Slashdot Mirror
Bill Gates Should Buy Your Buffer Overruns
Really, what is a good argument against companies paying for security exploits? It's virtually certain that if a company like Microsoft offered $1,000 for a new IE exploit, someone would find at least one and report it to them. So the question facing Microsoft when they choose whether to make that offer, is: Would they rather have the $1,000, or the exploit? What responsible company could possibly choose "the $1,000"? Especially considering that if they don't offer the prize, and as a result that particular exploit doesn't get found by a white-hat researcher, someone else will probably find it and sell it on the black market instead? (Throughout this discussion, I'm using Microsoft as a metaphor for all companies which have products in widespread use, and which do not currently pay for security exploits even though they could obviously afford to.)
Perhaps you say that you would be willing to report bugs to Microsoft for free, and I respect people who do that out of selflessness, but that's not the point. Even if you and some other people would do "white-hat testing" for free, there are more people who would do it if there were prizes. The amount of people willing to do security testing for free, has not been enough to keep exploits from being found and sold on the black market -- but if Microsoft offered enough money, it would be. Obviously if Microsoft offered more than the black-market prices, everyone would just sell their exploits to them. But probably Microsoft could offer much less than the black-market prices and still put the black market out of business, because there are lots of researchers who wouldn't sell exploits on the black market even for tens of thousands of dollars, but would be willing to participate in a legal Microsoft "white hat" program for much less money.
Microsoft would undoubtedly say that they do their own in-house testing, and indeed the offer of a prize should not be used as a substitute for good security testing within a company. But at the same time, the fact that a company does their own testing isn't a good reason for not offering a prize. If a company says that they already do their own in-house security audits to catch as many bugs as they can, that still doesn't answer the question: given that a cash offer would probably result in an outsider finding a new exploit that they missed, why wouldn't they want to take it? Even if there are already outsiders who willingly find new exploits and turn them over to Microsoft for free, there's almost certainly at least one more exploit out there that would be found if they offered a cash prize. (And if the cash prize doesn't turn up any new exploits, then the company doesn't pay out and has lost nothing.)
I've done security consulting for companies like Google and Macromedia who paid me "by the bug", so you might think I'm biased in favor of more such "bounty" programs because I think I could make money off of them. Actually, I think that if Microsoft and most other large software companies offered security hole bounties to everyone in the world, almost all exploits would be picked clean by other people, and my chances of getting anything out of it would go way down, and there would be one less buffer protecting me from having to get a real job. But most people's computers would be safer.
Microsoft does in fact "pay" for security exploits in their own way, by crediting people in their security bulletins. To some people, who report exploits in hopes of being recognized, this is apparently enough. And there are third-party companies like iDefense who will buy your security exploits and then use them to gain reputation-credits for themselves, by handing them over for free to the software developer and warning their own clients about the potential risks. But there are a lot of people including me who have found exploits in the past, but don't consider the benefits of being mentioned in a Microsoft security bulletin to be worth the effort of finding a new one. And even the benefits that iDefense gets from reporting security holes, are evidently not sufficient for them to offer enough money for exploits to compete with the black-market prices (if iDefense got that much benefit out of it, then they'd be able to offer so much money that nobody would sell exploits on the black market). So using recognition as payment is evidently not enough; as Lord Beckett says, "Loyalty is no longer the currency of the realm; I'm afraid currency is the currency of the realm."
A cash prize program might mean that some people get mad when they are turned away for offering "exploits" that don't really qualify, but so what? What are they going to do for revenge, release their "exploit" into the wild? If it's not a real exploit, then it won't do any harm, and if it is a real exploit, then Microsoft should have paid them after all! Some people might threaten to sue if they aren't awarded prizes, even if the rules of the program state clearly that Microsoft is the final arbiter of what counts as an exploit. Maybe in some rare cases they would even win. But all of this could be considered a cost of running the program, just like the cost of giving out the prizes themselves -- and all insignificant compared to the cost of an exploit that gets released into the wild and allows a malicious site to do "drive-by installs" of spyware onto people's machines.
Probably the real reason Microsoft doesn't pay for security exploits is that they don't pay the full price for those drive-by installs and other problems when a new exploit is discovered. I've heard hard-core open-source advocates say that either (a) Microsoft should be held liable for the cost of exploits committed using flaws in their software, or that (b) users of Microsoft software should be held liable for exploits committed through their machines (which would drive up the cost of using Windows and IE to the point where nobody would use it). If that happened, Microsoft probably would pay for security exploits to forestall disaster. But let's make the reasonable assumption that neither of those liability rules is going to come to pass. The real price that Microsoft currently pays for security exploits is in terms of reputation, and the price they're paying right now is too low, because people don't realize that Microsoft could find and fix a lot more bugs by spending only a tiny amount of money -- but chooses not to. Despite all the snickering when "Microsoft" and "security" are used in the same sentence, most people seem to believe that Microsoft is doing everything they can to prevent users from being exploited. But as long as Microsoft doesn't pay for security holes, they're emphatically not doing "everything they can".
It's not that I think security bosses at Microsoft are trying to screw anyone over. They probably just have an aversion to the idea of paying for security holes, and what I'm arguing is that such an aversion is irrational. The people they would be paying money to are not criminals or bad people, they're legitimate researchers who just can't afford to do work for Microsoft for free when they could be doing something else for money. Offering cash will bring in new exploits, and every exploit that is reported and fixed is one that can't be sold on the black market later.
