Security Research and Blackmail

harryjohnston alerts us to a story picked up by a few bloggers in the security space. A Russian security research company, Gleg, has discovered a zero-day in the latest version of RealPlayer 11. But they won't reveal details to Real, or to CERT, despite repeated requests. Details are available only to their clients who pay a lot of money for early access to such knowledge. To describe Gleg's business model Daniweb rather cautiously puts forward the word "blackmail." The story was first exposed in Ryan Nariane's Securitywach blog.

Comments

Intellectual Property

[thebear05]

Seems fair they have information and want to be paid for it

Re:Intellectual Property

[Penguinisto]

If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee?

I'm sure that you'd easily come up with a lot of reasons why it isn't cool.

On certain superficial moral levels, sure - proprietary closed-source shops would have it coming in a fashion. They make money from hidden information, so hiding information from them until a fee is paid sounds a bit like karma.

OTOH, that's not how we're supposed to work as a community, for one simple reason: end-users don't deserve the grief (which they would get in increased costs that would be passed onto them). Morally, a security researcher isn't supposed to hold information hostage and then credibly claim to be part of any ethical hacking community. At level best, they would be called grey hats; many would rightly call them black-hats.

...and what if the info turns out to be bogus, or an attempt to manipulate the best-guess fix into becoming an even bigger security hole?

Sorry, but there's a distinct lack of responsibility and ethics going on here, no matter how much you think the primary target may deserve it.

/P

Re:Intellectual Property

[thebear05]

How does your argument differ from the profession of a lock smith? They know how to get in your house, and you can pay them to get you into your house. Now is it ethical to withhold information that could be used to hurt others, I would say that I personally think no But if they have discovered something that is beneficial to someone compensation does not seem unfair if reasonable.

Re:Intellectual Property

[Penguinisto]

How does your argument differ from the profession of a lock smith?

I don't have a locksmith soliciting me out of the blue, demanding payment for his knowledge?

...and what if the weak-point is in a window, not a door? What if the weakness is in the garage door, the attic vent, crawlspace, or some other place where you'd not find a keyed lock?

Your locksmith is more akin to a security contractor or consultant - you specifically hire the guy to utilize his knowledge in order to fill a need which you yourself have (e.g. you locked yourself outside of the house or car). You don't have locksmiths coming to your door unbidden demanding payment.

/P

Re:Intellectual Property

[vux984]

How does your argument differ from the profession of a lock smith? They know how to get in your house, and you can pay them to get you into your house.

Great analagy! Lets work with that.

Can you pay a locksmith to open someone elses house for you? Can you pay him to show you how so you can do it yourself?

Of course not.

But it goes further than that... locksmiths are both Licensed, and Bonded in most civilised countries to help prevent exactly these sorts of activities, as well as any other sort of unethical activities he'd be able commit.

Now if the locksmith discovered some fatal flaw of some widely distributed type of lock, I wouldn't say he's obligated to turn the information over to the lock manufacturer. And if he wants to sell them the information that's fine too.

But in the meantime, he still can't go around disclosing the information (for money or otherwise) or using it himself, outside of the ehtical constraints of his trade. (that is of only openining locks for the owners, at their specific request.)

Your locksmith analagy is apt. Perhaps security researchers should also be licensed and bonded before they are allowed to to work professionally and provide services to the public. (Hobbyists hackers would still be free to bang away at their own locks in their own homes.)

Re:Intellectual Property

[timeOday]

How does your argument differ from the profession of a lock smith? They know how to get in your house, and you can pay them to get you into your house.

Go ahead and advertise a "locksmith" service to open the doors on anybody's home, without the owner's consent, for a fee. Then have fun in jail.

Here's a better analogy for a legal activity: auto makers who sell SUVs to whomever wants them, then tell the rest of us we need one to keep our families safe in the event of being hit by one. It's a classic arms race, the only real winner is the arms dealer.

Re:Intellectual Property

[piojo]

I don't think the parent should be modded troll, though the comment seems to be sarcastic.

But in any case, what can we say about a company that makes its living by finding security vulnerabilities and offering to sell their findings to interested parties?

1) If they sell their findings to people who want to exploit them (rather than fix them), they are scum.
2) If they do not do (1), these companies are useful, as they do make it easier for flaws to be fixed, even if they do charge money (and won't help if you don't pay them).
3) It's *mean*. It's not nice to solicit someone and say "I could fix your problems (and it wouldn't even take me any work!), but you have to pay me a lot."

Point 3 does not change the fact that this company's existence is useful. Further, it's a necessity if they want to continue to exist. They need to be paid somehow. (I haven't read the article, and I will eat my shoe if they actually are selling exploits to third parties.)

Re:Intellectual Property

[clarkkent09]

If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee? I'm sure that you'd easily come up with a lot of reasons why it isn't cool.

Honestly, I couldn't. I am sure there are security experts out there who would be able to improve security of my house but I certainly wouldn't expect them to do it for free. This idea that if you find bugs in a software product, you have the responsibility to give that information to the company that makes it, and therefore help them improve their product, for free is completely bogus.

Sorry, but there's a distinct lack of responsibility and ethics going on here, no matter how much you think the primary target may deserve it.

I don't see any ethical problems here and its completely irrelevant who the party involved is. I would actually argue that there is more of an ethical problem with testing a company's product for free, as it devalues the work of their own QA personnel, and it encourages companies to release shoddy products too early, with expectation that paying customers will help them fix the bugs.

Re:Intellectual Property

[jacquesm]

even fairer, they *did* release information, precisely one bit worth: is there an unpatched exploit in real ? the answer is 'yes'. So now all real has to do is get off it's ass and do its job *or* open source their code and we'll help them ;)

Re:Intellectual Property

[Edward Teach]

BS. That is exactly what security analysts do. They research security problems. Whether it is how to break into your house or how to break into your computer is no different.

If I want my house to be secure, I can either secure it myself or I can pay someone to tell me where the vulnerabilities are.

Re:Intellectual Property

[Blkdeath]

Go ahead and advertise a "locksmith" service to open the doors on anybody's home, without the owner's consent, for a fee. Then have fun in jail.

FWIW, there are security firms that specialize in exactly that. House being one of a personal residence, a corporate office, a warehouse, or any secured facility that a company wants audited. What better way to audit one's security than to hire people with technical knowledge on how to enter establishments they shouldn't be in? It's one of those niche businesses that savvy reformed criminals tend to start up because they're the ones with the unique skill sets to do so.

Here's a better analogy for a legal activity: auto makers who sell SUVs to whomever wants them, then tell the rest of us we need one to keep our families safe in the event of being hit by one. It's a classic arms race, the only real winner is the arms dealer.

Ahh, a car analogy. Auto manufacturers sold products their customers asked for, and what their customers asked for was a bigger vehicle that was neither a pickup truck or a minivan, hence the SUV was born. How is being hit by an SUV different from being smucked by a minivan? Yaris and Fit don't work so well for families of 6 or 7.

As to your analogy, no, it's not comparable because RealNetworks aren't the ones selling the exploit code to people, they're the ones being "blackmailed". Hell-o?

Re:Intellectual Property

[Blkdeath]

But in any case, what can we say about a company that makes its living by finding security vulnerabilities and offering to sell their findings to interested parties?

1) If they sell their findings to people who want to exploit them (rather than fix them), they are scum.
2) If they do not do (1), these companies are useful, as they do make it easier for flaws to be fixed, even if they do charge money (and won't help if you don't pay them).
3) It's *mean*. It's not nice to solicit someone and say "I could fix your problems (and it wouldn't even take me any work!), but you have to pay me a lot."

Couldn't we just consider this a public service, let the software giants and consumers learn a lesson from all of this and move along?

Our society has become so focused on instant gratification that it's built itself into the production models of physical products and software packages alike. "Release it now! Damn the QA! Mush! Mush!" is the battle cry of the upper management and bean counters.

Well what if we delayed releases of products until they were right and let the people learn to wait? What if people became used to paying slightly more for a product that was of higher quality rather than wanting to shave every buck they can?

Bad enough that RealPlayer is pre-release quality bloatware rushed to market for its entire lifespan to compete with other media formats. Too bad it didn't become the ubiquitous media format they wanted it to be. {rolls eyes} So now I think it looks good on them to have to pay money to fix a vulnerability that affects their entire client base. Now the question becomes this - how concerned are they about the security of their clients? Are they willing to fork over the dough or are they going to stamp their feet in moral defiance and let their users twist in the wind?

Re:Intellectual Property

[Penguinisto]

So show me where Real contracted these guys.

Therein lies the problem. It's like some guy showing up at your house, saying that he knows exactly how he could break into that house, but he'll tell you how if you only pay him some money.

In short, nobody asked them to research the bug. They did the research unbidden.

If it's a question of fixing bugs for free, then quite simply they could just not do the research.

/P

Re:Intellectual Property

[Penguinisto]

BS. That is exactly what security analysts do. They research security problems. Whether it is how to break into your house or how to break into your computer is no different.

So if someone came up to you unannounced, and said they know exactly how to break into your house, but won't tell you unless you pay them some money, you'd have no problems with it?

If I want my house to be secure, I can either secure it myself or I can pay someone to tell me where the vulnerabilities are.

I don't argue against that. It's the unsolicited nature of it that irks.

/P

Re:Intellectual Property

[OverflowingBitBucket]

I will eat my shoe if they actually are selling exploits to third parties

I'd start cleaning your shoes and grab a knife and fork, just in case. From the article:

Indeed, there appears to be a legitimate concern over what benefit the customers of Gleg, who were informed about the problem, would get by having such client side exploit information before the vendor can patch it.

If my reading is correct, they're passing that information off to their "customers". Anyone who pays them, basically.

If Gleg offered to sell the info to Real, but told nobody else, I'd say that's fair. They deserve to be compensated for their work. However, it would appear they aren't doing this though. They're making sure other people know about the exploit, and are charging the vendor for the information they are going to need to defend themselves from the damage they are causing. That's akin to blackmail.

Re:Intellectual Property

[bluefoxlucid]

Picking locks is an ancient art based on known flaws in lock construction. You can get a book on cracking any given lock, even 'pick-proof' locks (they have flaws, most are published, some just aren't yet known). Fixing them is expensive and difficult. And FYI, lock smiths don't charge for emergency situations; a lock smith will charge you $40 or so just to pop open the lock on your car if you lock your keys in, but if you've locked a kid in the car they go out immediately and do it for free (if not, don't deal with them anymore, find someone else; all the ones I've seen do). It's part of responsible use of your skills.

Re:Intellectual Property

[forgotten_my_nick]

"If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee?"

That in itself is a fair point. I mean what if you are working in the security industry and are trying to secure someones business. You certainly aren't going to do it for free.

The issue here is more like after the home owner saying they don't have the money or can't pay that you sell the information to whoever wants it. That I am pretty sure is illegal.

Re:Intellectual Property

[bluefoxlucid]

I already know exactly how to break into your house. Hello official MIT lock picking course (which they condensed into a book you can pick up at your local Barnes & Nobel). I also know how to bypass most residential security alarm systems and some commercial ones (example, store glass with alarm tape? The grey stuff is metal conductive wire. Drill a small hole through a window next to (or through!) the tape, stick a wire through and to one side, use a soldering gun to secure the wires. Drill through another window, repeat. Smash the window between those two. Alarm doesn't go off!) *shrug*

Re:Intellectual Property

[martinX]

Security researchers. In Russia. Licensed and bonded. I can see that working...

Re:Intellectual Property

[Blkdeath]

And FYI, lock smiths don't charge for emergency situations; a lock smith will charge you $40 or so just to pop open the lock on your car if you lock your keys in, but if you've locked a kid in the car they go out immediately and do it for free (if not, don't deal with them anymore, find someone else; all the ones I've seen do). It's part of responsible use of your skills.

Why should they? You're telling me that because you were so callous as to lock your child in your car you should get free assistance to let them out? They have to waste their time, energy and fuel to get to your location, provide their valuable skills to you and you expect them to do this for FREE??! What world are you living in?

Re:Intellectual Property

[QuantumG]

It's "just" like that except that there's a hundred more complications. Please fit into your analogy:

* Intrusion Detection Systems.
* Malware.
* Anti-Malware, and Anti-virus software.
* A rule that says you are not allowed to reverse engineer your own home.

oh, and all the vulgarity of copyright law.

This is why reasoning by analogy is not only stupid, but also pointless.

Re:Intellectual Property

[bluefoxlucid]

Because if they don't, your kid can starve or freeze to death or get cooked in the summer. Babies have died in cars. And letting people off "because they can't pay" is complex and leads to scams and paranoia and all kinds of weird legal confusion so it's easier to just say "Screw this, don't worry about the money" and refuse to take payment at all. I guess some people just find it hard to put a price on someone's life, at least a price on a few dollars of gas and 20 minutes of work time against someone's life.

Re:Intellectual Property

[clarkkent09]

Well, perhaps then Real should include a note with their products saying "our product may contain security bugs, but pretty please don't try to find them as we prefer that nobody should know about them". It doesn't work. Bugs are there to be found, and somebody will find them sooner or later. If I was their customer, I would actually prefer to pay in order to have a security hole fixed, then to live with it and hope that nobody ever finds out. Take Consumer Reports. They find all kinds of problems with various products and they make that information available. I like to know if a product I have or plan on buying has some serious problems, so I consider it a very valuable service. But you got to pay for it, its not free.

I see your point about possibility of a veiled threat that "if you don't pay me, some criminal might, wink wink", and maybe it is, but unfortunately there isn't much that can be done about it. If you want that information and they put in effort to obtain it, then they have the right to charge you for it.

