's their problem, if the company has it happen that's everyones problem.

Re:Supression of information is a necessary

[ThinkFr33ly]

So information can be surpressed if it only affects a small number of people? How small? 1 person is OK, but is 2? 10? 100?

Another arbitrary distinction.

Re:Supression of information is a necessary

[Plunky]

How about the nuclear launch codes and how to use them? How about some top secret security codes used for encryption of data regarding national security? How about the security codes to your house alarm?

Yes. If somebody came across these details blowing in the wind and contacted the relevant authority who then said 'oh, we might look at that in a couple of months' then I would say that that person has every right to attempt to force said authority to look at the issue now when they are a concerned party.

For nuclear launch codes - well its obvious that they are a concerned party. For Excel then if they are also a user with data that becomes vulnerable with this then they are also concerned party.

I hope this publicity makes Microsoft stand up and do something immediately. This person has the information and now that the information is known to exist, others will be looking for it. When they find it they might not be so nice about it, hm?

I suspect he or she really was not intending to make a huge profit over this, but putting an auction on eBay is a very good way of getting publicity while deferring the release of the information.

Do you think that realistically, Microsoft could not release a patch for this in the 7 day timeframe of the original auction? (alternatively they could probably outbid everybody else in the entire world and keep the details secret for a while longer..)

Re:Supression of information is a necessary

[ThinkFr33ly]

Do you think that realistically, Microsoft could not release a patch for this in the 7 day timeframe of the original auction?

Are you kidding? Of course not. Excel is used by MILLIONS of people and the testing that needs to go into any kind of patch takes a weeee bit longer than 7 days.

In addition, we have no idea of the implementation details of the patch. Perhaps the offending code actually lives in a system library. This further adds to the time it takes to implement and test a patch.

This guy put the exploit on eBay for purely egotistical reasons... and perhaps some greed. It had nothing to due with holding Microsoft accountable, and even if it did it would be questionable at best.

Re:Supression of information is a necessary

[aitikin]

No, I never said that. I said it's a much greater deal if the information surpressed affects everyone with that equipment. If someone who isn't going to use the information negatively and figured it out on their own (in the case of the article) it wouldn't matter if he stumbled onto someone's personal security code. If someone figures out a vital security flaw in a large corporate system, odds are someone else is trying to figure that out and therefore it should become public knowledge before someone has the chance to exploit it.

The likelihood of someone who figured out a security code through no fault of the owner to be a benevolent person is slim to none, but in the case that it were to happen, what would it matter. The person is not going to do anything bad with it and odds are someone else isn't cracking away at it. If someone benevolent were to figure out a corporate security flaw, the likelihood that a malicious someone is going to figure it out is much greater, therefore it is much more important that the corporate security flaw (which coincidentally is personal for some people as well) be public knowledge.

Re:Supression of information is a necessary

[CreatureComfort]

You seem to have answered your own question, and contradicted your original theme at the same time.

Yes, if you oversee me type in my security code, I would much rather you tell me you know it and that you are going to publish it, and then have you publish it, than have you walking around secretly knowing my code. If you tell me it is compromised, and will be made public you are 'darn'd tootin' I'm going to change it as soon as possible, and implement better procedures to keep it from leaking in the future.

Myself, just like any number of large corporations, will willingly proceed with standard operating procedures, in the lack of any information showing they are flawed. I, unlike many large and small corporations, will change those procedures when they are shown to be flawed. Many corporations and individuals will only change their methods when threatened with public disclosure of a vulnerability.

And if you think you are doing me a favor by keeping the fact that you have compromised me secret, because you are a trustworthy individual, think again. If you know a vulnerability, then the chances are that someone else will also discover it, and they may not have your lofty morals. And that applies to knowing where to procure nuclear materials, the national missle codes, or the frequency to my garage door opener. If you have found a leak to aquire the nuclear launch codes or secret encryption keys, I really do want you to tell people and publish them. Because if you found them then it is very likely that someone else has as well, and they need to be changed immediately, and the leak needs to be plugged.

So yes, there is information that needs to be kept between limited, responsible people. If at any time that information leaks beyond that group, then once the group is informed, the information needs to be published so that 1) we the people can be informed by the failure in public trust, and 2) it will force a review and change of security procedures.