There are some interesting details that would have to be worked out about how such a program would be implemented. For example, what happens if Bob reports an exploit, and then Alice later reports the same exploit, before Microsoft has gotten a chance to push the patch out? Microsoft wouldn't want to pay $1,000 to both of them, because then whenever Bob found an exploit, he could collude with Alice so that they both "independently" reported the same bug and got paid twice. Microsoft could pay only Bob, but Alice could get so disillusioned at getting paid nothing that she might stop helping entirely. My own suggestion would be to split the money between all researchers who report the same bug in the time window before the fix is pushed out. If 10 researchers happened to report the same bug and each only got a paltry $100, some of them would quit in disgust, but if researchers start to leave because the average payout-per-person has fallen too low, then that will drive the average payout back up, so the number of active researchers stays in equilibrium.
Another issue: What happens if a researcher reports an exploit confidentially, and then the next day, the exploit appears in the wild? If Microsoft's policy was that they would pay for the exploit anyway, then a researcher would have no incentive not to sell the exploit twice, once to Microsoft and again on the black market (whereupon it might start being used in the wild). On the other hand, if Microsoft refused to pay for exploits that were released in the wild before they issued a patch, then that might leave many researchers feeling cheated if they turned in a genuine exploit and got nothing just because someone else sold it on the black market before the patch came out. My suggestion would be to simply pay for exploits even if they did subsequently get released on the black market -- on the theory that of the white hat researchers who turn in bugs to Microsoft, most of them would be ethically opposed to selling exploits to black marketeers, so they shouldn't be punished if the exploit ends up on the black market since they probably weren't the ones who put it there. Another would be to make the payout so large that even if researchers got no payment when the exploit got leaked into the wild before a patch was issued, the payout from the times that they did get paid, would more than make up for it.
But whatever rules are decided upon, there should be some sort of monetary rewards for people who confidentially report security flaws to big software companies. Whatever you can say about the merits of rewarding people through "recognition", or through social pressures to practice "responsible disclosure", the one obvious fact is that it hasn't been enough -- exploits still get sold on the black market, and every exploit that gets sold on the black market, would have been reported to Microsoft if they'd offered enough money. The talent is out there that could find these bugs and get them fixed. Most of them just can't afford to donate the work for free -- but the amount of money Microsoft would have to pay them, is far less than the benefits that would accrue to people all over the world in terms of fewer drive-by spyware installs, fewer viruses, and fewer security breaches. And if these benefits were reflected back at Microsoft in terms of greater user confidence and fewer snide jokes about "Microsoft security", then everybody would win all around. There are no barriers to making this happen, except for a mindset that it's "bad" to pay for security research. But if you prevent millions of Internet Explorer users from being infected with spyware, you deserve to at least get paid what Bill Gates earns in the time it took you to read this sentence.
Why couldn't I sell my exploit to the black market, THEN sell it to Microsoft a day or two later?
-1, Duh
I want to delete my account but Slashdot doesn't allow it.
What's to stop someone getting paid big bucks by microsoft for vulnerabilities, and then reselling the same exploits to the next highest bidder as well? I'd imagine that the people in the business of selling exploits to the highest bidder aren't the most ethical types to begin with.
I wonder what the real cost of finding an exploit is for a company like Microsoft... If its more than a 1,000 dollars then they should fully embrace this model
"what I'm arguing is that such an aversion is irrational"
You will get scum atempting to extort money from companies.
Offer mony for doing bad things and people will do bad things
You will never get to heaven with an Ak 47... But A Zu 30 is good for Low Flying Cherubim
If MS offers 10,000 dollars per exploit then thats going to be the minimum bid in the market. Someone will then offer 10,500 and the enterprising hacker will go for the extra cash. I dont see how MS's involvment can help this.
What might be more interesting is to dock 10,000k from the salaries of the security team everytime someone finds a serious exploit. Sometimes punishments are far more effective than rewards.
Almost sounds like an argument to outsource testing to the general public and pay them for it. Not sure why MS would do this when they've been outsourcing testing to the general public for years and charging licensing fees for it!
Cynicism aside, do you think that it really makes business sense for MS to pay for vulnerabilities? Has their revenue really been hurt that badly from their current security practices?
Makes much more sense than actually writing secure software in the first place, doesn't it?
This is a silly idea. It assumes that if Microsoft pays someone to keep quiet about a security vulnerability, no one, ever, will independently discover this SAME vulnerability. Human nature dictates that when you hand out money, you will quickly have people waiting in line.
Reminds me of the romans paying the barbarians NOT to invade them. Sure, give your enemy an income and make him rich. Makes a LOT of sense...
Seven puppies were harmed during the making of this post.
We could always burn black-hat hackers at the stake, like we used to do with witches.
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
We need the Mad Magazine Spys to weigh in on this matter ... or paint a house rather than the endless argument of what exactly is responsible disclosure.
I dunno, this sounds a bit like the argument over whether or not one should negotiate with hostages or terrorists... Once the black hats figure out that their exploits are being "rescued", two things will happen: * Prices ("demands") will go up; these companies have deep pockets / lots of resources after all... want a chopper and $2 million? * The exploits will be re-sold... some exploits can't be patched immediately, and even if it can, millions of machines will remain unpatched over their lifetime. So if you can make ten grand from randsom, you can pick up some extra cash on the side by pimping out your victim. Maybe I'm taking the analogy too far.
Who cares how many times they sell it? The point is that Microsoft can buy it and then fix it, thus elliminating the market value of the exploit. If someone can sell it to other people then good for them. Its still in Microsoft's best interest to buy it as early as possible and fix it as early as possible.