Re:Intellectual Property

[Mathinker]

Either you (and the guy whose kid is locked in the car) lack imagination, have very screwed up priorities, or the car in question must have heavily armored windows, eh?

In cases of emergency, almost always you can find something in the immediate vicinity which can break a car window.

Assuming this is the case, the locksmith is just saving the guy money he would have spent on repairing a broken window in his car, so I see no problem in the locksmith demanding money for his services.

Now if the guy somehow locked his baby in his high-security safe, or even his heavily secured house, I can see your point. Although in the case of the safe, I think the authorities should probably investigate somewhat...

Re:Intellectual Property

[module0000]

But it goes further than that... locksmiths are both Licensed, and Bonded In the USA, there is no federal licensure nor bond required to operate as a locksmith. You sir, are a dumbass.

Re:Intellectual Property

[do_kev]

Honestly, I couldn't. I am sure there are security experts out there who would be able to improve security of my house but I certainly wouldn't expect them to do it for free.

Oh? And how would you feel if a security expert was to go and find all of the security flaws of your house, and then offer to sell them to the highest bidder, as is essentially being done here?

I don't see any ethical problems here and its completely irrelevant who the party involved is.

Really? I'm not saying security consultants shouldn't be compensated for there time, but doesn't my above point illustrate why it's fine to charge the company, and fine to publicize that you have found a serious security hole so as to encourage the company not to just sidestep the issue, but to sell it to the highest bidder? Who's going to pay for this anyways? Somebody who's going to use this information to recompile their version of realplayer to be more secure (ha!)? Or somebody who's going to use this exploit to make more money than they paid for it in the first place, probably at the cost of innocent end-users?

Re:Intellectual Property

[blackdew]

we're supposed to work as a community

WTF community?
If real wants a free "community" to find their bugs for them they just need to opensource their code. Failing that i find charging them $ for finding bugs perfectly reasonable.

Re:Intellectual Property

[superskippy]

The problem is that there is only one legitimate customer- Real. Why would anyone else want this information? Only to break into your computer. There is no use selling to end users since they aren't going to be able to fix it even if they know about it (almost certainly). An end user only needs to know one piece of information- Real 11 isn't secure- and they've given that information free to the world.

By selling to whoever pays, they are in effect blackmailing Real- "we are going to sell this info to lots of bad guys unless you pay up".

Re:Intellectual Property

[jmo_jon]

You obviously missed the part of the post saying in most civilized countries

Re:Intellectual Property

[TheVelvetFlamebait]

If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee?

I'm sure that you'd easily come up with a lot of reasons why it isn't cool.

Only if there was an implied threat with the offer of information. If someone did that to me, and somehow managed not to imply some kind of threat, then I would consider money fair exchange to make a positive difference to my house's security.

Hey wait, isn't that what my local security firm does?

Re:Intellectual Property

[FailedTheTuringTest]

Who said anything about *federal* licenses? But nine states (Alabama, California, Illinois, Louisiana, New Jersey, North Carolina, Oklahoma, Tennessee, Texas) and New York City license locksmiths. (Associated Locksmiths of America

Re:Intellectual Property

[1u3hr]

Therein lies the problem. It's like some guy showing up at your house,...

No it's not. Why do people keep arguing by analogy? Analogies are just handwaving, they prove nothing.

E.g., in this case it's not "your house" -- an idea that carries an irrelevant freight of the idea of invasion of personal space -- but a product being used by millions of people. The issue is not just that it affects the "wner", but all those who use the product, and who have some expectation that Real pays attention to their security (of course, legally, no doubt it's disclaimed comprehensively).

Re:Intellectual Property

[Venik]

Look at the situation in more general terms: there is a consumer product that contains a flaw. There is a company that identified the problem and developed a solution. Finding both the problem and the solution required time and resources. This is their product. This product is being offered for sale with no restrictions.

Anyone can purchase this product. Just because you cannot obtain this product for free does not make it blackmail. There are countless products on the market that were developed and marketed in a similar way.

Re:Intellectual Property

[Anonymous Coward]

Are you fucking kidding me? I haven't even seen your house and I can already list 10. At least 5 of them are applicable.

No, I'm not going to tell you, and you're a stupid shit head if you get indignant over that fact.

Actually: never mind, I'll tell you.

#1: I use a pipe wrench on your door knob.
#2: I use some spark plug insulator on your window
#3: I slip the latch.
#4: I climb on top of your roof and cut a hole.
#5: I pick the locks
#6: I kick down the door
#7: I impression the locks
#8: I decode the locks
#9: I find an unlocked window/door
#10: I drill the locks

Having actually seen your house I could make a list 3 pages long. You're a stupid asshole if you expect me to do so for free.

Re:Intellectual Property

[Anonymous Coward]

"If I knew you have a life threatening disease, then told you that based on my DNA research I was able to heal you but won't tell you how unless you paid up a fee?"

How does the same question sound in a slightly different light?

Re:Intellectual Property

[segra]

"Can you pay a locksmith to open someone elses house for you? Can you pay him to show you how so you can do it yourself? Of course not." Why not? You can't expect us to believe that every locksmith on the planet is law abiding/ethical... And surly your not saying that someone can't teach another person a new skill?

Re:Intellectual Property

[segra]

Actually you could also look at it as "We are going to sell this info to whoever comes asking for it, until its patched at which time its no longer valuable and therefor there is no reason to sell it" Real should get their butts into gear and find the bug themselves (time/money) or pay the guy for the work he has done (time/money)

Re:Intellectual Property

[somersault]

Your analogy is slightly off. Even from just reading the summary you can see that this is like a locksmith with a list of criminals who subscribe to his mailing list. The locksmith works out the vulnerabilities in your security (most houses are pathetically insecure via lockpicking anyway, if you really want into a house it's not gonna be hard to get in), then lets these criminals know them, but refuses to let you yourself know what the vulnerability is. He doesn't demand payment from you - he refuses to give you the information for any price, because you almost certainly won't pay as much as all his other clients. Because you have millions of houses, with millions of [currency]s worth of currency.

For some reason when I first read the summary I was thinking of this company's clients as benign, but a second reading made me rethink :P

Re:Intellectual Property

[Anonymous Coward]

OTOH, that's not how we're supposed to work as a community, for one simple reason: end-users don't deserve the grief (which they would get in increased costs that would be passed onto them).

Knock off the end-user crap. Large business entities can always find a way to keep you from taking out your frustration on them directly. "You shouldn't chew out the first-level support drone for not helping -- he's just trying to make a living like you are." Well, shit on that -- I say put your executives or developers on the line and let me at them -- they're the fuckers who are responsible for my problems. If they won't take on that responsibility, I'll chew the ass off anyone they toss at me as cannon fodder. If nothing else, I can cost them money in telephone time and turnover.

While we're at it, look at the goddamned medical "community". They want everything for free. They go into the jungles and entice the indigenous people to show them plants with medicinal properties, then develop huge pharma products with that knowledge, then stiff the people who provided the basic knowledge.

Or the blood banks -- they routinely get people to donate something priceless for free, then sell it to the sick for huge amounts of money, well beyond the "added value" they've provided themselves.

All of these assholes, including the software vendors, try to get free material or information by sobbing about how it's always someone else's "duty" to give up whatever they have so the top predators can make a fine living off the givers.

Fuck that shit -- you're no different from us -- pay us what it's worth for what we have to offer or do without.

Re:Intellectual Property

[Anonymous Coward]

I think you're confusing the situation with your houses and locksmiths and all. Let me offer an analogy: you have a widely distributed piece of software and I find a serious exploit as part of my security consulting work. I of course would expect to be paid for my work by anyone who wants to benefit from it. Similarly, if I found a way in to your house as part of my analysis of major residential locksets, I'd expect you to compensate me for my time, expertise and the cost of the locks. See, all cleared up by analogy.

Re:Intellectual Property

[Anonymous Coward]

"Go ahead and advertise a "locksmith" service to open the doors on anybody's home, without the owner's consent, for a fee."

Nope, thats not fair. A fair comparison would be, "Go ahead and advertise a service which gives you the tools and information to open the doors on anyones home." I am quite sure that Gleg is not hacking into various servers for clients, but are providing information about a security weakness in a certain system for a fee to their customers. What a customer would do with that information is beyond the scope of this argument. Besides neither Gleg nor Real is a charity/ opensource/ community organization.

Re:Intellectual Property

[c0p0n]

The analogy police will come after you.

Re:Intellectual Property

[wireloose]

I see this as a good opportunity for a security firm to make a little cash for their efforts. The auction approach is not necessarily the best or most ethical approach as far as we, the consumers, are concerned, but we have no proof that they didn't approach Real prior to the auction, with a private offer.

Security firms take a huge risk these days even announcing they've found exploits and publishing them. How many links do you need to articles on lawsuits against blackhats for revealing an exploit, just because some software author doesn't want it known that they have security holes? I ask myself, "How many unpublished exploits are still to be found in existing platforms because the company knows about it but has buried the information and is in no rush to develop a fix?"

Re:Intellectual Property

[tha_mink]

Great analagy! Lets work with that. Actually, it's a poor "analagy". A better one would be a software security company figuring out how to keep their clients safe from poorly written software. Oh wait...that's not an "analagy" at all.

Re:Intellectual Property

[KDR_11k]

FWIW, there are security firms that specialize in exactly that. House being one of a personal residence, a corporate office, a warehouse, or any secured facility that a company wants audited. What better way to audit one's security than to hire people with technical knowledge on how to enter establishments they shouldn't be in? It's one of those niche businesses that savvy reformed criminals tend to start up because they're the ones with the unique skill sets to do so.

That still requires the consent of the owner of the property being audited, you cannot have them audit someone else's property.

Re:Intellectual Property

[MttJocy]

On this I would have to agree, It's akin to saying "If you don't pay us for this information we will use it against you" ie a threat thus blackmail. On the other hand if someone found an exploit in a system of some kind and notified the vendor/owner of that system of its existence and offered to turn over copies of all their documentation on the vulnerability so they could fix it but would not use or allow others to use the information in an attack it is not blackmail (By definition blackmail usually involves a threat of one form or another against the target, an implied threat like "we will only provide this info to third parties who pay us" where the intent of those parties is unknown is what makes it blackmail in this case IMO)

Re:Intellectual Property

[Anonymous Coward]

How does your argument differ from the profession of a lock smith? They know how to get in your house, and you can pay them to get you into your house.

Great analagy! Lets work with that.

Yes, let's work with that.

Can you pay a locksmith to open someone elses house for you? Can you pay him to show you how so you can do it yourself?

Of course not.

Really? I think that in both of these cases the answer is Yes.

If you are house sitting for someone and you lock yourself out I'm betting that you CAN find a locksmith to open the house for you. There have been cases where locksmiths have done exactly this for people. Whether the locksmith was duped or did it willingly with full knowledge.

As for the second statement, can you pay him to show you how, this is even more common. It's call training and it's how probably all locksmiths become locksmiths. For a price you can get all the tools, manuals, etc, and without a lot of hassle.

But it goes further than that... locksmiths are both Licensed, and Bonded in most civilised countries to help prevent exactly these sorts of activities, as well as any other sort of unethical activities he'd be able commit.

Yes, this is a good reason that locksmiths are licensed and bonded. Although you CAN be a locksmith without either. You point out that the licensing and bonding are to prevent these kinds of problems. I'd like to point out that they're there because of exactly these kinds of problems. Our "civilized" country is not really good at doing these types of things proactively, it's usually because something has happened in the past that we decide that we need to enact some kind of prevention.

Re:Intellectual Property

[Anonymous Coward]

James Bonded, would you say? With a license to kill -9?

Re:Intellectual Property

[ultranova]

In Soviet Russia, security bonds you !

Re:Intellectual Property

[Stiletto]

Oh? And how would you feel if a security expert was to go and find all of the security flaws of your house, and then offer to sell them to the highest bidder, as is essentially being done here?

I would feel like properly securing my house, for starters.

Re:Intellectual Property

[v1]

This seems to fit well with the russian "bulletproof hosting" offered to botnets in russia. I suppose those are their clients after all, looking for new exploits to grow their nets.

It's not surprising at all, and I'm sure it's nothing new. I'd imagine a new zero day exploit could result in hundreds of thousands of dollars in additional revenue for the botnet operators.

There's no reason for them to sell it to anyone but the highest bidder.

CERT's job isn't to get people to work for free and donate exploit examples to them all day long, their job is to identify and describe exploits in the wild. Heck this group is keeping them in business.

If they ask you "what's in it for me?" and you don't have an answer, then quit complaining about how they react.

Re:Intellectual Property

[Anonymous Coward]

If someone told me they knew how to break into my home, I would congratulate them on their success and remind them I sleep with a 10-gauge, I have a itchy trigger finger and absolutely no qualm with shooting intruders to protect my family.

Security researchers have a moral obligation not to release their ideas and discoveries into the wild because there are those; in government, in the community, and in business; who would utilize that innovation towards predatory, self-destructive means. This obligation is primarily to themselves; if blaster propagated silently and, say, overwrit the boot partition with a very good CHKDSK clone that instead of checking files ran Darik's boot n' nuke in the background, the internet would be a very different place. No hacker has destroyed the internet because it would mean the end of the society they enjoy so much.

This researcher owes Real nothing. They have no duty to inform then of their problems, just like I don't owe someone asking me to take a survey 5 minutes of my time.

Their discovery is protected as a derivative artwork. It's like telling people if you combine Mentos and Diet coke you can make a geyser or by purchasing a certain stock market algorithm you can make money appear from nothing. It's a form of innovation and should be encouraged. Nobody's going to destroy the internet by hacking real player; what will happen is someone'll buy the exploit and probably create some malware and infect some people's machines; it's like inventing the gun. The good guys have to buy them because the bad guys will buy them too.