I defy you to find any class of information, that once found vulnerable, should remain secret under this scenario. Even information that is in some way hard coded, i.e. the instructions on how to build a nuclear bomb, needs to be public, just so that we can implement proper security to keep it from happening. If I don't know that a certain left handed widget is critical to the assembly of such a device, then I don't know to be suspicious when I see one being delivered to the house next door. And no matter how good your security is, once someone has figured out how to do something, other smart people will be able to figure it out as well, you just won't know that it been re-invented, and you won't be looking for people doing it because you have 'secured' the information.

Re:Supression of information is a necessary

[arose]

I think that the world is a better place because some information is kept secret.

Maybe the world just seems to be a better place because you don't know the secrets...

Re:Supression of information is a necessary

[Fordiman]

"So is it OK for me to provide a detailed description of how to make a suitcase nuclear weapon, including people to contact to get the materials used in its production? How about the nuclear launch codes and how to use them? How about some top secret security codes used for encryption of data regarding national security? How about the security codes to your house alarm?"

Yes. Again, yes. If you can obtain it, yes. Sure.

Truth is, you couldn't do any of that if you tried. I could do the first and second, but could use neither. The trick with the is that you need to not only know who to contact, but have to verify that you're not just some punk off the street or someone who actually intends to use the materials. They're all controlled. Truth be told, you probably COULD do #1 with a little patience and research; a nuclear bomb is little more than a carefully uncontrolled nuclear reactor, and I'm pretty sure most people know how those work.

The second; well, you'd have to get to a place where the launch codes can be entered. And if you think that means 'the internet', you've been watching too many movies. Even if you distributed them, how long do you think it would take before they were changed?

"Top Secret Security Codes used for encryption of data regarding national security?"
This question PROVES you watch too many movies. I mean, for one, US Military intelligence protects their data the old fashioned way - servers with no bridge to the outside world, locked up in a room behind groups of marines. They may encrypt, they may not. Truth be told, you'll never know. The marines won't let you in.

You can have the code to my house alarm. It's 1234. And I give 75% odds that so is yours.

Re:Supression of information is a necessary

[arkanes]

Besides the other replies, most of which are reasonable, you're drawing an apples and oranges comparison. The security code is the secret. The method by which you obtained it is the flaw. Disclosure of the flaw is reasonable. Disclosure of the secret (usually) is not. Disclosure should also be to affected parties - if you know your neighbors code because the keypad is visible from the street, then you should tell him that. There's no special need to publish that widely, because only your neighbor is affected.

On the other hand, if you know the code because theres a flaw in the system, it's reasonable to distribute that widely, so that it reaches all the customers involved - assuming that the company doesn't take reasonable steps itself. I know theres a common thought that you shouldn't take action into your own hands just because the company doesn't respond to your satisfaction, but on the other hand it's demonstrably true that many companies are much more interested in maintaining a pretense of security than real security, and they rarely have customers best interests at heart.

Re:Supression of information is a necessary

[Fordiman]

Information should not be surrpessed. Not by law at least. It's something that each person has to decide for each piece of information he posesses. Whether to spread it.

If I am told someone's home security number, it is my choice as to whether to release it. Social pressure should be enough to stop me from spreading it, but lets say it doesn't.

I spread the information. The second it gets back to the homeowner, he changes his code and never tells me again, meanwhile, doesn't trust me with anything ever again.

Skip over to the exploit, a different topic entirely. The issue here is not whether the information should be public - the continued presence of Security Focus is evidence enough that it is, and that it's going to stay that way. The issue here is whether the hacker in question should be able to profit from his work.

I say yes. He performed a valuable piece of user-end debugging for microsoft, and even told them first. The eventual price of the auction is considerably less than the potential price of a freely available code exploit would be. Viruses are bad, if you recall.

Additionally, he did it in a way that got Microsoft's _immediate_ attention, which is more than you can say about SecurityFocus bulletins or emailing Microsoft.

I say that microsoft should have payed the pittance ($56 from a multi-billion dollar company?), giving the man his due - rather than pulling his bargaining position out from under him.

Re:Supression of information is a necessary

[ThinkFr33ly]

Wow, did you totally miss the point.

Re:Supression of information is a necessary

[Fordiman]

No, no I didn't. The point is that individuals keep information secure, not laws. Data like security codes and instructions for dangerous items, when open to the public, become quickly useless - as the individuals charged with keeping the information secret either change the information, or make the information only a peripheral requirement.