Microsoft? Do something smart about security flaws? Impossible! ;-)
Microsoft is not interested in fixing the problems with their operating systems. They need a certain number of bugs and annoyances present in the OS so the consumer will be unsatisfied and will rush to purchase the next "upgraded" OS. This business model has been hugely successful for them and it will continue to be until people wise up. Microsoft are capitalizing on human nature. Most people believe that "newer is better" but it is not always true.
--
Place creative sig here
Finding a security hole isn't necesarily a "bad thing". Its just information, which can be used by the company to fix the vulnerability or by unsavory people to exploit the software.
Click that magical little read more link below to continue the thought.
No no no no. That's sooo web 1.0. Now we say after the jump! You're so out of touch with the current trends of the blogosphere!
This is stupid really.
- Selling exploits like this is only going to encourage crime -- anyone who thinks a big vendor like MS is going to buy exploits this way is fooling themselves.
- All of the exploits currently listed for auction are for "free" software. Who (except a very unlikely angel corporation) is going to pay for these exploits, except criminals?
(Note that I have no problem with vendors paying for this stuff, but this auction method exists to make money by selling exploits to criminals. Call it what it is.)
Another post by someone who only read the title!
Using an exploit maliciously is, but finding the exploit is not a bad thing. In fact, it's a good thing. Hence, it should be rewarded.
Ben Hocking
Need a professional organizer?
That's the dumbest fucking idea I've ever heard since I've been at Microsoft.
640 buffer overruns ought to be enough for anybody! --Bill Gates
In Soviet Redmond, Bill Gates buys buffer overruns from YOU!
Thank you, thank you, folks! I'll be here all week. Try the veal!
(heh: my CAPTCHA was micros - no joke)
I think this is a good idea, but it's unlikely to happen - by buying such a thing, Microsoft sets themselves up in a position of liability - something that software vendors have so far largely managed to avoid.
...
Say they buy one exploit, but not another, and some company gets caught by the other. Microsoft have put themselves in a pretty nasty legal liability position there.
Additionally, it'll look a lot like endorsement of black-hat practices, something MS will want to avoid...
Score:-1, Funny
Shout from the highest roof top in every city that black hats should be hanged. It won't be long before there's a mob ready to hang black hats. Better still, Microsoft comes out looking like the good guy.
Microsoft has employed this strategy for at least a decade now.
This story is preposterous.
Got Trader Joe's? friendwich.com RSS feeds work now!
There are a lot of intelligent people who would be willing to do it legally for far cheaper prices than the black market will pay to do it illegally. Not everyone is immoral. Personally, I'd like to believe that most people are basically good people.
Ben Hocking
Need a professional organizer?
The key question is, IMO, has their revenue been hurt more than it would cost to pay for vulnerabilities? I'd say it has. Sure, you could argue that the revenue loss is not a large percentage of their total revenue, but presumably paying for the vulnerabilities would cost even less.
Ben Hocking
Need a professional organizer?
It makes far more sense to be a legal, well rewarded security researcher with a useful CV than a criminal. Nothing gives a person ethics like being well paid for it.
Pining for the fjords
So, will we get massive Clone armies for hunting down rebel security holes? Boba Fett to the rescue!
Site slashdotted out? Use SharePapyrus under Site Directory
...where it begins. Microsoft's security analysts have access to the source code. If they can't find exploits before outsiders find them by reverse engineering, you have prima facie evidence that M$ is (a) not hiring very talented analysts, or (b) not motivating the ones it has.
I've worked for a (non-IT) company where if you invented something that saved the company a million dollars, you'd get a coupon good for a clock radio or a DustBuster. Billion dollars, maybe some luggage...and you were bloody well expected to be grateful. For some reason, we didn't invent much. Meanwhile, the company was spending millions on the endless parade of corporate self-help scams (Zero Defects, TQM, ISO9000, ad nauseam) that produced less than they cost.
At a minimum, an analyst who documents an exploit should get some kind of bonus based on an estimate of the damage it would have caused in the wild. Further, I think they should be working in an adversary relationship with the developers...your typical coder should look on them about the way a detective looks on Internal Affairs.
rj
The prices that these sorts of exploits command would make a significant hole in Microsoft's finances.
Have gnu, will travel.
I guess I'm confused as to why this is different than the government/police offering up rewards for criminals and fugitives? Sure it would be nice if Microsoft could solve all of this beforehand with some well written code, but I can understand how things get through considering the size of their code base and the numbers of people trying to collaborate.
If we don't have a problem with paying to get criminals off the street, why should we care if someone is getting paid for an exploit. If all these 'gangs' of spammers/exploit writers really are trying to one-up each other, why not turn in competitors' exploits to make them less virile and screw them over.
I will shred my adversaries. Pull their eyes out just enough to turn them towards their mewing, mutilated faces. Illyria
- Once you pay for the vulnerability, you've basically admitted it's there and that you didn't already know about it, and you might not want to do this.
- Your testing staff might try to game the system.
- You open the door to all kinds of bad publicity: people mad that their exploit didn't pay, or didn't pay as much as another, or was ignored (when it was really unfounded)
Some of this might have been addressed in TFA or even the summary (I didn't read the whole thing - sorry!). My point is just there are some negatives, and for a PHB they probably outweigh the positives (especially when measured in $)Prov 9:8 Do not rebuke mockers or they will hate you; rebuke the wise and they will love you.