If real media wants to patch their stuff so bad they can pony up; consider it a way of keeping them accountable for their actions. At the end of the day, the software company that is unwilling to pay for the security they advertise is like the lock manufacturer who creates a lock and distributes it knowing it can be exploited in 2 seconds with a paper-clip. Both are doing a disservice to the world at large. We've been giving software companies a free ride and they take it for granted; the Russians understand this. If Real had to pay $2,000,000 in blackmail money to a security researcher for 8 or 10 exploites they might invest 1 or 2 programming positions in making their code more secure.

As a sidenote, some people are quick to say "if we didn't have hackers" or "hackers are the problem lets not encourage it!". Congratulations; you have just stated the obvious. Guess what; we've got robbers, barons, industrialists, mass-murdering psychopaths, thieves, murderers, rapists, pedophiles. The only difference between them and the black-hats is their defined crime. If the community at large and the government subsidizes the software industries delusion about their codes security by tracking bugs then we end up in a worse condition. It's a lot like gun ownership; if everyone carrys a gun, everybody will be polite.

Re:Intellectual Property

[ultranova]

Because if they don't, your kid can starve or freeze to death or get cooked in the summer.

See rock meet glass. See glass break. Break glass break !

I guess some people just find it hard to put a price on someone's life, at least a price on a few dollars of gas and 20 minutes of work time against someone's life.

Maybe they could ask the person who refused to break his car window to save his kid for an upper bound ?

Re:Intellectual Property

[zotz]

I don't know that I like the situation myself, but the first analogy I thought of was not locksmithing, but patented cures for sickness... We seem to have a lot of that.

all the best,

drew

Re:Intellectual Property

[IndustrialComplex]

Why not? You can't expect us to believe that every locksmith on the planet is law abiding/ethical...

That was the point of his analogy. That it is unethical for a locksmith/security researcher to behave in such a manner. And to say that they are teaching a 'skill' is a long stretch of the definition.

Re:Intellectual Property

[Tolkien]

I would call them crackers rather than hackers of any colour hat, any day of the week.

Re:Intellectual Property

[Ronin Developer]

"Anyone can purchase this product. Just because you cannot obtain this product for free does not make it blackmail."

The researcher REFUSES to provide the information to REAL - it doesn't say whether REAL offered them money or not. Regardless, they are willing to provide the information to others (who certainly don't have REAL or their customers best interest in mind) while denying REAL the information necessary to close the hole and protect their customers in a timely fashion. This damages REALs ability to do business - if it isn't a crime, is should be. Is it blackmail? I'd sure as heck say it's pretty darned close. Ethically, it's just wrong.

It's a lot like someone coming up to you and saying, "I've seen you house...cute kids...btw, how to you like the new laser sight on my sniper rifle?". You can imply a threat from a statement like that - well, that's how Real is perceiving Gleg's actions as well - a veiled threat - and rightfully so.

RD

Re:Intellectual Property

[Anonymous Coward]

come on, you very well know there is a difference between worldwide sold programs and your entrance door.

Re:Intellectual Property

[Anonymous Coward]

Who said anything about *federal* licenses? But nine states (Alabama, California, Illinois, Louisiana, New Jersey, North Carolina, Oklahoma, Tennessee, Texas) and New York City license locksmiths. I don't think New Jersey counts. In New Jersey, you need a license to shit. Unless you've bought off the Governor, or maybe it's the teacher's union. Well, whichever one runs the place.

Re:Intellectual Property

[shadoelord]

So the knowledge of how to open a lock is illegal? Are you seriously advocating security through obscurity? Knowledge isn't a crime; acting on that knowledge is. Just because I know how to open locks doesn't mean that I'm going around opening up my neighbors homes.

If you spend time and money to discover a weakness in someone else's design, you deserve to get paid for it. Time is money.

Re:Intellectual Property

[elrous0]

Can you pay a locksmith to open someone elses house for you? Can you pay him to show you how so you can do it yourself?

Of course you can. How do you think new locksmiths come into being? They pay to go to locksmith school or apprentice with an existing locksmith.

It's not legal for a locksmith the break into someone's house for you. But it's perfectly legal for them to teach you to be a locksmith for a fee.

Re:Intellectual Property

[gunnk]

I think you've hit the nail on the head.

If the company knows of an exploit and wants to sell the information about it to the vendor that's perfectly fine as long as they aren't threatening to tell others about it.

It's much list noticing my neighbor has an open wifi point advertising his file shares. Nothing wrong with offering to show them exactly what the problem is for a fee. If he doesn't want to pay for my expertise -- well, I told him his wifi point is leaving him open to hackers, so he has been warned. Now if I say I'm going to sell the information to others if he doesn't pay me -- that's extortion.

I couldn't tell with certainty from the article whether or not the firm is showing the actual exploit to their subscribers or not. They may just be informing their clients of the existence of the exploit and giving guidelines about the severity and potential impact to business operations. If that's all they're doing, I'd say they are playing to win, but playing by the rules.

On the other hand, if they sold the actual exploit to their subscribers then they're criminals.

Re:Intellectual Property

[agbinfo]

Actually, the Locksmith Ledger will sell codes to open your locks and techniques to open your safe. They'll even sell lock picks. They probably won't sell them to you.

Also it's much harder to recall locks then to update software so the fact that the lock manufacturers get access to the same information doesn't help that much.

The difference is that if no one knows how to open your safe when you can't remember the combination, you'll be in trouble. If nobody knows how to exploit the Adobe exploit, there's no problem. Still, they could sell the technique only to the lock manufacturer but there's probably less money in that.

Re:Intellectual Property

[agbinfo]

But in the meantime, he still can't go around disclosing the information (for money or otherwise) or using it himself, outside of the ehtical constraints of his trade. (that is of only openining locks for the owners, at their specific request.)

The Locksmith Ledger and other trade magazines will disclose such information. If I'm a locksmith, I can sell the techniques to open locks to these trade magazines.

Re:Intellectual Property

[Anonymous Coward]

If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee?

I guess you haven't seen the movie sneakers. http://imdb.com/title/tt0105435/

Re:Intellectual Property

[Syberghost]

If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee?

I'm sure that you'd easily come up with a lot of reasons why it isn't cool.

Dunno about other countries, but in the US, I couldn't compel you to tell me. Unless I GOT broken into, and then the cops would question you about it.

Re:Intellectual Property

[Blkdeath]

FWIW, there are security firms that specialize in exactly that. House being one of a personal residence, a corporate office, a warehouse, or any secured facility that a company wants audited. What better way to audit one's security than to hire people with technical knowledge on how to enter establishments they shouldn't be in? It's one of those niche businesses that savvy reformed criminals tend to start up because they're the ones with the unique skill sets to do so.

That still requires the consent of the owner of the property being audited, you cannot have them audit someone else's property.

RealMedia gave me the software and in fact told me I needed it in order to play specific types of rich media content on the Internet. Now the software is installed on my computer as well as those on my LAN, so I'm going to perform an audit on the software to see if it's secure.

Where'd your analogy go?

Re:Intellectual Property

[bigdavex]

If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee?

Yeah, but what if it were a car? ;-)

Re:Intellectual Property

[xappax]

Your metaphor is silly because you presuppose that it's all about one person with a vulnerability, and therefore they're the only one with a right to know about it.

In fact, security vulnerabilities affect a whole lot of people in a lot of different ways, so there's plenty of reason to have a for-pay service which alerts anyone who signs up to vulnerabilities when they exist. What qualification do I need to have to be informed of a RealPlayer vulnerability, swear before a court that I have downloaded and installed RealPlayer?

And furthermore, there's reason to expect that an actual proof-of-concept exploit be a part of that alert, for verification purposes. After all, if I'm going to invest a lot of time and resources in responding to a security alert (especially if I'm responsible for a business or organization), I want to be able to confirm for myself that it's a threat to my particular setup, and that it's not some fuck-up by the researchers.

Re:Intellectual Property

[Venik]

Don't go overboard with your analogies. The important consideration here is whether or not Real was willing to pay the price to obtain this information or if it was expecting to get the information for free. Another key question is whether Gleg offered the information to Real at the same price as it did to the rest of its customers. The article does not say.

Real's perception of Gleg's business model is really beside the point: I, for example, have a problem with Real's business model of peddling consistently buggy software loaded with adware. Gleg has no obligation to provide Real with any information, especially considering that Real was the one who put out an unsafe product on the market in the first place.

What bothers people in this situation is the realization that Gleg could have done a great public service by providing the fruits of it labor to Real for free; by telling Real what the problem is and how to fix their stupid video player. Unfortunately, the days of Communism in Russia are over and money talks. If you are in business of selling defective products, you might as well learn to pay for your mistakes.

Re:Intellectual Property

[spinkham]

See rock meet glass. See glass break. Break glass break ! Have you eve tried to break a modern car window?
I have, and:
1) it's not easy. It takes a LOT of force to crack the window.
2) You get little pieces of glass with shard edges EVERYWHERE. They're not long jagged pieces like you would get from a non-laminated glass, but they can still cut you up pretty well.

It is possible with the right kind of tools (heavy blow, small area) to crack the window without blasting pieces everywhere, but with a simple rock, that result is not likely.

Shattering a window with a small child in the car is better then letting them cook, but still not a very safe thing to do.

Re:Intellectual Property

[xappax]

The researcher REFUSES to provide the information to REAL - it doesn't say whether REAL offered them money or not.

The researcher refuses to make a special exception and give Real the information free just because they're the software manufacturer. I'm sure if Real really wanted the information badly they could sign up for the researcher's service like everyone else does. What, you think they do some deep background check to make sure you're not with Real when you sign up?

Real expected to be treated special since they wrote the software, and when they were rebuffed they complained that the researchers had "refused" to give them the information.

Re:Intellectual Property

[gunnk]

Suppose I run a company that does security work for my clients. One of the things I do for them is run a battery of tests to see if I can break their security via any of their installed software. It seems to me that you are arguing that if I find something I have a moral obligation to inform not just my clients, but the vendor of the software.

Well, that's an interesting argument. I'm not sure I agree, but I'm not sure I disagree either.

On one hand, making sure the vulnerability is explained in detail to the vendor so that the vendor can fix it helps everyone globally that uses their software. On the other hand, why should I turn the results of my work over to them for free when they could have (should have?) found the problem themselves. It's kind of grey to me, so that's why I described it as "playing to win". I'm not making any statement whatsoever as to what you call the "qualifications" of the recipient of the information.

My big point is that I would withhold rabid condemnations of the security firm unless they are actually releasing the technical details to the highest bidder while withholding those details from the vendor.

Reporting details free of charge to the vendor is magnanimous. Notifying the vendor and offering to sell them the details (contingent on proving to them the problem really is on their end) strikes me as simply business. Notifying the vendor that you are selling off the details to anyone willing to pay is blackmail.

Re:Intellectual Property

[Anonymous Coward]

If you ever are involved or a witness to an accident, let me know how the negotiations work out with the person in the burning car.

Okay, I am going to be late for work and I am willing to pull you from this burning car. I am risking getting burned myself and possibly getting my clothes dirty. For $200, I will get you out of this burning car and 5 feet away, anything over 5ft is $4 a foot ronded up to the nearest foot. You can also purchase a package deal of pulling from the car and moving you 30ft away for $225 which a a 10% reduction of the normal price. If you need me to stop any bleeding or perform first responder aid, that will be another $100 a minute.

Do we have a deal?

Re:Intellectual Property

[ericrost]

Families of 6 or 7 don't work so well for the rest of us that believe that unchecked population growth is a good way to make ourselves either extinct or at a severely lower standard of living.

Keep breeding yourself into the hot, poor house. I'll work on sustainable development on both a local and global level so that folks like you will be looked down upon by history as the selfish fucks you are.

Re:Intellectual Property

[I)_MaLaClYpSe_(I]

Yes, that's the idea behind WabiSabiLabi, the Exploit Marketplace. Security Researchers have always been treated unfair, as it was always demanded from the to give their knowledge away for free, at least to the vendor. But what is the incentive for a white hat to do research at all if he is not allowed to make money out of it?

Also, why should said researcher not just turn into a blackhat and sell stuff on the black market if he is not paid for his work on the 'free' market because no such market exists?

Compare it to medical research: medical research requires great efforts and would not be done if you could not turn the results into money (usually by patenting). Is it unethical to patent drugs that could save many lives? Why does nobody point their finger onto the drug researchers but the security researchers are the unethical people?

If someone is willing to pay more for an exploit than the vendor, that's the free market.

The WabiSabiLabi guys experienced the ethical dilemma as well: They tried to resolve this issue and to create a free market for the security researchers but when they informed the vendor of an auction, they were called blackmailers. If they didn't do so, they acted unethical as well. So what?

BTW, there's a great video available from the WabiSabiLabi guy (Roberto Preatoni from Zone-H) at the HITB Kuala Lumpur Videos, the presentation is here .

Re:Intellectual Property

[xappax]

Notifying the vendor that you are selling off the details to anyone willing to pay is blackmail.

Blackmail involves demanding money from someone in return for keeping secret something you know. It seems like if you wanted to blackmail a company, you'd avoid selling the exploit information to anyone so as to keep it secret, and then tell the company that unless they pay X huge sum, you will release the information to third parties.

That's not what they're doing - they've already released the information to third parties, there is no secret and therefore no possibility for blackmail. They're offering to tell anyone about the exploit, and their condition is you have to be subscribed to their service. It seems like there are only two reasons to possibly object to what they're doing:

A) It's wrong to distribute information about vulnerabilities to anybody who's interested - such information should be restricted to a special class of trusted officials or corporate representatives.