Laws won't help. They're way too nonfluid to be able to adapt to the number of situations needed to handle security issues. The only thing that does help is an alert administrator - in this case, Microsoft.

Re:Supression of information is a necessary

[Alsee]

So information can be supressed as long as all parties that are privy to the information agree to keep that information secret.

Sory of, though I'm not completely happy with how you worded it.

You can simply not hand out Top Secret information to people who have not already taken a secrecy obligation. And of course it would be quite criminal for someone to break in to a safe to obtain the information.

However if someone does independant physics research and/or public documents research and figures out the materials and design for a nuclear device, then they are free to discuss it. It's the same information, but this person has not broken the law to get it, and is under no special obligations.

The basic design of a nuclear device is surprisingly simple. If you have more than a certain mass of uranium-235 or plutonium within a certain volume then you get an exponetially increasing chain reaction. Boom. You pretty much just need to cross that threshold as rapidly as you can and as far as as you can. The main designs are with the gun type (firing a cylindar of material into a doughnut to create a super-critical sphere) and implosion (collapsing/firing material from all directions into a supercritical focal point).

Another potential issue is that once the reation starts the core immediately begins to blow itself apart. Once the core gets larger than the critical threshold size the reation terminates. So if you have a small or borderline bomb with a "slow" detonation, then that core could just "fizzle" blasting itself apart. No big boom. That can be fixed using certain materials that act as a rich neutron source. When the reaction starts it floods the core with neutrons rapidly spiking the nuclear detonation, pulling out the nuclear energy faster than the core can physically blow itself apart.

I expect some of the main "Top Secret" work is on how to design the smallest and most efficent bombs - the smallest lightest device to get the smallest core to "pop" really fast before it can vaporize itself terminating the reation.

No, I have no special training in this area. Just a general science geek. The basic idea and physics behind an atomic bomb are now 60 years old and fall within the realm of basic scientific knowedge. The only reason that everybody-and-their-grandmother doesn't have nuclear bombs if the challenge of getting the uranium-235 or plutonium. Plutonium is not naturally occurring, you pretty much need to breed and purify it inside certain types of nuclear powerplants. The other option is U-235, which is naturally occurring. However U-235 is a trace percentage of "normal" uranium, and it is a real bitch to separate it.

If and when off-the-shelf nanotech makes it easy to refine U-235, well then things become a lot more... ahhh... interesting. "Interesting" as in the ancient chinese curse "May you live in interesting times".

-

Re:Supression of information is a necessary

[John Hurliman]

I'm going to throw one last comment in here, might have already been covered. The major distinction is the security code belongs to a private entity, he isn't advertising access to his house or a competition to break in. The company selling the home security system is marketing the system as something that keeps your house safe, and convincing people to pay them money for a product that should improve the security of their home. If there is a fundamental flaw in the system, the consumer who has been misinformed needs to be aware of this as well as the company responsible. You can get down in to the gritty details of who should be informed first, how long should the vendor have to respond, the difference between vulnerability disclosure and proof of concept code and working exploit code, etc. but the basic idea is that weaknesses in a system that was designed and marketed as a secure system should be public information.

Re:Supression of information is a necessary

[aphor]

You appear to want to draw a line in the sand, pitching some examples to suggest its proximity, but no matter how much you assert its existence, I don't see it. I hope I'm not standing on your invisible friend.

I'm trying to make a subtle point here. Think! I know this is Slashdot, but someone will get it.

In Soviet Russia...

[Anonymous Coward]

...excell sells YOUR vulnerabilities on Ebay!

Well alright lets run with this idea

[SmallFurryCreature]

A security hole on its own has zero value. Take for instance those 1 dollar number locks you can get for your luggage. I can tell you how to break them but big deal. Not because a wire cutter will also work (that would leave evidence that the lock has been broken) but because the attached value is to small.

A security hole would gets its value from the attached object. A how-to on bypassing shed locks is less value then a how-to on bypassing a bank safe.

Next would come how easy it is to exploit the security hole. This one seems to require people to open an excell sheet. This obviously makes it off lesser value then say an exploit that works when a user opens a gif file via IE. Even more valauble would be an exploit that does not require the user to do anything but can attack any computer just hooked up to the net.

