Auction Site To Sell Security Vulnerabilities

talkinsecurity writes "A Swiss research lab has built an eBay-like marketplace where hackers and researchers can sell the security vulnerabilities they discover to the highest bidder. WabiSabiLabi could replace the back-room, secret sites where researchers and hackers used to sell their exploits and replace them with a neat, clean way to make money by finding security flaws. Those who have seen the site say they are concerned about how the buyers will be vetted, and how the marketplace will ensure the flaws aren't found through illegal methods."

Comments

Re:Bidding up

[MadUndergrad]

Yeah, like it or not there's a good deal of trust involved for sites like eBay. I don't think that's going to work when extortion and thousands of dollars are on the line.

sounds good to me

[nanosquid]

Companies like Microsoft seem to have developed the attitude that people shouldn't find their security holes at all, but if they do, they should be obligated to report them for free.

I think a free market approach like this is good.

As for vetting buyers and sellers, I don't think that's either necessary or desirable. If people find security holes through "illegal means" (whatever that means), it's a matter for the police and courts. And if the mafia outbids Microsoft, well, then Microsoft will have to live with the consequences or pay more next time. Companies like Microsoft should be exposed to the true costs of their security vulnerabilities, and they will be exposed to that only if the "bad guys" are in on the bidding, because vulnerabilities aren't worth a lot to the other "good guys".

If prices and damages get high enough, companies will invest enough in software development to stop creating security vulnerabilities in the first place.

Re:sounds good to me

[suv4x4]

Companies like Microsoft seem to have developed the attitude that people shouldn't find their security holes at all, but if they do, they should be obligated to report them for free.

I think a free market approach like this is good.

Oh yea, free market always works! Especially when the bidders in this case would actually gain financial benefit from said "goods" by illegal access to people's machines.

Software companies that produce products will be forced to "pay up" or let the vulnerability go to said parties above.

Other free markets that work just fine, and bidding works miracles in there:

* Human Organ Markets
* Internet domains
* Fire Weapons, Biological Weapons, Missiles
* Kidnapping journalists in Iraq for bounty
* De-regulated utility monopolies
* Open Market Health Insurances

The world is full of amazing examples where the best thing EVAH to do, was just sit there in awe and think "it's perfect"!

How would you know that it is only sold once?

[EmbeddedJanitor]

After all, who's going to try claim "ownership" of an exploit?

Re:How do you preserve value?

[GizmoToy]

I agree. Once you tell the bidder what the flaw is in, and give a good enough description of it to garner bids, someone is going to be able to track it down for themselves for free. Not the best business model.

Its simpl;e, really - and why it won't work

[tomhudson]

It reminds me of the joke:

Man: I just lost my wallet with $1,000.00 and my credit cards in it. I'll give whoever finds it $100.00.
Voice from back of room: $I'll give $200.00

If its a real vulnerability, you can sell it over and over again. None of the buyers is going to leak it - they'd lose their investment, and chance to make $$$.

So, sell it once for $X, or sell it 20 times for $X/2?

This is just someone else with a lame attempt to insert themselves into a market.