I wonder if this strategy could be used as a means to averting terrorism?
That is, don't just offer large amounts of money for the most important terrorists (like bin Laden), but also offer varying amounts of money for reports that stop terrorism.
OK, give us your info, and we'll pay you if we consider it's genuine.
(2 days later) Guess what, it's not a true exploit. Sorry, no pay.
(1 week later, at Windows update) We've fixed a patch for a recently discovered vulnerability!
Rewarding unethical behavior?
What could *possibly* go wrong?
You are attempting to read sigs. Cancel or Allow?
Would be for Microsoft to simply open source the entire Windows kernel and everything else. Winning the security race is an impossible task these days - it means buying positive press, paying for scumbag hackers who have no scruples etc. etc. It's clear over the past decade that it is impossible to add security as an after-thought to a shoddy security model.
If MS releases everything else except a few secrets and binary drivers, these security researchers will find their entire industry crumbling down instantly, and users will have a genuinely secure experience - since they will now be able to examine exactly what hackers and trojans are up to.
Of course, Microsoft's own Live One Care and tech support will suddenly be over-staffed, but that would be a pleasant problem, wouldn't it?
If you keep throwing chairs, one day you'll break windows....
In my experience, MS aren't interested in reports of security holes anyway.
I found a security hole in an MS product about 6 months ago so I sent a full description with working test code to secure@microsoft.com.
I got an automated response (so far so good) but then I heard nothing more. After a month, I sent them another email to ask if they were doing something. Silence. Another month later I rang Microsoft support and asked them to give me an update. They told me that the case number doesn't exist and that they don't have a department called the "Microsoft Security Response Center".
Eventually I found an engineer who does support for the product with the security hole. He said he'd heard a _rumour_ about the MSRC and offered to track them down. Eventually, I got an email update from them saying "we might get round to fixing it in a few months."
In short, if they're not interested in free security reports, why would they pay for them?
To er is human.
What about the exploits that aren't accidents, but are actually designed in, ie (har-har) Active-X controls that allow anyone to execute arbitrary, unrestrained code on every system that visits a website. Paying for someone to report these obvious exploits would amount to paying someone to call you an idiot.
The author's problem is that he thinks Microsoft should be concerned about delivering a good product. Everyone privy to how corporations work knows that the goal is only to deliver a product that the customer will pay for.
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
While I like your sig (though I don't recognize it as a reference), what the hell is a Zu-30? The closest I can come up with would be the Tunguska AA system being incorrectly referred to as the ZSU-30-6.
You might consider revising it to ZSU-23 (actually, ZSU-23-4 would be more accurate -- that's the old Shilka, but they're still used IIRC) or 2S6 (Tunguska).
Failing that, could you at least tell me where the line is from?
Fill in your four or five-letter word of wisdom here _ _ _ _ _.
No technology company in the world spends more money on security testing than Microsoft does. At any one time, it's likely that Microsoft retains a plurality of the security testing industry to perform code review and black-box testing on the myriad of products they are releasing this cycle. These aren't Microsoft employees; these are team members of the boutique security consultancies being paid directly by Microsoft to find vulnerabilities in products before they ship.
Microsoft is already paying for vulnerabilities. Investigate and you may find that just as Google singlehandledly jacked up the comp for every web-savvy C/C++/Java dev in the valley, Microsoft has amped up the bill rates for security consultants worldwide. Entire consulting outfits are built around pipelines of Microsoft work; some of the best and most famous researchers in the world work for these outfits.
Seven years ago, it was probably valid to single out Microsoft for carelessness about software security. But, just like this essay implies, software security is a problem that money can impact. Microsoft has lots of money. Since Windows XP, they have certainly put it where their mouth is.
There are differences between "true independent security research" and contract work for vendors. They're not clear-cut enough to make a value judgement. Researchers on contract to Microsoft get access to source code, developer documentation, test tools and the dev team. They also find problems before customers are exposed to them. On the other hand, indie researchers don't have to pass phone screens, know how to sell, or have the right contacts. Both groups find stuff.
It's worth noting that the overwhelming majority of external Microsoft findings in 2007 come from vendor-sponsored "research labs", usually attached to IPS signature farms (like the ISS "X-Force"). These groups strain the definition of "indie", are already well-compensated, and will continue to harvest findings whether or not an incentive scheme is created.
In any case, "WabiSabiLabs" is unlikely to have any impact here. Every major product Microsoft releases has been audited by a competant third-party. Microsoft has re-vamped their coding standards, deprecated old C/C++ idioms, introduced new ones, developed internal tools, adopted static analysis, and instituted a culture of security design reviews that starts before the first line of code is even written. As a result, a major "indie" Microsoft finding is a big deal. You'd be naive to put it on some fly-by-night auction site; a Microsoft remote code execution finding is already liquid in the grey market today.
Several arguements where covered, and comments are just rehashing them. Yes, you will have people that sell to both sides, yes prices may get driven up, but it's also going to drive up the number of honest people out there. For every exploit sold to both sides, how many will be discovered by honest people that otherwise wouldn't have invested the time without any returns. So what if an exploit is sold to both sides, better M$ be working on a patch while the blackhats are still making / destributing the explotation system vs. M$ being completely behind and the exploit in place before the patch comes. M$ could even go for something that doesn't really cost them as much, like instead of cash, copies of software. Blackhats aren't going to worry about something they would steal anyway, but many whitehats could put an MSDN subscription to use. It's almost like the old MAFFIA arguement... does it really cost M$ anything if they wouldn't have bought the software anyway, which only leaves them out the cost of the media.