B) It's wrong to make money off of information that could be provided for free. (i.e. intellectual property is wrong)

Re:Intellectual Property

[TrIp0d]

You don't have to worry about being hit my an SUV because it's an SUV. You have to worry about the over-worked realestate guru/soccer mom who's on the cell phone while driving the SUV. She could be driving a Mini...she'd still be on the phone. It's the phones that are the problem, not the SUV's. Now not only do the tree huggers have to worry about SUV wielding soccer moms in need of a cellphonectomy, they have to worry about SUV wielding soccer moms in need of a cellphonectomy tinkering with a navigation system and voice activated things that aren't listening to her, thereby causing yet another distraction. Now most cars have an MP3 player interface. So now while on SUV wielding soccer moms in need of a cellphonectomy is on the cell phone and watching the navigation system, she's now messing with iPod digging through thousands of files looking for that perfect song to cruise to because she's upset that Daddy's got to work late again to pay for all those gadgets. How ethical is that?

Re:Intellectual Property

[lucifuge31337]

You did it wrong.

Improvised side-auto glass breaking 101:
1.) Get an antenna from your car or the nearest one. Break it off.
2.) Make it into a U - hold both free ends in your one hand.
3.) Place this hand just outside the one corner of the window (your hand on the body of the car) with the rest of your "u" going across the window at an angle. Try to get the tip to hit in the bottom right or left corner of the window, about an inch or 2 from the edge.
4.) Pull the tip back with your other hand. Let go.

I mention this for one reason only - the getting child out situation. Anyone with malicious intent will simply use a brick, or, the proper tool (a spring loaded center punch). This way minimizes and flying glass, and make the window pretty much fall straight down in small pieces. Obviously you want to choose the window furthest from the child if you need to do this. Front and rear glass will likely not work with this technique, as they are laminated. We have specific saws and picks for this (glass masters).

Yes....I'm a PA certified vehicle rescue technician. Yes, I've pulled people out of cars using this method in a pinch.

Re:Intellectual Property

[Anonymous Coward]

Anyone who is reading this lives in a country where reproduction is barely at replacement level, or below. Nice random rant, though.

(Of course, anyone who is reading this also has no chance of reproduction anyway. This is Slashdot, after all.)

Re:Intellectual Property

[orgelspieler]

If you told me you knew how to break into my house, I would sit there quietly, smile, nod my head, and think to myself about how nice it will be to have a man-sized snack for my laser-wielding sharks.

Re:Intellectual Property

[m0rph3us0]

Hit it in the corner and it will break like nothing. Borrow a key from anyone around you and put it into the bottom rear corner of the glass and press as hard as you can, not only will it break but 90% of the glass will fall on the ground outside the vehicle. Pound on it in the center and you will be there all day. Wikipedia a "Prince Rupert's Drop" to know why it works like this.

Re:Intellectual Property

[shentino]

You wouldn't just get nailed for extortion. If someone actually did break into the house, you could be charged as an accessory in the B&E *in addition to* the extortion.

Re:Intellectual Property

[TheWingThing]

Such security experts will do the penetration testing at the home owner's request. They won't do it on their own, and then threaten to sell it to the highest bidder (read: other potential burglars).

Re:Intellectual Property

[Ronin Developer]

To say, "If your are in the business of selling defective products, you might as well learn to pay for mistakes" makes me think you are an opportunist or a bit of a sadist. My analogy may seem a bit over the top, but how would you feel if you or your company was the one Gleg decided to target? Do I like Real's products? No, I don't allow their stuff to run on my PC. But, that's me.

All software is subject to bugs - even the simple "Hello, World" can be riddled because of an issue with the compiler/interpreter or even at the hardware level. Same goes for just about anything else out there - cars, tv's, cell phones, paint, kids toys painted with lead-based paint - the list goes on. That's a simple fact of life. Hell, even good old H20 can be a problem for some people. How about Linux? How about GCC? How about the libraries we use when developing software - open or closed source? All seem to have known problems/issues/bugs, don't they?

When a company realizes there is a problem, most DO pay for their mistakes - they issue recalls, put out patches, endure law suits and/or go out of business. The aim with any business is to mitigate the risks. And, if you are operating in a capitalist society, you balance the risks against making profit. Nothing is perfect. Standard practice in our industry is to offer the information to the vendor of a product and give them a period of time to fix it. We gave them a chance to rectify the situation. If they don't, the information is made public. Then, we watch them squirm and have to deal with upset customers. I doubt that Real intended to intentionally release software the could potentially affect millions of users. Do you really believe that's the case?

As you noted, we don't know if Gleg allowed Real to purchase the information or at what price. But, as a consumer, if my identify was stolen or my system trashed because Gleg sold the information to somebody who used it against me? Well, I'd be pretty pissed off. And, while Real may have made an imperfect product, my anger wouldn't be exactly directed at them.

Re:Intellectual Property

[rdawson]

I can no longer sit back and allow, communist subversion, communist infiltration, and the greater communist conspiracy to sap, and impurify all our precious bodily fluids!

Re:Intellectual Property

[SMS_Design]

You clearly don't work in the security industry. People make their LIVING as information security researchers. If they don't get paid for their work, they don't do more research. If they don't do more research, bugs float around longer.

Blackhat researchers know how to get paid, so that will continue. It's estimated that the controller of the Storm Worm zombie herd is pulling up to 2 million dollars per DAY.

Re:Intellectual Property

[vux984]

Of course you can. How do you think new locksmiths come into being? They pay to go to locksmith school or apprentice with an existing locksmith.

Where in either case they are introduced to the ethical considerations of the profession, and are expected to agree to them in order to receive training. That's part of being taught to be a locksmith.

In some jurisdictions with licensing you actually even need a separate license to -teach- locksmithing, recognition of the fact that some discretion is appropriate.

Not that I agree that information about locks should be withheld per se; in fact framed like that I don't agree. But that's not the point, the point is that this tension exists, and it underscores society's struggle with the issue.

And a similar tension and struggle is appropriate with respect to security research, where on the one hand we don't want to lock information up, but on the other we find it ethically repugnant to sell exploits to the highest bidder while calling oneself a 'professional'.

Re:Intellectual Property

[Venik]

Gleg is not really 'targeting' anybody. This is what these guys do: they dissect latest releases of popular software and look for serious problems. It's not like Gleg's programmers put the bug into Real's player. They found an issue and let people know about it. This is a public service in itself.

Even if Real is not willing to pay for detailed information, at least now they know there is a serious vulnerability in their product and they know the general nature of the problem. Most importantly, now YOU know there is a big hole in your Real player, so you have an option of NOT USING IT until Real comes up with a fix. Now tell me this is not useful information?

And if anyone buys this information from Gleg and illegally uses it to compromise your PC, you have only yourself (and Real) to blame: you knew there was a problem but you continued using the product.

Everything is really up to Real and whatever comes is entirely their responsibility. Whether they choose to pay for information or deal with the bug on their own - its their product and their responsibility. Of course any software has bugs. Who's responsibility is it to fix these bugs? Gleg's? I don't think so. Not for free anyway.

Re:Intellectual Property

[Dun Malg]

The Locksmith Ledger and other trade magazines will disclose such information. If I'm a locksmith, I can sell the techniques to open locks to these trade magazines. Indeed, The Locksmith Ledger is probably one of the best places for "0-day exploitz" for bypassing automobile door locks. You think they call up Ford and say, "Hey we found an easy way into the new Taurus"? Heck no. They let Ford subscribe to the magazine and find out the same way everyone else does. And what does it take to subscribe to The Locksmith Ledger? $47 and a mailing address. Sure, they ask you what kind of locksmithing you do, but they don't ask for state/city license numbers (they can't, as some states do not have licensing). Seems like all these people should be mad at LL too, as they're telling CAR THIEVES how to STEAL THEIR CARS!!!!!

Re:Intellectual Property

[Dun Malg]

if you've locked a kid in the car they go out immediately and do it for free (if not, don't deal with them anymore, find someone else; all the ones I've seen do). It's part of responsible use of your skills. I'm a locksmith. If someone said "come out and get my kid out of the car for free because I have no money" I'd say "break a window, or call the fire department. This ain't the charity department."

Re:Intellectual Property

[Eil]

If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee?

I really like this analogy, because it helps prove my point in another point that you make...

Morally, a security researcher isn't supposed to hold information hostage and then credibly claim to be part of any ethical hacking community. At level best, they would be called grey hats; many would rightly call them black-hats.

I would call them black-hats because I have a hard time seeing how this can be anything but blackmail. I don't even care about the moral or ethical points of it, if somebody told me they could break into my house but wouldn't say how unless I paid them, well I would take that as a threat and would have them arrested and/or sued immediately. It's a good thing that these Gleg guys are in Russia (probably not coincidence?) or Real would already be throwing armies of lawyers at them because blackmail is highly illegal in most countries.

I'm glad Real isn't paying them a dime. Real has no way of knowing if the security company's claims are overstated or not. And if they did pay, that would set a horrible precedent. It would be like saying to the entire black-hat community, "hey guys, we'll throw money at you if you hold our vulnerabilities ransom!" It's almost akin to caving in to terrorist demands.

I understand that security companies want to make money, but this isn't how you go about it. A good security firm makes their money by establishing a reputation. They establish a reputation by demonstrating publicly that they're good at what they do.

Re:Intellectual Property

[Blkdeath]

Because if they don't, your kid can starve or freeze to death or get cooked in the summer. Babies have died in cars.

So you maintain that professionals in business to earn a living must render their skills for free to help irresponsible people who care more about their car windows than their child's life?

And letting people off "because they can't pay" is complex and leads to scams and paranoia and all kinds of weird legal confusion so it's easier to just say "Screw this, don't worry about the money" and refuse to take payment at all.

If you're going to get into the litigious aspect of things - you don't see a licensed, bonded locksmith being sued because they came out to unlock the doors, free of charge, but got there too late and the child was killed or seriously injured?

Break a damn window or call the fire department. Atleast they're paid to take care of people who screw up and endanger their lives or the lives of others around them.

I guess some people just find it hard to put a price on someone's life, at least a price on a few dollars of gas and 20 minutes of work time against someone's life.

No, the problem is the sheer number of people who lack all sense of personal responsibility. Just because you've endangered your child's well being doesn't invalidate the price of somebody's skill set.

FWIW; firefighters, police officers, EMT Paramedics, emergency room doctors, nurses et al. can very easily put a price on people's lives. They get paid a salary and their primary purpose is to save lives. I guess in your utopian world view it sucks when skilled people get paid to save lives huh? Imagine, all those selfish people wanting to make their mortgage payments. Won't somebody think of the children in all of this!

Re:Intellectual Property

[LifesABeach]

There is another argument that appears to be not being presented here. "Security Through Ignorance"

Re:Intellectual Property

[Ronin Developer]

They found an issue and let people know about it. This is a public service in itself. Listen, I agree with you that finding bugs and letting the public know there is a problem is, theoretically, a good thing. However, to not afford the company whose product and business is directly affected the opportunity to fix the problem before you tell the whole world is simply wrong.

Even if Real is not willing to pay for detailed information, at least now they know there is a serious vulnerability in their product and they know the general nature of the problem. Theoretically, true. But, how long do you think it will take them to actually find the problem and fix it correctly? Gleg spent how much time, energy and money finding this problem? It's obviously not something easy to find. I don't have a problem with them selling this information - but, it should be made available to the company affected first. Then, if the problem is not rectified in a reasonable time period, then buyer beware. In that case, with any luck, a third-party will make a patch (freeware or commercial) to solve the problem if the vendor doesn't. Of course, then there's the DMCA to contend with ... another story.

As for end-users knowing there's a problem...many people have no clue - they use their PC for email, write love letters and surf the web. Most have no idea how to secure a PC. Then again, people shouldn't have to - in an ideal world - anyway. But, there are cretins who will pay for this exploit and, in doing so, have the intent harm the affected company's customers. All that begets is compromised PCs, stolen identities and lifes screwed up when personal information hits the internet. How, is that a public service?

And if anyone buys this information from Gleg and illegally uses it to compromise your PC, you have only yourself (and Real) to blame: you knew there was a problem but you continued using the product. Yes and no. I also have unethical companies selling to the highest bidder access to my personal information to blame. I also have people who condone this practice to blame. It's people who condone it that allow this parasitic behavior to exist and thrive.

Re:Intellectual Property

[Venik]

I actually went to Gleg's Web site and checked out their information. Whatever they find and develop is published on a CD with regular monthly update, similar to anti-spyware and anti-virus products. All information is available for sale at set prices. I see no restrictions as to who is allowed to purchase their products. The prices are a bit steep for you and I, but then Gleg's product is not exactly a consumer item and it is priced entirely within the range of such specialty commercial software. So it's not like they are trying to extort millions out of Real.

If Real is concerned with the quality of their software products and if their own debugging resources are not up to the task, they should seek outside expertise. It is much more difficult for Gleg to find bugs in someone else's compiled software. Real has the programmers who actually wrote this software and who have the source code and all other necessary information and resources to do their troubleshooting.

The unfortunate fact is that many mainstream software vendors develop their software on the cheap side. They outsource the work to temp code shops with poor skills and non-existent quality control. These vendors frequently rely on the same hacks to do debugging, security and troubleshooting as a cost-saving measure. Gleg seems to be performing a valuable service that keeps this type of irresponsible behavior in check and helps to keep your computer safe.

If someone is going to find a security hole in some software I have on my PC, I'd rather hope it is Gleg or a similar company. The price of their product is outside the range of most hackers and script kiddies. This information usually quickly makes it's way to software vendors. It' not free - and, believe it or not, this is actually a good thing - but it's freely available.

