An eBay For Hackers

cyberdelicat writes to let us know about a Swiss security firm called WabiSabiLabi that is causing waves with its open auction for zero-day security vulnerabilities. While WSLabi claims they will thoroughly vet both buyers and sellers of vulnerabilities, many researchers are skeptical about how effectively they can do this. The Washington Post article mentions the guy who almost opened a similar auction site several years back, to be called Zero-Bay, but pulled the plug at the last minute. SearchSecutiry notes that some security researchers are now referring to WSLabi as "zerobay" as they undermine the auction site by reproducing and publishing vulnerabilities as soon as they appear for sale.

Comments

How about an Ebay for Dupes?

[Anonymous Coward]

http://it.slashdot.org/article.pl?sid=07/07/06/014 4234

So what happens when...

[Mr EdgEy]

A sold vulnerability ends up being used against the site?

Hmm

[UncleWilly]

Only 4 Items for sale...and 550 euro for the Linux Kernel memory leak sounds fishy with only 1 bid

Don't let stupidity fool you

[packetmon]

I saw via a security mailing list ridicule at "Who the hell would buy a Yahoo messenger exploit. har har". So let's think about this for a minute... Done, how many people do you know that use Yahoo messenger at their corporate office? As obscure as some may think the site will be, all you need is some hardcore "pwning" going on, and some government will treat the site as they did Pirate Bay and shut it down quickly

Dude, this sucks

[TheModelEskimo]

I posted this awesome cultural comment the last time this story was posted and nobody even replied. Now the dupe is just plowing up all those bad memories again. http://it.slashdot.org/comments.pl?sid=246095&cid= 19763499

Re:Sounds dumb

[Nazlfrag]

There is nothing I can think of that is illegal about not immediately disclosing any security vulnerability a professional researcher or basement dwelling hacker stumbles across. There is also nothing illegal about providing exploit riddled software according to licenses I've read. What is illegal is robbing peoples bank accounts. I'm fairly sure that these guys aren't planning to keep the best hacks undisclosed while they rob banks (though it would be an interesting twist). I'm fairly sure they will be able to track the dissemination of these exploits far better than the existing markets.

Researching security holes should be a legitimate and profitable R&D investment, and should be done in an up front manner such as this rather than via the black market where your dire vision already thrives.

Vulnerability Info Exchange is Good

[this great guy]

Selling information about security vulnerabilities may be considered unethical by some, but it is perfectly legal in almost all countries (notable exception: France). Don't forget that a vuln is just a bug, they are selling information about how to trigger a bug. Why would that be illegal ? If a buyer exploit the bug for nefarious purposes, then the buyer is doing something illegal, not the seller. There are plenty of legitimate cases where a market for selling vulnerabilities is a good thing:

• The developer of a vulnerable application may want to buy vulnerabilities found in his application. Financial reward is an incentive for security researchers to find more vulnerabilities in an application when they know they would get paid for it. Additionally, over time, the security of the application increases.
• Penetration testing companies can increase their chance of a successful pentest with access to new and original vulnerabilities. This prompts the client (pentest target) to secure his IT infrastructure, by rearchitecting it, or implementing new security mechanisms.
• Vulnerability assessment tools developers can gain an edge over their competitors by buying info about vulns. A legitimate security vuln market moves the VA market forward, and in the end increases the rate of discovery, and therefore the rate at which security vulns are fixed.
• The biggest argument is perhaps this one: a vulnerability sold to a legitimate buyer is often one less sold to a criminal.

Well it depends

[Sycraft-fu]

Quite often, it is illegal to sell someone something if you should reasonably know they are planning on using it for an illegal purpose. As a simple example, a gun dealer in in a world of shit if someone comes in and says "I need a gun so I can go kill my wife, what do you have for me?" Basically, you are an accessory to a crime if you have or should reasonably have knowledge that a crime is going to be committed and you provide support, material or otherwise, for the commission of the crime. So while not disclosing a venerability is legal, selling it to someone that you have a good idea is going to use it for criminal means is illegal. The ignorance defense only goes so far, while being an accessory requires knowledge of the crime (you can't be charges for letting someone in a house if you legitimately believed they should be there, for example) it doesn't require that it was spelled out for you. If there was enough evidence that you should have known what was happening and were just being willfully ignorant, that doesn't cut it, especially if there was profit involved.

There are additional problem when you start dealing with certain classes of items. If something has substantial legal uses you are on much more solid ground. To use the gun example again, guns are widely used for hunting, target shooting, personal and home defense, all perfectly legal uses. Thus it isn't a stretch to assume someone has a legal use for it, unless there's specific reason to believe otherwise. However if the item in question has little to no legal use, then there can be problems. I see exploits as being mostly in this category. Other than the companies, who really has a legit use for the details behind an exploit? Now this isn't a challenge to try and come up with obscure reasons someone might want it, it is something to think about in general. What would people by and large want to buy these for? If the majority of realistic answers are illegal ones, then you can have a real problem when you sell it if you aren't real careful.