An I.T. motto in the hands of an idiot is a dangerous thing...
Does he realize that he is talking to people who write software and operating systems in their spare time and give it away for FREE?? And he is trying to justify his greed to people who would mostly do what he wants for free as well? And he tries to manipulate us into thinking it's ok by using Microsoft as an example.
If he wants to try to make money off of exploits and the like, then let him go take it up with the vendors. There is no reason to try to appease his conscience by preaching here that we should agree with him. If you think it is a good idea dude, do it! Don't be bothering us about it or worrying what the rest of the world thinks of you.
--
Looking for a C/C++ job in Silicon Valley?
Qxe4
As many people have pointed out, Microsoft's problem is that they don't seem to take the "big picture" approach to bug fixing often enough. I mean, how often have we known that buffer overflows are a problem? Microsoft itself even has a page on safe string handling functions to replace strcpy and its ilk. Switching to these functions is trivial.
Microsoft has harder problems facing it-- buffer overflows are only one class of problem. But it seems that Microsoft's highly compartmentalized development process prevents someone from saying, "You know what? We keep seeing the same kinds of bugs. We need to require that all our developers do X." Until someone at MS does this, we're going to see this patching go on indefinitely.
There is one word that describes this sort of thing: Blackmail. 'nuff said
Step 1. Discover Exploit
Step 2. Submit Exploit to MS for prize
Step 3. MS rejects exploit saying they already were aware of that, thank you, try again.
Step 4. MS patches previously unknown vulnerability using free 0 day information.
Step 5. MS gets great PR for stepping up their security program and fixing tons of stuff.
You MIGHT get some of the big players to go ahead and play along and pay. But given the behaviors of most of the companies involved in the major security issues...good luck getting paid.
The only change I can believe in is what I find in my couch cushions.
There already is a cash incentive and bad people are already involved. The idea is to provide a cash incentive for (more) good people to get involved in a positive way.
Ben Hocking
Need a professional organizer?
There's only one reason why everything in the modern world is turning to shit.
With arbitrary performance metrics set by clueless assholes in management, it's easier to meet goals by fiddling figures and ignoring problems. So not only are the Microsoft security response team ignoring reports, they're combining patches and silently patching in order to make the stats look good.
Proof that Microsoft still don't "get" security; they see it as a marketing exercise.
People keep submitting stories to Slashdot about WabiSabiLabi, but when you go there, there really isn't anything to see. Is WabiSabiLabi the story, or is the story WabiSabiLabi? Look, six months from now, WabiSabiLabi will be gone for fairly obvious reasons. It was a fair shot at Internet cash, but the Dot Com bubble burst, and people just are not really interested in that kind of business model anymore.
If you want news from today, you have to come back tomorrow.
This idea may seem great on paper, but in order to buy an exploit, a person would have to provide payment, which is the fatal flaw. Now, lets say the feds want to get a quick list of people that may be using exploits for unlawful computer access. subpoena the DB of the exploit auctioneer, and wa-la, a giant list of exploit users. Like shooting fish in a barrel. something tells me this exploit auction system may work ok if companies purchase it, but i dont think underground exploit buyers are going to surface to harvest exploits from this website..
I've had comcast before, theirs along with several other sites say their site does not work with firefox, etc. however, using firefox and changed what the useragent sends does not break the site... In otherwords, it seems to be a simple check to see if your using IE, and if your not, they will tell you the site wont work, even though it really does (most sites). 1) Use firefox anyways 2) go to about:config 3) add config.about.agentoverride 4) set the string to the browser/os you want comcast to see.
If Microsoft would take on something like this; and their marketing department spun it the right way, it would be much cheaper than paying for Google ads.
there's one obvious thing [Microsoft] can do to help protect users: offer to buy up the security vulnerabilities themselves.
Sure, because the way to keep folks off your lawn is to erect a fortress and then reward anyone who breaches it with cash.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Because Microsoft's security strategy is to pretend that they have less security flaws than the competition. Even when they *do* admit to flaws, they're usually behind on patching them. In fact, the whole thing would be a bad idea for Microsoft as a result. They'd end up with a huge number of known flaws, and still lack the resources to do anything about them.
(I see far too many machine with eyeball identifiable malware despite the fact that the customer is fully patched, anti-virused, and anti-malwared (blacklists suck, they really do) to believe that MS is capable of coming even close to patching all the flaws. Even with the added protection of third party help.
Liberte, Egalite, Fraternite (TM)
Microsoft is much better off contracting with a security company who has some sort of agreement with them. Paying rewards to random schmo's has all sorts of inherent problems associated with it. The only legit way to leverage finding exploits into cash is to find a lot of them, give them to someone (either MS or a aforementioned security firm), play a little politics and get yourself a contracting job to find more exploits for pay.
The economy doesn't work out. To use some exploit a bad guy needs one. To prevent exploits MS needs them all. Say your band of white hats finds 1000 exploits and sells them to the highest bidder. Bad guy bids $1 million on all of them and satisfies his goal for $1 million. To prevent this, Microsoft has to pay 1000 x $1 million = $1 billion. They can't win, the idea is dumb. MS is better off not encouraging more exploits.
Because if MS fixed it quickly...
That's a mighty big if.
When our name is on the back of your car, we're behind you all the way!
1) Get a job on the Microsoft Windows team.
2) Build in a bunch of exploits.