Re:Intellectual Property

[ericrost]

Yes, and I'll spell this out for you slowly. Folks who make the selfless decision to reproduce at a population decline rate of 1 child per couple have to counterbalance selfish idiots like you who think that their genes are gold plated and must be shoved into as many replicas of themselves as possible. WE are doing the right thing (which was my point), just because we are winning the battle doesn't mean we shouldn't point out that selfish idiots with 4 kids and a gas guzzling SUV aren't killing the planet and propagating idiocy.

Nice attempt to dodge the issue though.

Re:Intellectual Property

[agbinfo]

Strangely enough I got a letter from my car manufacturer today. There's been a lot of theft of personal belongings inside the model I own so they have decided - I don't know what kind of pressure they were under - to change part of the locking mechanism at no cost. I wonder how easy it is to get inside the car? I guess if I lock my keys inside, it shouldn't be too hard to get in. Now I just have to get a copy of the LL.

Re:Intellectual Property

[Ronin Developer]

Interesting post and I think we're on an more even keel. However, as I am sure you are aware, the threat isn't from script kiddies and the casual hacker. The threat is from organized crime, terrorists (yes, the T word) and even rouge goverments (can you say, 'cyber-warfare'?). And, THEY have the resources to purchase and utilize the information.

If the information is released on a CD once a month and Real and organized crime buy it at the same time - how long do you think it will be before an exploit is released? A fix? Fixing a problem takes time. A demonstratable vulnerability and exploit is what they sell. The balance is definitely NOT in the favor of the vendor - source code or not.

And, while you are correct on the methods employed by software shops to get code out there quickly and turn a buck are, to say the least, disturbing - the fact remains is that their customers will become instantly vulnerable the momemt the information its the street.

That is where I find fault.

RD

Re:Intellectual Property

[Venik]

An important fact to consider is that in many cases bugs discovered by outside resource are already known to the vendor. More often than not vendors consciously ignore known issues because fixing them is considered inefficient use of resources. They realign their budgets toward developing new features instead. Known bugs migrate from version to version.

The approach often is to address known bugs only if there were documented incidents. This is particularly easy to do if much of your development work is subcontracted and offshored. As a manager, all you hear back is "yes Sir, thank you Sir." There is very little transparency and accountability. Even if a company like Gleg privately informed the developer about a discovered bug, there is little reason to expect a swift action, if any.

The best approach is to make information public, along with an exploit (an make money in the process). This will force the developer to divert whatever resources necessary toward fixing the issue. As to hostile governments and terrorist organizations, they don't need Gleg - a small group of Russian programmers - they have their own plentiful resources. It is possible and even likely that many of such "0-day" vulnerabilities have already been discovered by others, who rather keep their knowledge to themselves.

Re:Intellectual Property

[Jeruvy]

Really this comment isn't insightful unless you think that everyone is out to get you and you can't trust anyone.

I know how to break into your house, most people know how to break into a house, it's really quite simple. You kick the door in, or break a window and crawl in, or you grab the key hiding under the door mat and open the door. I know how to pick locks, and anyone could learn with a set of picks and a lock in no time. Neither are difficult to come by.

What you offer is security through obscurity, which if you look at this REAL problem, you would realize is just this. Except this time instead of REAL hiding the details, or the AV firms hiding the details, the researcher is hiding the details, and probably won't have any issues giving the details to those who wish to pay for them.

I say who cares, REAL is a antique product that has never done anything good except create vulnerabilities for it's users. Nobody uses these formats these days as most folks are into flash video and mp4. These formats make much more sense.

So protect yourself against all security risks inherent in REAL, REMOVE IT FROM YOUR PC's.

Now I do concur with your comment about calling this guy a grey hat, since they have no ethical resolve to your 'community' perspective. Let me see, someone spends time researching something, gives it to CERT, they publish the details. REAL gets it and in typical fashion DOES NOT release the details UNTIL they get a patch out. History shows this could take months with them. You never get the exact nature of the details released regardless. However I can get the details from the researcher for buying the details directly from him.

I'm a full-disclosure advocate so this doesn't appeal to me, since I'd call this partial-disclosure or select-disclosure, but this isn't different from what many companies do. Many refuse to post any disclosure. This is wrong for all the normal full-disclosure reasons.

Blackmail eh?

[QuantumG]

How about just "proprietary knowledge".. ya know, like the source code of Real Player?

Re:Blackmail eh?

[iksbob]

I think "extortion" fits the situation a little better. Blackmail requires a criminal act.

Re:Blackmail eh?

[QuantumG]

huh? Call me crazy, but isn't extortion where you demand someone pay you to keep quiet? These guys are not demanding a silence payment.. they're just selling their proprietary information to whoever wants to pay for it.

Re:Blackmail eh?

[Your Pal Dave]

I think "extortion" fits the situation a little better. And, the "X" makes it sound cool!

Re:Blackmail eh?

[Vectronic]

Extortion is basically the (ab)use of power to obtain something you wouldnt be able to obtain without the power.

Blackmail is generally the use of information or threats to extort something you desire from someone else.

Blackmail is essentially a method of extortion.

Re:Blackmail eh?

[QuantumG]

Extortion is basically the (ab)use of power to obtain something you wouldnt be able to obtain without the power. Hey man, you're free to define a word any way you like, but don't expect the rest of us to know what the hell you're talking about if you do.

http://www.google.com/search?hl=en&q=define%3AExtortion

Re:Blackmail eh?

[Lijemo]

huh? Call me crazy, but isn't extortion where you demand someone pay you to keep quiet? These guys are not demanding a silence payment.

You are describing "Blackmail".

"Blackmail" is a subset of extortion: All blackmail is extortion. Some, but not all, extortion is blackmail. There are other forms of extortion, including the good old-fashioned low-tech break-your-legs protection racket.

How did a comment expressing such an incredible lack of basic 7th grade-level vocabulary get modded "+5 insightful?" Was someone with Mod points saying "I don't see anything wrong with this happening to RealPlayer, therefore I'm going to mod up anyone who agrees, whether their point makes any sense or not"? Have whatever opinion you like, but look for facts that support your opinion, rather than trying to re-write the facts (or the English language).

Re:Blackmail eh?

[HiThere]

Proprietary information, yes. But who owns it? Certainly Real doesn't. They don't appear to have ever has possession of it.

So what they're selling appears to be information that THEY own. OK so far. But it's information whose sole value appears to be enabling it's possessors to do something illegal. So we've got to suspect that the purchasers of this information don't have clean motives. Except, *possibly*, for Real, were they a purchaser.

I'm not sure what they're doing is, or ought to be, illegal. It appears to be immoral and unethical. But the immoral and unethical part doesn't involve refusing to give the information to Real. There's no grounds that I can see for saying that's an obligation on their part. It's selling to their normal customers that appears to be immoral, and, perhaps, OUGHT to be illegal. If you could word the law carefully enough. But that's tricky. Perhaps it's safest to just leave that unlegislated.

What Real ought to do is sign one of their employees up for the list...presuming that it doesn't involve NDA agreements.

Re:Blackmail eh?

[QuantumG]

Dude, you're like 24 hours late. As has been said many times in the comments of this story, there are plenty of legitimate purchasers for this information.. for example makers of intrusion detection systems, anti-virus software, anti-malware software, and just plain old sysadmins who want to patch their corporate networks NOW instead of when Real gets around to it.

But...

[Eevee1]

But who does use RealPlayer anyway, that this could possibly affect? I mean, there's VLC and I daresay others out there that can play similar files.

Re:But...

[Nossie]

I think you're missing the point...

What if this article concerned 'VLC' and 'daresay others' ?

Re:But...

[Eevee1]

Well, it would theoretically be possible to rewrite the code cheaper with open-source rather then with something like RealPlayer.

I know by saying this, the next response will be modded +5 Insightful or +5 Informative.

Re:But...

[Anonymous Coward]

I think you're missing the point...

What if this article concerned 'VLC' and 'daresay others' ? Well, the source is there. A thorough audit will likely find the issue(s).

Re:But...

[Nossie]

true... but there are x patent violations in 'Linux' if you believe Microsoft... and yet nobody has found any of them and Microsoft is staying hush, is this not the same thing?

Re:But...

[kcbanner]

No, it's not. We're talking about security vulnerabilities, not patent terminology.

Re:But...

[Anonymous Coward]

"proprietary knowledge"

Anal are we? or just your standard case of geek OCD?

Re:But...

[Anonymous Coward]

true... but there are x patent violations in 'Linux' if you believe Microsoft... and yet nobody has found any of them and Microsoft is staying hush, is this not the same thing? There is no doubt that VLC violates patents. That is why VLC is developed in France. Mpeg2 is patented, mpeg4 (Xvid/divX/h264) is patented, mp3 is patented, aac is patented, css is patented, etc. VLC supports all of those.

Re:But...

[Anonymous Coward]

were we talking about a media player that could or could not come with linux that could or could not include proprietary codecs or are we talking about the supposed x amount of patent violations in GNU LINUX?

keep also in mind that you can get VLC for windows too...

Re:But...

[Anonymous Coward]

I don't see what GLEG is doing as being any more "blackmail" or immoral than software vendors who release products with security vulnerabilities and develop patches to close them but refuse to provide the patches unless they are paid. As long as there are vendors that are allowed to require a paid up support agreement (whatever they may choose to call it) in order to make a security patch available, then GLEG should be allowed to charge for their information.

Even if vendors are requried to include the cost of security patches in the original license purchase cost (i.e. everyone with a license to use has, by virtue of having purchased that license, a right to all security patches at no additional cost) GLEG should have the right to be paid for their work.

It doesn't mater what the product is.

How can people be so socialist on this issue yet capitalist on others? If GLEG is immoral for not giving away its information because it has social benefit, then why isn't Real immoral for not giving away RealPlay because it has social benefit (actually, I don't use RealPlayer, but so many people do I assume it has some benefit).

Re:But...

[techno-vampire]

But who does use RealPlayer anyway, that this could possibly affect?

All the Aunt Tillies out there who use Windows because it came installed on their computers and have no idea what an operating system is. They use IE for the same reason, and when they want to hear an audio file, guess what IE tells them to install? One hint: it won't be VLC.

Re:But...

[KURAAKU Deibiddo]

I think that you're confusing RealPlayer with Windows Media Player.

Are there even any OEMs out there that pre-install RealPlayer, these days? I'm not aware of any.

Re:But...

[Don_dumb]

The BBC still use realplayer for radio broadcasts don't they?

Here in the UK people are going to trust the program the beeb tells them they need to use to listen to The Archers online. Heck many people here on /. wanted the BBC to use Realplayer for cross platform compatibility rather than the Windows-only thing they decided on using.

Re:But...

[themelv]

Aunt Tillie needs the K-Lite mega codec pack. If you were any kind of a nephew you would have installed this with the quicktime+real+ffdshow option. Media Player Classic (mplayerc.exe)is fucking fantastic. Best media player(for video) ever.

Re:But...

[techno-vampire]

And what about that huge majority of Aunt Tillies who don't have a geek for a nephew? What are they going to do?

it's tough

[rastoboy29]

If you're not actually shaking down the vendor, it's not blackmail.  I mean, if you get a piece of information, are you obligated to inform anyone?

It is sleazy, don't get me wrong, because what other reason would someone other than Real want to purchase the information except to do no good?  But I'm having a hard time feeling sorry for Real, because they suck so fucking bad.  I keep trying to replace them in my mind with some company I like to analyze the situation, but it just keeps switching back to Real.

I mean, it's not like someone's going to get killed or anything.  Unless, of course, Putin wants that done.

Re:it's tough

[thedarknite]

But it does come close to racketeering.

Re:it's tough

[Ambush Commander]

Mod parent up!

To elaborate, Evgeny is threatening damage to Real (by this exploit) unless they pay up a sizable sum of money to purchase the exploit (whether or not he'd sell it to Real is another matter, although Real could always pose as a client and then purchase it).

I know Real has got a pretty scummy reputation, but that's no excuse to condone this behavior.

Re:it's tough

[Actually, I do RTFA]

It is sleazy, don't get me wrong, because what other reason would someone other than Real want to purchase the information except to do no good?

Well, there are malware blocking programs that deal with plugging holes in other programs. Windows, and the various VB running Office programs are one source of bugs. I could see an antimalware company advertising itself as fixing holes in Real/Flash/Other malformed content.

Re:it's tough

[QuantumG]

How exactly are they threatening damage?

Re:it's tough

[Ambush Commander]

...this is an exploit, after all.

I understand where you're coming from; the only ones who seem to be directly affected are the poor end-users. However, if people stop using RealPlayer because of the exploits, and IT departments start uninstalling it because all there machines are getting owned, and it affects RealMedia's bottom-line, you can be sure as hell that's damage.

Re:it's tough

[fosterNutrition]

I don't see it that way. In my view, they're not "threatening damage" but promising results. They're essentially saying "Hey Real, if you hire us to do a security audit, we can guarantee we will find at least one serious vulnerability, and your money will have been well spent." It's a bit disingenuous to phrase it this way, but it essentially boils down to the same thing.

Think of it as "we guarantee value for your money" rather than "give us money or we guarantee you'll wish you had," which, if you consider missed opportunities valuable, mean the same thing.

Re:it's tough

[Anonymous Coward]

if people stop using RealPlayer because of the exploits, and IT departments start uninstalling it because all there machines are getting owned, and it affects RealMedia's bottom-line, you can be sure as hell that's

...a win for everyone. Besides Real.

Re:it's tough

[QuantumG]

But *they* caused the damage.. they released a product with a security flaw in it. If some third party who doesn't even have the source code can find it, then so can RealMedia.