Would there be money in it? You bet. Once you got an exploit using it to install a botnet is childsplay and botnets are big business. If you can deliver a 10.000 zombie network there are people willing to pay you hard cash in exchange. Even for just renting it.

However you would hardly do this over e-bay. There are very few legit uses for a botnet and therefore your potential customers would prefer a less public way of trading it.

But it does happen. It is one of the reasons we see so few destructive virusses vs the ones that turn a pc into a zombie. Used to be different. Once the majority of virusses either joked or destroyed your machine. Now you just got a zombie. Do I have proof?

No of course not. Just stories tall tales from the server room and hints that should a company that hosts pay sites wish to do some advertising that they might know ways that do not involve constantly trying to find the next provider willing to be placed on a ban list for spam.

Spam sells, ISP's are unwilling to hosts spammers, so the only question is, will spammers pay for a botnet that can do their spamming. Does the pope shit in the woods?

Re:Well alright lets run with this idea

[Anonymous Coward]

There is a good point in there. What if the discoverer was to patent or copyright their research. In fact microsoft is getting a free ride from their time and effort. If they were to patent the procedure then they could charge microsoft for their effort. It's applying a market solution to computers and it really sounds like the best way to go.

It broke the "ebay doesn't like it" rule

[Sycraft-fu]

eBay has no obligation to list anything in particuar. It is in their best intrests to list most auctions without objection since the more that sells the more money they make, but there's no obligation. If eBay management decided that they wanted to ban selling of all religious items or something, they'd be well within their rights.

Now if I worked for eBay and was the guy with his finger on the button, so to speak, for canceling autions, I'd pull this. Why? Well simple cost-benefit analysis:

It's entirely possible, even likely, this guy is lying (I'm talking from their perspective, pre MS announcement) and thus we'll just get invloved with having to refund someone's money in the end. But let's assume he's telling the truth. In that case we would be on the hook for a ton of bad publicity since no doubt the press would eat up the story of eBay welling hacking instructions, and we might even be civily or criminaly liable for knowingly allowing this to go on. Now weigh that against the 2% or so we'd make from the final sale, maybe a few hundred at most if the auction gets bid way up. Not even a blid on our balance sheet. Thus, we cancel the auction.

eBay's a business, pure and simple. They'll let you sell whatever you want (for a cut) unless they feel what you are selling might cause them trouble. That's why they ban some entire classes of items, like firearms. It's not illegal to sell firearms on the Internet, and there are sites that do it. However it's trickey, since they have to be shipped to a licensed dealer and so on. It exposes you to a lot more liability, liability eBay doesn't want, so they just outright ban them.

DAMMIT

[Prince Vegeta SSJ4]

Dammit, your interfering with my profit potential. I just put information on that link up for bid on EbaY.

******SPECIAL******

For a Limited Time

get a CD with instructions on how to make Excel Crash!!!!

Starting bid $1

[text size="fine print"]only $59.95 for S/H[/text]

Seriously..

[Jester6641]

I understand why they pulled it. Think about it...you've managed to collect about 10 people with a lot of money and bad reputations, along with about 10 people with a lot of money and a lot to loose to the people with the bad reputations. They're all there and you offer for auction the world's best superweapon. We'll call it a frickin' laser for the sake of argument. So you start bidding on the frickin' laser at $.01 and somebody dishonest makes an offer. This is immediately followed by another dishonest guy who wants it for himself, then an honest guy that doesn't want either of them to have it, then by another honest guy that doesn't know guy 3 was, in fact, honest and is just trying to save his own hide. Who's going to win? Well, it'll be the guy with the most chips to bet, but everyone's going to be on pins and needles to see which side of the fence he's on. It's basically holding all 20 people hostage to themeslves and seeing what shakes out. Pretty slick marketing if you think about it.

Re:Seriously..

[lhommemagique]

Well there is always the chance that some people will team up. In that case the side (not the person) with the most money will win. Assming that there are no double crossers. But in our case it doesn't really matter because MS has the most money and they are nigther good nor bad.

WAAAYYY overpriced

[SHP]

I thought M$ bugs were a dime a dozen.

-SHP

He is not to blame

[lhommemagique]

Hunting stores sells lots of guns and knives all the time, and if someone buys one of these and kills someone else the hunting store is not to blame. Just as this guy should not be blamed it his sale had lead to a misuse of the exploit.