3) Retire.
4) Expose the aforementioned bugs.
5) ????
6) Profit!
Have gnu, will travel.
If MS offers 10,000 dollars per exploit then thats going to be the minimum bid in the market. Someone will then offer 10,500 and the enterprising hacker will go for the extra cash.
Only if you assume the amoral hacker.
I posit most people are moral, and most people also have to pay the bills. Given the choice between $0+morality and $2500+immorality, most will chose the second, because $0 gets you starved and on the streets. But given the choice between $10K+morality and $10.5K+immorality, most will chose the first option. Neither figures in the risk of jail-time either. I'm sure a dyed-in-the-wool economist could come up with a value to dock from the $10.5K for risk.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Which is the whole point here. The issue that Code Red exploited has been available for a month before it hit critical mass.
All your buffer overruns would belong to Gates.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 is the magic number.
You are right but look at it this way! People don't blame Msoft for the hack they blame the hackers. It's like someone steals from a house do we blame the robber or the locksmith? It's up to the people now!
However, I think this approach would go down in flames in a matter of months. Why? Well I worked for 3 fortune 500 companies and anything that happens in these large companies is very, very slow. Microsoft or any other company buying exploits would need to verify the exploit before paying out the bounty. So some security researcher finds a potential exploit, sends it to MS or another company. Now the fun game of waiting and waiting and waiting begins. If your lucky, you will eventually be paid. Oh, and part of the submittal of the exploit will certainly include an NDA to not release the exploit. If you get tired of waiting to be paid for your work and release the exploit, get ready to be sued.
Another big thing I see happening with closed source companies is non-payment for exploits. For example, MS pays for some big-ticket exploits, creates a patch and in that closed source patch they include some of the smaller ticket exploits and reject those small ticket exploit submissions as not being verified and then don't pay. What recourse would you then have? Sue Microsoft of some other large software company that can keep a court case going for months costing millions? What person submitting an exploit would have millions to spend on a court battle to be paid the $1,000 for their exploit?
I think the only way to get companies to react to exploits is to:
- Send the exploit to the company.
- Give the company 2-3 weeks to respond.
- If no response in 2-3 weeks, release the exploit
- If company responds, get a firm date of fix release
- If fix is not release in a timely fashion, release exploit
The only thing that motivates these companies is money, loss of money and bad press. If they won't fix their bugs, then force them to buy using one or more of the previous three options.General, you are listening to a machine! Do the world a favor and don't act like one.
The cost is not the $1000 per reported new bug.
The cost is in the evaluation of the bug reports
once you have a prize offered.
How many false or duplicate bug reports will
a large company such as Microsoft get once
it has offered such a prize?
Thomas
Reporters of valid critical security bugs will receive a $500 (US) cash reward and a Mozilla T-shirt
OK, maybe it's time to adjust the cash for the weak USD, but anyway...
There's a browser safer than Firefox, it is Firefox, with NoScript
From TFEssay: (a little edited)
"Perhaps you say that you would be willing to donate your organs to the hospitals for free, and I respect people who do that out of selflessness, but that's not the point. Even if you and some other people would do "organ-donation" for free, there are more people who would do it if there were prizes. The amount of people willing to donate organs for free, has not been enough to keep organs from being found and sold on the black market -- but if the hospitals offered enough money, it would be. Obviously if the hospitals offered more than the black-market prices, everyone would just sell their organs to them. But probably the hospitals could offer much less than the black-market prices and still put the black market out of business, because there are lots of persons who wouldn't sell their organs on the black market even for tens of thousands of dollars, but would be willing to participate in a legal "donate'n'earn" program for much less money"
Forgive me for even mentioning this but I expect that Microsoft already pays 100s of thousands of dollars every year for exploits in the form of salaries and overhead for the employees who work in their security division. Whether or not it would be more cost effective to buy exploits on the open market is more an issue for debate than whether Microsoft should pay to improve the security of their product.
The key to this issue is that exploring security holes should be treated as a business. This way it's all legit and nobody can object the principal of getting the maximum profit out of it. If Microsoft is willing to pay the most, so that their product is safe, so be it.
Thus creating a market for security. Linux distros and Apple could sell their security "credits" to Microsoft (or essentially anyone on the open market). In theory, eventually the market would come to an equilibrium. This then would then necessitate the government getting involved (which we all know would really muck things up) and figuring a way to measure security. The real problem is that there is no real incentive for Microsoft to change anything if they are flush with cash. And chances are it actually costs them more to change than to buy credits. Not unlike the big power generation companies and pollution credits, it's just another cost of doing business. But as the theory goes, other hungry, up-and-coming businesses will be motivated to innovate to a) not have to spend money buying credits and b) actually profit from from selling credits. The huge downfall of this market plan is that you end up sanctioning a public "bad" (like unsecure software or pollution) and with this system you never get to zero--there always has to be a market of buyers and sellers.
Badges!?! We don't need no stinking badges!
Guys, umm. I am dumbfounded. Expect to get paid for reporting a bug to Microsoft?
You have to pay them to report a bug. If you're on one of their "customers who have a right to report a bug" lists, you can get your money back, if they decide that what you have reported is a bug.
Having done tech support, I can certainly see their point. Easily 90% of what are reported as bugs in your product are, actually, something stupid and/or insane that the user has done. That kind've makes it tough to try to rely on your customers for bug reporting. 'Course, when your docs are opaque, and your tech support guys know less than many of your customers, your screening process isn't going to be all that effective, either.