In the mean time, there's people who sell anti-malware. There's people who sell intrusion detection systems. There's people who get paid to maintain the security of corporate networks. All of these other people are willing to pay for information about the exploit.. some of them are even willing to pay for exclusivity - to the extent that this one research company can actually provide that, remember that anyone can do the same work they did and find the same defect. In the mean time, RealMedia are *not* sitting there saying "oh, but if you would just tell us what it was we'd so like to fix it!" They're cranking out more code with security flaws in it because they don't care enough to hire their own security analysis people.

Re:it's tough

[Ambush Commander]

It's one thing for RealMedia to cause damage (release a product with a security flaw in it). It is another thing to actively exacerbate this damage (release an exploit to the blackhat community for large sums of money, and refuse to tell the vendor what the exploit is).

Re:it's tough

[Ambush Commander]

Yes, they are promising results, but the reason why they can "guarantee" these results is because they already know about them. This is a key distinction from a traditional security audit, where one presumably doesn't know the vulnerabilities before signing the contract.

Re:it's tough

[Ambush Commander]

I should add, whether or not we condone this behavior has no bearing on the issue at all. This is a clear issue of a product arising to supply a need; if we want to curb this capitalistic instinct we'll have to get the Russian Government to do something for the "greater good."

What is the greater good? For me it's pretty clear: software without security vulnerabilities. Is it reasonable to expect security researchers not to make money off their knowledge? Is it reasonable to expect software not to have security problems? It is reasonable to expect people with vulnerabilities to make them public and not sell them to the black market?

Probably not. Still, we can dream (or say OPEN-SOURCE, although that really doesn't fix the problem if it never goes public.)

Re:it's tough

[Omnifarious]

You make an interesting point, and my feelings are along the same lines. But I'm very much on the fence about this. Really though, Real just made their own bed by releasing such buggy software.

Re:it's tough

[QuantumG]

blah, RealMedia are free to plug the hole any time they want.. they just don't get the research used to find the hole for free.. they have to do their own damn research.

Re:it's tough

[networkBoy]

You know what's funny?
I thought Real was dead...
I had no idea they were still in business till today.
this is racketeering, and it's wrong. That said, I wish there was a culture of "Hey thanks for finding that whopper of a bug, here's a couple grand" for bugs that can be exploits, because should such a culture arise, your average geek would go for the bounty.
-nB

Re:it's tough

[freedom_india]

I don't think so.
I would still support Evgeny even if the product belonged to Apple.
BECAUSE, Evgeny spent x amount of money to discover the bug, which should have been first discovered by Real.
Now, after spending money and effort, you expect Real to be given that information Free, because Real made the defective product in the first place?
That is not capitalism. Real is practising Fascism.
The assumption is that Real with its army of lawyers could scam the legal and legislative system of russia and force Evgeny to release this information to Real only.

Sorry to burst the bubble, but Russia practices pure capitalism. In this case Evgeny is free to sell it to largest payer.

Dear Real, get over it. This is not US where the laws ypur purchased could have forced Evgeny to hand over you the exploit free.
This is New Russia, so that means you pay, else watch as millions of Real players are off-the-grid.

Re:it's tough

[Anonymous Coward]

You're right, there's no threatening going on here, just a business transaction.

It's just like when cousin Guido stops by your grocery store and offers you some security - with guaranteed results.

"Hey kid, nice shop you got here... This is a tough neighborhood, sure it would be a real shame if something happened to it next Thursday. Now, if you hire me and the boys for security, I can GUARANTEE nothing will happen..."

Re:it's tough

[Gideon Fubar]

This is just like the 'potential damages' part of a media infringement trial, right?

The part where the prosecutor pulls magic number out of the air, goes 'should have, would have, could have' and the jury are suddenly lobotomized?

Re:it's tough

[forgotten_my_nick]

IANAL. If I had a security exploit that if used could get someone killed and I refused to hand it over and instead sold it to a third party who then used it and killed someone I am pretty sure I would be liable in that instance.

Re:it's tough

[Blkdeath]

IANAL. If I had a security exploit that if used could get someone killed and I refused to hand it over and instead sold it to a third party who then used it and killed someone I am pretty sure I would be liable in that instance.

Where are the small children and cute kittens and puppies in your sentiment? I mean, while we're going out on a limb and all ...

We're talking one of a million software exploits out there in the great wilds of commercial software packages.

Where, BTW, is the liability for the company who released the defective product in the first place? If this exploit can "get somebody killed" (or whatever actual damages can take place as a result of its use) why shouldn't RealMedia be held liable?

Re:it's tough

[QuantumG]

Yeah, they've been doing that with computer hacking cases for years too.

Re:it's tough

[Antique Geekmeister]

Fortunately, the blackhat community are thieves. And mostly quite stupid ones, at that. They'll have no fear of stealing the information from each other and publishing it on one of their poorly secured IRC channels for l33t d00dz. Expecting otherwise is expecting the blackhat community to obey their non-disclosure agreements with this Russian company, and having the skills to protect their systems from the rest of the unskilled but fast-breeding blackhat users.

I'd expect Real to get a copy of the published information, or a synopisis of the actual vulnerability, within 48 hours.

Re:it's tough

[forgotten_my_nick]

The point I am making isn't that you do or don't have to tell the company about the flaw. The issue is that these companies are selling the flaws to the highest bidder. In such case yes you should be held liable for any damages arising out of you profiting in giving that information out.

Re:it's tough

[Anonymous Coward]

It's not any different from selling a handgun in an auction. It's up to the highest bidder to decide if he's going to kill somebody with it, it's not your responsibility.

Re:it's tough

[Eighty7]

You'd rather pay for unknown possibly inconsequential vulnerabilities over confirmed vulnerabilities? I may or may not have a bridge to sell to you.

Re:it's tough

[Anonymous Coward]

It is sleazy, don't get me wrong, because what other reason would someone other than Real want to purchase the information except to do no good?

Ahhh, that old canard again. You're nothing but another **AA lickspittle.

What need has anyone of a car that can go 200 mph, if not to do illegal shit on public roads?

What need has anyone of a gun, if not to kill people? After all, all the game you need to eat can be gotten at the supermarket.

What need does anyone have of a disassembler, if not to reverse engineer proprietary software?

Get fucking off it, people. This is exactly the same shit that the **AA uses to inhibit technological progress. They've effectively gotten themselves an absolute veto on the manufacture of any dual-use hardware or software by asserting that the possible amount of non-infringing usage is down in the noise, compared to their bullshit claims of massive infringing usage.

As to your original question, anyone might well want that information in order to develop their own protection against the flaw. Why would they depend on Real to fix the problem with any sense of urgency?

We have all heard of the cases where someone reported a weakness to a software vendor, only to be told they'd be prosecuted for illegally reverse-engineering the software. Likewise people who've innocently or otherwise found their way into networks. The first thing the network owner will do is hire "conslutants" who will advise the owner to pay handsomely for a "damage assessment" in order to get the imputed "damages" to a high enough value to make the intrusion count as a felony.

So take your assessment of the motives of someone with valuable knowledge and ram it up your ass.

Re:it's tough

[Gideon Fubar]

Indeed.. I've always wondered how a company can justify putting the wages of a security employee on a statutory damages claim... Especially when (in merit of the fact that they're in court in the first place) that employee kinda failed in his or her position.

One sure way

[bherman]

I bet if they opened up their source code someone would be nice enough to look it over and tell them what they find. Too bad they're closed source. Oh well.

Re:One sure way

[Anonymous Coward]

I bet if they opened up their source code someone would be nice enough to look it over and tell them what they find.

Yep. Patent trolls and their hired guns would be very interested.

Re:One sure way

[Anonymous Coward]

I bet if they opened up their source code someone would be nice enough to look it over and tell them what they find. Too bad they're closed source. Oh well. Actually, to a certain extent they did.

One word: no

[WetCat]

Why should they give the information for free? They spent time and effort to find the vulnerabilities, it's pretty enough just to know that they are exists. If CERT or Real really want to find those bugs - they can either
  Pay for the information - it's the cost of doing business with proprietary software,
or
  Find the bugs by theirselves: just have a tip about the bugs is a valuable information,
or
  Open source and get the help of community in code review.

Re:One word: no

[Anonymous Coward]

I agree! CERT should open source! Those proprietary bastards! /sarcasm

and open source does not help in this situation, are you retarded? I can find a Linux TCP stack remote exploit and say I'll only tell Linus what it is for $10,000 - same situation.

Nothing's free

[StealthyRoid]

I don't know how this is even remotely blackmail. What do companies like Real pay their QA guys to find the exact kind of 0-day exploits that the Russians discovered? I'll bet it's not 0. And why should the Soviet's be required, morally, ethically, or otherwise, to provide something for free that any responsible software company pays talented people for? Maybe it's sort of dickish to sell it to Soviet hackers, but the fact is, it's their work that produced the knowledge of the exploit, and they should profit from it. Information isn't always free, nor should it be.

There's no fiduciary duty here

[Sangui5]

Indeed, for individuals, pointing out security problems can be dangerous. It isn't very nice of them, but then again, most software vendors aren't nice either. Calling this blackmail is a bit of a stretch.

Re:There's no fiduciary duty here

[timeOday]

One interesting consequence of allowing this type of behavior is that software vulnerabilities would carry a financial consequence for the software makers. It's a sort of liability they can't simply disclaim in the license.

It's called capitalism

[enos]

It's called capitalism, and it's been breaking out in eastern Europe ever since the USSR fell. In unregulated areas (i.e. new markets) they have a much more "pure" concept of it than the west. The public good is a socialist idea. This same thing happens in a lot of places in the west where there are shops that specialize in IP of some sort. They have to make their living somehow. It's just that people are used to security companies giving this stuff away for free.

Re:It's called capitalism

[thelexx]

Way to completely sidestep the word 'ethics' there...

"In unregulated areas (i.e. new markets) they have a much more "rapacious" concept of it than the west. The public good is an inconvenient idea."

FTFY

Re:It's called capitalism

[Anonymous Coward]

The individual capitalists finding a balance that is for the public good, fits within capitalism. Individuals choosing to act for the public good also fits into capitalism. It's only when teh government gets involved, and starts to redistribute wealth that you get socialism.

Re:It's called capitalism

[timeOday]

A lot of the responses here claim it's capitalism and therefore must not be blackmail, as if that were a dichotomy - it's not. Blackmail is capitalism, just as libel is speech. I really don't know whether Gleg's actions meet the legal definition of blackmail in Russia, or for that matter in the US. But that fact that Gleg can make money doing this is not, in itself, much of a defense against charges of blackmail.

Re:It's called capitalism

[sempernoctis]

"The public good" is the motivating factor behind both socialism and capitalism. The difference is that socialism tries to address the public good through conditioning people to act with less regard to their own interests, where capitalism believes that providing personal rewards for people who are productive will increase the value of the society as a whole. Most IP laws (copyright, patent, etc...) were originally written to stimulate innovative and creative works that eventually will benefit everyone, by rewarding those who discover or create them. The two are, however, extremes, and like most extremes, the best solution is probably somewhere in between. The USSR illustrated the shortcomings of pure communism, and the U.S. has been gradually learning that there need to be checks in place to prevent pure capitalism from acting against the public good (anti-trust laws, for example). The USSR falling apart has caused major changes in that part of the world, and this "blackmail" activity looks like the proverbial pendulum swinging back a little too far. Of course, no matter which philosophy you follow, the people in power can still skew it in whichever direction is most convenient to their own agendas.

Re:It's called capitalism

[Blkdeath]

"The public good" is the motivating factor behind both socialism and capitalism. The difference is that socialism tries to address the public good through conditioning people to act with less regard to their own interests, where capitalism believes that providing personal rewards for people who are productive will increase the value of the society as a whole.

Couldn't this lead to a betterment for society, though? Wouldn't you think software vendors would prefer to concentrate more on getting security right in the first place and releasing software of a higher calibre rather than finding themselves on a list of "Exploits For A Buck"? If that were the case, hey, I think this Internet thing might just be a safer place to be.

Besides all that; don't you think this has been going on for years already? Of course it has! This is just the first company with the cajones to step forward and be up-front about their business model.

I think it's great. I like having an industry watchdog out there keeping these software giants honest. Saves me a lot of work as the company and family IT go-to-guy. I'm sick of cleaning malware from everybody's PCs.

Re:It's called capitalism

[xcedrinod]

"Promote the General Welfare"... it's in the Preamble of the U.S. Constitution. Marx wasn't even born yet when that was written. Saying that "the public good is a socialist idea" seems pretty uninformed, especially considering that Plato's Republic talks about some pretty extreme ideas of governance performed to promote the greater good.

Re:It's called capitalism

[skribe]

How long before Real change their EULA demanding that licensees reveal any exploits to them within 24 hours of discovery?

Re:It's called capitalism

[pilgrim23]

----and it is certainly a case of d**ned if you do and dam*ed if you don't:
    Recently I had issues with a game I purchased. I finally figured out that the reason it refused to play was the machine I had this game on was not networked in an expected way and the game's DRM wanted to handshake with the company to let me play it. In the process of figuring this out I also figured out a crack for the DRM they were using and passed on my discovery to the company. I paid for the game, I like the company, and thought it neighborly to let them know that the commercial DRM they used was pretty shaky. A week later I received a general email announcing a new delivery system for their games (with new and "improved" DRM). It works even worse then the previous. I also figured a new crack. THink I will shut up this time...

Re:It's called capitalism

[Brandybuck]

Thank you. While we can argue over the ethics and legality of blackmail, trying to define capitalism as the foundation of blackmail is ludicrous.

Re:It's called capitalism

[Antique Geekmeister]

How about they switch to GPL? That way, anyone who publishes a patch for client has to reveal the patch.

Yes, it's a pipe dream for now, but that sort of security and performance flaw is partly why the GPL exists: to get the source, patches, and feature additions out into the open.