Re:He is not to blame

[deanoaz]

Under some conditions the store may very well be held liable. If they did not pursue due diligence in assertaining that the buyer was not a known felon, then they could face penalties.

Also, guns and knives have many recreational and defensive uses, and the vast majority of buyers are no threat to anyone.

Is the same true of someone who buys an exploit?

"I'm all in favor of keeping dangerous weapons out of the hands of fools. Let's start with typewriters." - Frank Lloyd Wright

Why even consider paying for it?

[jofi]

Just watch Security Focus or FRsirt for all your 0-day MS exploit needs.

Reflects Poorly on Security Researchers

[Sux2BU]

This stunt just reflects poorly on security researchers. Yes it sucks that MS is slow to respond, but threatening to sell the exploit to the highest bidder doesn't help. It just comes off as extortion or aiding virus writers.

What the M$ rep told Ebay...

[acercanto]

When MS called EBay to tell them to take down the auction, it probably sounded like this BOFH quote:
"Two seconds later the red phone goes. I pick it up, it's the boss. He mumbles the username of the person I was just talking to, mentions something about a nasty mail message, and utters the words "You know what to do...", with the dots and everything."
--Acercanto

Re:What the M$ rep told Ebay...

[crashelite]

real convo goes "aww shit dude this will take us... well untill some one makes a virus/worm/whatever for it then we will address this issue. but untill then pull the auction or we will stop giving you microsoft T-shirts and coffee mugs"

Zing!

[ImaLamer]

No, criminal profiteering. The only type of person who could make use of the information apart from Microsoft is a criminal.

What about the system administrator trying to secure his networks? There are plenty of legitimate reasons why someone would want to know exactly what the vulnerability is so they are able to stop people from using it.

Exactly. From the Microsoft viewpoint, trying to secure anything without their permission or use of another one of their products is criminal.

Stop questioning Microsoft you criminal!

invisible hand

[TubeSteak]

If by "Invisible Hand" you mean General Grievous' flagship, then yes, I expect it will solve the issue for us

http://www.starwars.com/databank/starship/tradefed erationcruiser/?id=eu

Once the war erupted, such subtlety was lost and Grievous was tasked to take worlds by force. The Invisible Hand, leading the charge of a Microsoft flotilla, grew to be feared in the distant Outer Rim and other unprotected regions of space.

Weapons:
14 quad turbolaser turrets;
34 dual laser cannons;
2 ion cannons;
12 point-defense ion cannons;
102 proton torpedo tubes

Follow up for the story

[Anonymous Coward]

There is a followup on ebay!

Here is his name and e-mail address

[Anonymous Coward]

Daniel Rovaniemi

hostmaster@fjupp.com

what's the point?

[Anonymous Coward]

what's the point of the new auction? to see if the geniuses at eBay pull it?

Free decides seriousness of Bug

[ittanmomen]

Companies operate with constrained resources in order to generate a profit. While developing a product a company only experiences cost, no income. After the selling starts a company receives income that slowly covers development cost until it breaks even. After break even, additional sales generate profit. After sales start any maintenance work reduces profit.

Why do I talk about what everyone already knows? A company like microsoft must decide for themselves how to use their limited resources. They decide how serious a bug is by looking at the urgency, and seriousness vs reduced profits. They make a decision based on their own interest. By putting an exploit on ebay, the cost and seriousness of the bug is not decided merely by microsoft, but by the market.

If MS thinks its irrelevant, they need not do anything. If they think its serious, they will have the choice of either fixing it until the auction ends, or bidding to prevent disclosure. Third parties interested in security will also have a chance to bid, however they must realise that their purchase may soon loose value if a fix is provided.

Overall I think its a good idea - in the best case it encourages a faster fixing of issues.

He just posted another auction

[JRHelgeson]

http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item =6588680836

Apparently he is a researcher that was looking to find the true market value for an exploit by selling it on ebay. Was gonna write a paper.

Joel

All well and good, but...

[Atario]

...what's to stop any random idiot from claiming your auction is violating something or other and telling eBay to pull your auction? Case in point: some organization calling itself "SIIA (The Software & Information Industry Association)" has pulled my wife's auction of a set of Kaplan USMLE study books...wait for it...which she bought on eBay. Lots of other auctions for the exact same items stay on and go through to completion. Sounds like someone doesn't like competition and knows how to game the system.