... after all, if I told a company that I had found a security exploit but wouldn't give it to them unless they paid me for the information, I think they'd call the FBI. Some circles call this "blackmail."
This is a proposition filled with potential hazards to the exploit finder so, ironically, the safest and most profitable means of disclosure is through black auctions of some sort or another.
I believe a LAW would actually have to be written to exempt security experts from civil/criminal prosecution before anything like contacting the company directly and asking for money could be anything other than a risk to the discoverer or reporter of the flaw(s) in question.
I consider this to be a hole that product makers have created for themselves and I pray the industry (both the security side and the product side) matures to the point where there's a logical and acceptable process for handling these things. If it was something everyone understood like cars, safety and security standards could be more understood by experts and companies alike. (But then again, if the stuff said on "Fight Club" about how a company decides whether or not to do a recall on a car is true, then we're all pretty much screwed if they all think that way...)
Buffer overruns you.
Since Wabisabilabi are only selling exploits that affect Linux users, Bill should hold onto his money. Ouch Slashdotters :-)
Microsoft has money, they can buy exploits. Linux doesn't, so who will buy the Linux exploits and prevent them from falling into the "wrong hands"?
making it easier and more effieceint for exploits to be sold helps propeitary software vendors more the open source. I wonder how much people will like this when they see Linux exploits being sold.
if the exploit in question somehow comes under the "veil" of the DMCA, wouldn't that implicate the seller? Then if M$ or some other company buys an exploit does that then make them guilty as an accomplice or accessory? More to the point, DMCA sorta discourages "exploration" of various legalized electronic "protection" scams, so if MS were to offer to buy the exploits, it's almost like entrapment. Ug.
"Microsoft would buy the knowledge of the exploit, patch it, and it would no longer be an issue."
MS has already alot of unpatched vulnerabilities already. What make you think they will patch it ?. Who has the responsibility for an undisclosed bug ?
You assume they will patch them immediately. Why would they do that ? There is a reason why they are not patched : Its does NOT affect them! It does not make them LOOSE money! Why ? Accountability AKA : The principle that individuals, organisations and the community are responsible for their actions and may be required to explain them to others
Now go read any any MS EULA and you'll see they are not accountable for anything that happens to you if you use their softwares. Why ? Otherwise, MS would be bankrupted because of too much legal fees. And don't think about the government coming up with a bill for that. That would be political and corporate suicide. A solution is to keep the source OPEN. That way, no one will be able to sue BUT you can be damned sure your software will be patched!
Security and accountability will be the reasons for the oss revolution.
I'm all for this white/grey/black/ market. It bring the light on this very issue.
This is a stolen sig.
Is slashdot trying to advertise this service or something?
Seriously.. I`ve seen stories about this site like 3 times in the last month. And every time I visit the site it's the same 3 lame exploits.
Look, there are lots of good explanations here, and personally, I'm a fan of the "bounty system". When I first saw "bounties" for Ubuntu I was overjoyed! Feeding IT people is really important for IT growth.
However, in this case, the logical flaw is actually the market, do a cost/benefit analysis. Microsoft, as a monopoly, does not make or lose any significant amount of money on OS security flaws. Companies with a budget capable of supporting security flaw bounties, don't actually need them short-term.
These big companies are publicly held and security flaw bounties do not help quarterly profits, or even annual profits (why these are important is a different issue). If I have SAP running my 10,000 employee business I can't just leave b/c SAP has too many security holes, moving is very expensive. It's probably cheaper to eat a small customer lawsuit than to switch systems. Now, if I'm really smart/motivated/scared I may move off on the next upgrade cycle, but these cycles only happen every 5-10 years. So SAP won't set up public security bounties b/c it is not beneficial to their shareholders in any way they can fathom. MS has the same deal, sure they can make the OS/DB/IIS more secure, but it must already be secure enough as nobody's leaving, right?
You have the right idea, but the impetus for broad security testing is simply not there. The only people who would "benefit" from such bounties are actually the unestablished new-comers or the competitors to monopolies (like Linux providers). With an open bounties system, these companies can use the security feature as leverage for marketing their product. But these are still very long-term deals and such a company would need to convince investors that the long-term benefits of such an action outweigh the short-term costs.
In the case of say, Linux and LAMP and PostGreSQL, we're probably there. These guys are great candidates for such open bounties. And these long-term activities are likely to pay off. Mac OS X may benefit from the same interest as they try and poach desktop/home users. But MS and SAP and other dominant players can't deliver better profits to their investors with such a system, so they won't do anything until investors get scared and start demanding one. We're not there yet.
Keep in mind, my statement was a hypothetical response to a hypothetical statement in a hypothetical scenario. We're really stretching this farther than we should be... ...but you are nuts if you think that Microsoft isn't losing money from the countless security vulnerabilities in XP that have allowed massive botnets to form and attack. Corporations have technology purchasing cycles, and as time goes on, I think we will continue to see backlash from those vulnerabilities and worms by way of corporations considering alternatives.
Why do you think Microsoft has tried so hard to secure Vista, especially despite the complaints from security giants like Symantec? It costs money to hire programmer and to test for problems extensively before earning any revenue off of a product. Yes, Microsoft has deep pockets and other products to earn it money. But their investment in Vista was absolutely massive, and they took a damn long time to release it. They know that another security failure like the pre-SP2 days of XP would thrash their reputation very, very badly. There wouldn't be many CIOs out there not considering an alternative OS, and that is the last thing that Microsoft wants.