Re:It's called capitalism

[cdrdude]

I'll bet you 2 potential flaws and half of a zero-day that they've already changed it...

Re:It's called capitalism

[spion666]

Blackmail is capitalism doesn't mean that all capitalism is blackmail - it means that blackmail is a subset of capitalism :)

Re:It's called capitalism

[Anonymous Coward]

If the public good is socialism, and you appear to be a good Republican and hate all forms of socialism, then why dont you try not using "public" roads, or "public" transit. Or, hey, try this, go visit Beijing where socialism is going away and there are no "public goods". You know, like air quality laws. Or you could go to Mexico, where there are no water quality laws.
And I bet you went to a private school didnt you, because the "public good" is served by "public" schools.

People like you who hate the idea of something being done for the good of all people, and not for profit, are what is destroying America. And I bet you dont see anything wrong with the private army of Blackwater, either. (As long as they make a profit, of course.)

Re:It's called capitalism

[Anonymous Coward]

How long before Real change their EULA demanding that licensees reveal any exploits to them within 24 hours of discovery?

No problem. You observe a licensed user operating the product and "notice" a flaw. If you don't inform that user of your discovery, neither of you is obligated by the license to pass the information back to Real.

Aside from that, I see no ethical or moral obligation to reward Real with this kind of information after all the surreptitious spying and data-mining (even if they've publicly denied it, it's well documented) which they've done on their licensees.

Re:It's called capitalism

[cmat]

This is just silly; if entity A is willing to do something ethically "gray" (which is debatable in this case but assume for the sake of the argument), then they will do the same even if a piece of software is GPL'ed. The GPL isn't some magical spell that compels one to instantly release your modifications on distribution of the modified binaries. The GPL exists to LAY A LEGAL FRAMEWORK that can be used to make software better; it really has no power without the willingness to enforce it.

Re:It's called capitalism

[Antique Geekmeister]

Well, getting Real to use the GPL is a pipe dream, but it's one founded in some very real business models. And avoiding this kind of zero day exploit is part of that.

Re:It's called capitalism

[Brandybuck]

Where is the capital? No capital, no capitalism. Please do not confuse markets with capitalism. Markets have been around since the first caveman learned to chip flint.

chilling effects of free market capitalism

[drspliff]

I don't call it blackmail, I call it a free market...

Companies have a financial incentive for keeping their products secure, open source projects have less of an issue because the money just isn't in it.
All this is - is one company spending real money, hiring well paid analysis to plow through machine code or source code and analyse vulnerabilities.
The reason they can afford to do this is because the market is full of companies willing to pay for this stuff...

Thats where your code of ethics goes out of the window!

With open-source projects, there is still a market of companies using that software but at the same time there's a limited timespan before it's usually discovered by somebody else.
You know very well that if you advertise you've found a security flaw in open source XX product you're going to have hundereds of people scrutinising it and to develop a fix - because it's benificial to everybody (so the code of ethics lives strong).

It doesn't help that `Real' has a bad reputation, but by doing this and with holding it, Gleg are doing exactly what they set out to do in the first place and doing as any successful business man/woman does: identifying the market and targeting it appropriately.

This happens every day not just in software security, but in every other industry yet people just consider it a normal day in the office and maybe grumble a bit about it.

In an ideal situation ethics and social benifit would come first though... yet this is in practice incompatible with the free market, just for the reasons above.

Re:chilling effects of free market capitalism

[Anonymous Coward]

"I don't call it blackmail, I call it a free market..."

Thank you for demonstrating yet another problem with the idea of a pure free market.

Re:chilling effects of free market capitalism

[Anonymous Coward]

I don't call it blackmail, but (and admitting that IANAL) under English law, it could perhaps be considered a case of statutory conspiracy (under the Criminal Law Act 1977) to commit an offence under the Computer Misuse Act 1990 (as amended).

Can a lawyer comment, perhaps?

Re:chilling effects of free market capitalism

[hhawk]

I don't think anyone is saying they are doing something wrong and they thus need to be arrested.

People are saying that what they are doing isn't ethical, based on the protocols of the security industry.

Each speciality has their own ethics. Drs's have the hippocratic oath. Most other professional have similar although less formal ethical guidelines.

This doesn't matter if this is only one company, but if it turns out that their "business model" changes everyone else's that will really change the nature of the IT security profession.

Re:chilling effects of free market capitalism

[drspliff]

This was my intention :)

It makes me cringe when I see far right free market capitalists talking on FOX or CNN.

They're fucking Ruskies What did you expect?

[Anonymous Coward]

They're fucking Ruskies What did you expect? If ever there were a people that are as crooked as an old man's dick, it's the ruskies.

Blackmail?

[clarkkent09]

If this is valuable information (as in there are people willing to pay money for it) why should they give it for free? Companies pay good money to consultants to come over and fix problems with their business, why shouldn't they have to pay people who help them fix problems with their software products.

Re:Blackmail?

[Anonymous Coward]

No kidding. Why are we claiming that these guys should work for free.

Re:Blackmail?

[xtracto]

Yeah, screw Real and the others. They create closed source software, how can they expect to get free security consultancy? If this company is spending their resources on finding methods to secure third party insecure software then they have all the right to sell such information. If people at Real want to know about these problems they should 1. Spend their money getting good security consultancy or 2. open source the programs and then maybe people will submit patches for free.

Just imagine if Microsoft was in the same situation, oh shit, they are with viruses and whatnot. Is as if they told Symantec, McAfee and all those useless crap vendors to give them their technology for free... "oh shit, my software is buggy as hell, please give me the corrections you made... oh but I wont give you nothing in return, not the source not anything but i really like free lunch".

Charge them, and charge them dearly.

Re:Blackmail?

[Anonymous Coward]

It's one thing to inform the vendor that a flaw exists and demanding money for the details of the flaw. It's a whole different thing in my book to sell the details to _anybody_ else than the vendor.

Re:Blackmail?

[dissy]

It's one thing to inform the vendor that a flaw exists and demanding money for the details of the flaw. It's a whole different thing in my book to sell the details to _anybody_ else than the vendor. Indeed. Unfortunatly in the USA, by law if you inform the vendor of the problem, and so much as ask for payment, it falls enough into the legal definition of blackmail to get you in trouble if they push the issue. And you never know if they will push it to court, or thank you for your trouble.
If I was running a large company with lots of finantual backing, and thought I was in the right (or to be more specific, if my legal team thought i was in the right) then I would definatly go to court to fight it.
However being an individual, there is no way in hell I would willingly expose myself to that type of risk.

Selling to everyone else however can't possibly be blackmail, since they can just say no and nothing bad happens to them. It doesn't match either the legal or english definition of the word.

It's very smart from a legal point of view. Offer your services and 'IP' to everyone that you know wont sue you for it, and avoid the one person/company that could.

If the laws were different and more sane, then they COULD sell to everyone including the vendor, or perhaps it would be at a price where they can afford to sell to ONLY the vendor.
Sadly, they arnt.

Capitalists gotta eat after all!

RealPlayer Has other bugs?

[the_Bionic_lemming]

Bought 8 years ago, I actually paid for a version of realplayer from best buy that lasted three weeks.

My only offer from them was to pay a lot more to get the next version, or not to be able to use the version I purchased to view content.

Frankly, supporting realplayer is dumb.

Great idea.

[v(*_*)vvvv]

It would be even better if they actually didn't have such info.

Re:I for one ...

[mysidia]

Not blackmail. But poorly designed software tends to have security bugs.

These bugs pose a problem for users of the software. It makes sense that third party services exist that scour software for bugs like this, for the benefit of the software's users and prospective users.

So they can know whether to use the software or whether to take extra precautions/refrain from using it.

The cost of performing this type of analysis is high. Much time and energy is required.

It makes sense that you need to pay to review their findings in detail, or to review them before they are publicly released (for free).

If they merely submit their findings to the software vendor, then they have provided the vendor with high-quality, costly labor for free.

Why should the software vendor get free labor from security researchers, and be able to freely follow poor design practices in the design of their software, while relying on the public to find and report the issues gradually? (For them to lazily fix _after_ the defect is drawn to their attention)

If the security researcher wishes to serve the community, then they have the option of practicing full disclosure, but they may be more fairly compensated for their work by providing paying customers with key information in advance, so their customers can mitigate the problem, before it has become public (and known to the bad guys).

One way you mitigate the problem is very simple: uninstall the defective real player 11. Re-install the fixed version, when it becomes available.

Vista

[Joe U]

So, I have one question, does UAC actually help trap exploits like this?

Not that I would ever install Realplayer outside of a locked down VM anyway. Assume I had a seizure or something and wanted to put this on my host OS.

Re:Vista

[Anonymous Coward]

No. UAC does not provide any security whatsoever.

Limited user privileges, in addition to simply being a good idea, help mitigate some types of attack, and most certainly makes containing and cleaning up after such attacks easier. But UAC by itself does not limit user privileges at all. At best, it's a decent privilege-escalation method (when you configure it to ask for a different username and password). In most home-use scenarios (account has admin privs and a blank password), UAC is just another set of click-through warnings that users will train themselves to ignore.

This doesn't even touch on UAC's blocking of applications at startup under the HKLM/Run key. In previous versions of Windows, those applications ran with the same privileges as your user account--and if you set yourself up as a limited user, then those apps were also running with fewer privileges and everything was that much safer. However, under Vista, there is absolutely no way to run those applications with the privileges of a limited user. They either run as a full admin or not at all. This last bit arguably makes UAC a security vulnerability in its own right.

Hope that helps.

Re:Vista

[cbhacking]

Depends on the exploit and on your definition of "trap." UAC is just an easy way to run programs with limited permissions by default without a big hassle when you want to run them with full permissions. If the exploit wanted to do something needing full permissions (it probably would, if it's targeted at Windows) then yes, UAC would stop it (to use a Linux parallel, imagine a user-permissions program trying to run
$ /sbin/modprobe rp_exploit_rootkit
. It would fail, of course, with a permission denied message. Depending on how it's implemented, on Vista this would either cause a UAC prompt to install a driver (or whatever), or silently fail. One hopes you would realize the first isn't even close to expected behavior.

Of course, if the attack were something that can be done with limited user permissions, then you would get no prompt at all - on Vista or Linux (or OS X, *BSD, etc.)

On very rare occasions over the last (nearly) two years that I've been testing and running Vista, I've seen only a couple of unexpected UAC prompts. Despite worries that clicking through them would become automatic, it hasn't been a problem for me; believe me, if visiting a website pops up a UAC message you bloody well notice. Not sure what it would have done if I'd allowed it; I didn't have a handy disposable environment to test in and didn't want to possibly need to reinstall the whole system.

Advice for free

[Dachannien]

It's not like these guys are really putting anyone in a bind. Real Networks has a responsibility to inspect and maintain their own product, and since they have the source code, there's nothing preventing from doing so. And people who are uninterested in paying them umpteen bazillion dollars for their expertise are welcome to take my advice, given for free:

Uninstall RealPlayer.

blackmail? product defect!

[nguy]

When companies ship software with security holes, it's a product defect. If they don't want to be embarrassed by that in public, they should simply not introduce security holes.

Re:blackmail? product defect!

[Antique Geekmeister]

I've seen this sentiment echoed here several places. The only way to ship a complex product without security holes is not to ship it at all: with a few hundred thousand lines of code, or a few million in a big product line, you can't catch __all__ the holes even with with a rigorous Q/A policy.

Re:blackmail? product defect!

[nguy]

The only way to ship a complex product without security holes is not to ship it at all: with a few hundred thousand lines of code, or a few million in a big product line, you can't catch __all__ the holes even with with a rigorous Q/A policy.

If you write your product in C++ using programmers you hired out of college or outsourced to India, it is not. If you use the right tools and development methods, it is very much possible.

Companies are just choosing the wrong tradeoffs right now: fast time-to-market, lots of features, low development costs, low reliability, and little security. Legal liability would change their priorities.

Re:blackmail? product defect!

[Antique Geekmeister]

OK, this belief shows a real lack of experience with complex products. But the concept that even a genius set of programmers, with a solid Q/A process, can write software without security bugs is nonsense. Even a small and secure set of functions have to interact with the rest of your operating system, and that introduces the potential for unexpected flaws.

Legal liability won't fix this. It may shift the balance, but creating new legal liabilities for software is what EULA's are designed to avoid.

Why does this remind me of Fermat's Last Theorem?

[AB3A]

I have this lovely demonstration, but you have to pay me to show you how it works. How do we know it is a real hack? How do we know it isn't a shake down?

This is a shade of Fermat's last theorem. Wiles, after he finally proved it, said that he doubted Fermat actually knew a viable proof.

We don't know what these guys have. Whether it's blackmail or not, it still smells bad. I think the money would be better spent on real security researchers who disclose what they find.

Root exploit, slashdot suicide

[Anonymous Coward]

I actually paid for a version of realplayer

Frankly, supporting realplayer is dumb. Declaring yourself stupid on slashdot? Wow, that root exploit is really having an adverse effect on people!

Re:Root exploit, slashdot suicide

[LaskoVortex]

Um, try some linguistic analysis. He bought real player 8 years ago (past-tense), but says supporting it is (present tense) dumb.

When it comes to blackmail....

[gandhi_2]

it helps to have something people want. Realplayer? Go ahead, kill the hostage.

Let me be the first to say...

[rhizome]

I'm surprised nobody has said it yet, but Real deserves this.

Same as drug companies

[Anonymous Coward]

Drug companies worldwide hold proprietary information that would greatly benefit the public but rather than release it they use it to further their own research. Obviously if you take that away you might as well ditch capitalism while you are at it.