Ben Hocking
Need a professional organizer?
#1 The history of paying for exploits.
This is a relatively new phenomenon, but historically where it has happened vulnerabilities have been purchased on the black market, by security research companies such as iDefense (now a subsidiary of Verisign). The reason that these companies did this is because these were (and are) exploitable, and were being happily used by the criminal community. Thus, in that situation, iDefense and other similar companies were able to acquire information about known and exploited vulnerabilities, and inform software vendors so that remediation could proceed.
While paying money to criminals is not necessarily something that fills anyone with glee, except the criminals of course, it was reasonably clear that the action helped "the greater good". The same is far from true in the case of building a free market in vulnerabilities. The obvious point is that it if a vulnerability applies to some particular product, why should we assume that the legitimate owner of the site or software product will be the highest bidder? It could as easily be a criminal.
#2 Legality - testing.
At least in the US, for downloaded software, the situation is such that the legality of testing software for vulnerabilities is moderately safe. For website on the other hand, the situation is that researchers are on rather thinner ice. Some websites do publish policies which describe the situations under which they would never push for prosecution, although many still do not. (Although, the recent discussions on this subject are clearly spurring more sites to do this.) The net for websites is that whether or not the testing activity is viewed as being criminal or not is in large measure up to the tolerance, or otherwise, of the website operator.
#3 Legality - sale.
For sale of vulnerabilities, if a researcher approaches a company and says "I have information about a vulnerability in your product/service, and I'd like $x for it", the answer is that any competent prosecutor could get a blackmail conviction. If you are a legitimate security researcher, I'd argue that the last thing you want is to be branded as a blackmailer. And, per point #2, I think you will find that as more and more websites release security testing policies, that those policies explicitly will not indemnify researchers when the results of the research have been resold or in any way used for profit.
#4 Business ethics. ;-)
Granted that most security researchers are not in fact employed by the companies whose products and services they are researching, why on earth would anyone expect to be compensated by that company? For example, if you show up at the office building of some company with a ladder and bucket and then clean all the windows, the office manager might be grateful, but whether or not you get paid for it is another matter altogether. Why should vulnerabilities be any different? Don't all workers have the right to expect the windows of their offices to be clean and bug free?
"The time is always now" - Victor
And so who is going to buy up teh Lunix's security flaws? Lunis Torvballs? That's pretty unlikely, seeing as he is mopping the floor at peepshows to pay his bills. And you really think Steve Jobs is going to pay anything? Of course not: Apple will become just another PC vendor in 5-10 years.
Once again, FOSSies show their jealous obsession with Microsoft, and again they ignore the lack of security in their own flagship product, Lunix.
Microsoft's OS just keeps getting better and better, and Lunix keeps getting worse and worse. Heck, teh Lunix still hasn't caught up to Windows 95's tail lights. You guys need ANOTHER decade to figure out how to rip off Plug and Play?
"Obviously if Microsoft offered more than the black-market prices, everyone would just sell their exploits to them."
Yes, however from a business orientated viewpoint this portrays the company having its balls in the hands of 'outsiders'. As a smart 'enterprisingly minded' human being would you buy software from a company which you plan to deploy on thousands of machines, if you knew that some of the security testing and possible patch submissions on it may have been handled by x-cons/hackers/crackers/stfu/criminals/etc.
I am not saying it would be substandard, but I think that a lot of people would feel something intuitively wrong with that. In a lot of ways it's like saying you got a friends friend who is a robber to test out your alarm for you.
However, at the same time, as pointed out "The people they would be paying money to are not criminals or bad people, they're legitimate researchers who just can't afford to do work for Microsoft for free when they could be doing something else for money."
Yes, there is a lot of legitimate security researchers out there, but let's say the CashPerExploit deal was introduced. Do you not think there would be an adequate amount of better trained 'nefariously minded' exploit finders? One bad apple fucks up the box. If companies got the impression that there is a possibility their software supplier uses such people, I think their confidence in the company would loosen.
But having said that, once it becomes a business enough people might get 'trained up' quickly.
I work for a company who uses a variety of Microsoft Technologies deployed over quite a few machines. Not hundreds, or thousands, just a tad higher! You'd be surprised at how relaxed they are about security, but me, I am generally just paranoid anyway. This is the first experience I have had in an 'enterprise environment', but all of the above is just me suspecting that other companies have a different corporate strategy to their security. I must say, for how successful they are, they really do believe in solely using M$ products, and products developed by companies who have good relations with M$.
I don't know, maybe it's like being with a gang of people. You're either on the FSF's land or somewhere in Redmond. A sense of security fostered by a recorded long term relationship of software development companies. Maybe it's less about the company, and more about consistency derived from their strong relationship. Patches each month, deployment Friday, etc... A big corporate bureaucratic machine survives on things like this, a bit like the x86 idea, make it simple, and make it fast/reliable. Hah, I'm laughing too....
"Deco, ya stallin' it up to mouseys gaff? We'll get mad ourra'vih!"
Following the authors logic why stop there. Let's pay bank robbers to not rob banks, pay thieves to not steal cars etc. That's just my 2 cents, my pay to not steal this article :)
Bill Gates exploits YOU!
They're my Mom's. I did set up her web-site, though. :)
Ben Hocking
Need a professional organizer?
Someone who wants money for every vulnerability is a terrorist. And I am sure the mafia will get into the game sooner or later by buying up the vulnerabilities and trying to exploit them for profit. The auctioning only makes their job easier. Talk about helping the underground.