By they way Real can simply have some moog in their office pretend to be a customer of the gleg service and buy the data and then pass it on to real. If there is some contractual reason why they can't they can just have that moog work out of a country where the contract means nothing and then leak the info to real. I mean seriously how hard could it be.

i don't get it

[bravo369]

the firm found the vulnerability. Shouldn't they be compensated? they aren't running a charity. Real would be the only one to benefit by security firms simply "giving" the exploit to them. sure you can argue that it's leaving customers insecure but are you telling me Real can't afford $10,000?

Wrong.

[Anonymous Coward]

Sorry, but this is blackmail. As there are two potential customers:

1. Real.
2. Criminal buyers.

The sale of this information to criminals has the additional effect of potentially severely damaging Real's business and Real's customers (you and me).

So, offering up this bug for a fee to any one other than Real, even as an idle threat, is nothing short of blackmail.

These guys are not "security researchers", they are criminals.

Re:Wrong.

[Deanalator]

Plenty of pen testers use 0day when evaluating companies. The theory is that busting a single machine on the corporate network should not give you the "keys to the kingdom". Properly implemented security architecture should be able to mitigate single point failures. Immunity and core (American companies) both buy and sell 0day without informing the vendor. Wabisabilabi has a very convenient marketplace for such transactions as well. It's all supply and demand. Sure it's sketchy, but aren't you glad that these are being sold in public, and not just on the black market?

Re:Wrong.

[umghhh]

they do not threat anybody they just sell.
If Real's evaluation should lead it either to purchase, own fix or non action if the fault is not deemed important enough. In any case it is Real's job to protect its product and customers. They made products for 'everybody' and these customers may purchase products that are meant to enhance the original one.
There were many analogies flying around so here is one to. If you buy a car do you buy protection against theft from the maker? You may if the makers provide one but you may buy it from other people that investigated the product and provide other sometimes better solutions from other producers. Do the other makers of such protective measures blackmail anybody?

Re:Wrong.

[Anonymous Coward]

3. Legitimate clients employing their security services.

You are essentially arguing that it is blackmail for them to use this information to protect a client. Imagine if, during the process of penetration testing a client's network a security firm discovered a flaw in some application. Would it be unethical for them to use this information to protect their other paying customers? Would it be unethical for them to trade this information with other security consultants or researchers for information that would help them better protect their customers?

Re:Wrong.

[mapsjanhere]

Hmm, everything seems to be hanging at the "commercial" intention. If we'd be having this discussion without the fee aspect, everyone would be harking at Real for trying to hide a bug instead of fixing it, and trying to prevent the noble security researcher from protecting us all from the big bad company and its bad proprietary code. With other words, we're dealing with the thought crime of making money of proprietary software instead of making it FOSS.

Re:I for one ...

[cdrguru]

Yes, but you have missed the key point.

There are three classes of potential customers: product owners, users, and criminals. If the researcher makes it clear they are willing to sell their information to the third class - criminals - then it matters little if they are also willing to sell to the other two classes or not.

Clearly, the implication is they do not want to sell to the product owner class as that would be a single sale. By selling the information to users and criminals they ensure that they have a substantial number of potential sales as well as motivating the users to buy rapidly or else they will be victims of the criminal class.

What is Real good for anyway?

[LoudMusic]

I know I'm way off topic, but I have to ask. What is Real good for anyway? What do they do, for a fee, that isn't done by a variety of other sources for free? And I know their media player software is free, but in their case the fee is all the garbage that comes with it. Or you pay a monetary fee and likely still get a bunch of garbage you don't want.

So to make some on topic comment I will say that I fully support this form of capitalism. Real could pay them for the information - it's a better deal than hiring a consulting company that may or may not discover a problem. At least these people have already done work with positive results.

Why?

[BraneSpace]

I suppose this really comes down to the intent of the security firm. WHY did they go looking for vulnerabilities? A common theme I see repeated here is that they spent time and effort looking for vulnerabilities. Why would they do so? What is their profit model? I see three real(hehe) possibilities.

1. They are planning to sell the information to (criminal) third parties.
2. They are planning to sell the information to Real.
3. They are trying to sell services to Real.

The fact that they offer it to third parties before offering it to the vendor (or at least offering a grace period) is very telling. They are trying to coerce Real to buy the vulnerability information before attacks appear in the wild. Failing to do so would lose them profit and face in the digital world, especially as this is being highly publicized.

Thus, either the firm is finding and selling vulnerabilities for criminal purposes or doing so to pressure companies into buying them. Either way, they are doing harm (to Real and/or end users). While it may not be illegal per se, this is a very underhanded thing to do.

Re:Why?

[Anonymous Coward]

I suppose this really comes down to the intent of the security firm. WHY did they go looking for vulnerabilities? A common theme I see repeated here is that they spent time and effort looking for vulnerabilities. Why would they do so? What is their profit model? I see three real(hehe) possibilities.

Well, maybe they are funded by Microsoft (.wmv) or Apple (.mov) to find ways to make Realplayer look bad (although, Realplayer's format seems pretty dead these days).

Or, maybe they are looking to make a name for themselves to establish a subscription model from large companies looking to protect themselves. L0pht made their rep selling L0phtcrack which demonstrated how unsafe the default windows password settings were. Lots of companies pay for regular antivirus updates, or advice from analysts & insightful news. Some companies are willing to pay for advance notice of security problems.

Re:Why?

[Anonymous Coward]

WHY did they go looking for vulnerabilities?

Why not? If you are looking to buy a used car, do you take it to a mechanic to go over it? If he charges $100 for the service, do you pay it? If not, is he not free to keep the findings to himself? If you do pay him, do you turn the report over to the seller free of charge?

In the case of the sneaky real estate bastards, notice that an inspection report on your house, even if paid for by you, automatically becomes a public record, regardless of who paid for it. In California, at least.

Re:Why?

[bliz1985]

Why would they do so? What is their profit model?

1. discover zero-day
2. ????
3. profit

Fight fire with fire

[SamP2]

According to Russian copyright law, "purely informational reports on events and facts are not copyrightable". The copyright on the code itself belongs to RP (and copyright to all other flaws discovered by this Russian company belong to their respective owners), and the simple informational fact of knowledge about flaw is not subject to copyright.

RP can legally subscribe to be a "customer" of this security firm, and then just take all information they deliver, and pass it on to all parties involved (in other words, send flaws to all companies whose code has a vulnerability the relevant information). Several companies can team up and split the "subscription fee".

Consider this to be the security (and legal) version of ripping a pay porn site and dumping the contents on eMule. The Russian company won't go far with a single paying subscriber.

Re:Fight fire with fire

[Anonymous Coward]

the simple informational fact of knowledge about flaw is not subject to copyright.

True, but it *is* subject to a NDA, and a hefty contract with damages.

Consider this. If discovering bugs is wirth money, more people are incentivized into the business of finding them, and hence, more bugs are found faster. That is a Good Thing (TM).

Re:Fight fire with fire

[Geminii]

Except that there won't be just the single all-companies subscriber, will there? The information will still be available to sell to other people as well - unless Real et al are going to broadcast all of their own code's security flaws all over the net in real time.

Additionally, every company in the sign-up gang would have to be 100% sure that they were OK with their own security flaws being sent out to dozens, potentially hundreds of other companies. Is Real absolutely confident that there's no-one in Microsoft, SCO or Jimbo's Bait Shack & Warez who could possibly want to onsell, leak, or use the information to take Real down a peg?

Re:Fight fire with fire

[Anonymous Coward]

If that happens then just just set a really high fee. One customer per flaw at millions of dollars each?
I'd invest.

I don't use Real...

[keraneuology]

Recently Yahoo announced that they were selling my music account to RealNetworks at twice the current subscription fee. Based on the poor history of that company there isn't a snowball's chance that I'll get a subscription to Rhapsody. Knowing that Real has security flaws in what they -claim- is a cleaned up version of their adware engine is no particular shocker. I don't care what happens to them - does anybody still use them anyway?

Re:I don't use Real...

[RuBLed]

Apparently, the blackhats do...

proprietaryness doesn't matter here!

[fishermonger]

and if this zero-day was targeted at mysql? Please mod down parent.

thank you

[vespacide2]

for explaining what the orthodox definition of blackmail is.

Capitalism's heart

[dokebi]

This is an interesting revenue model. If company A pays for a security audit, any exploits found are "bought" only once by company A. In this case, these guys can keep selling the exploit again and again, including to company A, but then to many others.

Russia has taken Capitalism to their hearts--principles be damned, everything has a price. It's funny how most of slashdot is lamenting good vs evil, while a clear profit is to be had. What happened to American business spirit? We should be proud that we exported capitalism to Russia, and stop bitching when they do it better than us. </sarcasm>

Re:Capitalism's heart

[superwiz]

What happened to American business spirit? At the same time as Russia got captured by the business spirit, USA has gotten captured by the socialist spirit. Just look at the latest elections. The sentiment of slashdotters (most of whom are Americans) is as much a proof of that as the latest primary elections.

Re:Capitalism's heart

[Anonymous Coward]

This is an interesting revenue model. If company A pays for a security audit, any exploits found are "bought" only once by company A. In this case, these guys can keep selling the exploit again and again, including to company A, but then to many others.

OTOH, what's to prevent Company A from re-selling (sub-selling) their newly-purchased knowledge? Some kind of EULA on the report, written by the Russian vendor? Gotta amortize this knowledge purchased at great price, right?

Ah!, the down side to proprietry software

[EEPROMS]

If you sell software under a restricted proprietary license you have set the rules for all dealings with with your code as being based purely on monetary gain. So if some programmers figure out a security flaw with your software they like you "don't have to give away their code or IP for nothing" because you also insist on not give away your IP either.

Re:Ah!, the down side to proprietry software

[doktor-hladnjak]

How would this really be any different with open source software? The company could still claim they found an exploit and won't release a patch or announce the details until somebody pays $x in ransom.

laugh, snort, laugh

[vespacide2]

When companies ship software with security holes, it's a product defect. If they don't want to be embarrassed by that in public, they should simply not introduce security holes.

Not the sharpest tool in the shed, eh?

Re:laugh, snort, laugh

[Anonymous Coward]

Not the sharpest tool in the shed, eh?

Talking about yourself, eh?

Security holes are avoidable. I'm sorry you don't know how. If companies were liable for security holes, people like you would be out of a job.

Re:I for one ...

[Anonymous Coward]

There's also a fourth class of potential customer - security product vendors (such as IPS or anti-malware vendors).

If you can sell knowledge of a zero day exploit to an IPS vendor, they can trumpet their 0-day protection when there isn't even a patch from the app vendor and by the looks of the wording in TFA, it looks as if this is their target market;

"Gleg sells exploits to about a dozen corporate customers around the world, with fees starting at $10,000 for periodic updates."

So for the IPS and anti-malware vendors, Gleg is a supplier of exploit information that they can use in a legitimate way and in that respect, prima facie, the business model is valid and any talk of blackmail could potentially be libelous.

Wow!

[vespacide2]

they should simply not introduce security holes.

Why didn't anyone think of this before??
Wait a second...
You're the person who was saying that P2P wasn't allowed By Comcast's TOS the other day...
I did waste my time taking you seriously.

Re:Wow!

[Anonymous Coward]

Why didn't anyone think of this before??

Because you're a moron. You already demonstrated that.

Comment removed

[account_deleted]

Comment removed based on user account deletion

because

[vespacide2]

How do we know it is a real hack? How do we know it isn't a shake down?

Because they wouldn't get paid if was fake. It's not like the RealPlayer people are gonna send the money without proof.

Like it or not, this was bound to happen

[SleepyHappyDoc]

Setting aside the debate as to whether or not they should have a dollar value, the bottom line is that exploits do have a dollar value. Someone can use an exploit to take your money, your bosses money, you government's money, etc., which will always give these things a value to people with the requisite lack of ethics needed to use them in that way. Because of this, there's simply no economic incentive for this company to give away their commodity of value for nothing. If this kind of thing is to be stopped, we'll need to find a way to change that balance...either by paying for the exploit (giving an economic incentive to disclose) or by some kind of legislative approach (to create an economic disincentive for not disclosing). The legislative approach has such a history (it worked so well on software piracy) that it probably won't work all that well, here, which leaves us with this. Got a better idea?

Re:Like it or not, this was bound to happen

[EEPROMS]

Easy set a bounty price on bugs. A serious security flaw gets you $2k then regressing downwards in price depending on how important the bug is. Also make sure that that part of the bounty payment procedure is a contractual agreement regarding the IP. So if anyone decides (stupidly) to release any of the information it is a simple breach of contract. Lets be honest humans do not like doing things without some form of monetary or social gain and to pretend another alternate false reality exists is naive.

Re:Like it or not, this was bound to happen

[SleepyHappyDoc]

TFA seems to think this is only slightly better than eating children. I guess using words like 'blackmail' increases blog clicks.

Re:Like it or not, this was bound to happen

[EEPROMS]

Yeah, I want to play a real media file so Im forced to download or use some software made by real, talk about blackmail heh.

Wow that sucks...

[Lally Singh]

I'd really feel for them. You know, if it wasn't RealPlayer.

Come on! Who doesn't hate that pile of garbage?

Re:Wow that sucks...

[Anonymous Coward]

The fact that it's garbage doesn't imply that you know anything better. Most likely, you don't.. Trying to win Brownie points with the 'Slashdot crowd' isn't enough to hide your ignorance.

Re:Why does this remind me of Fermat's Last Theore

[mudachuka]

An escrow arrangement might offer a way out of the lack of trust by the parties.

Re:metasploit would

[dkarma]

what other reason would someone other than Real want to purchase the information except to do no good?

****

What about security teams like metasploit and the like?

There are perfectly reasonable people who are interested in this exploit possibly for the sole purpose of protecting their business or personal computers. Your jump to the conclusion of "anyone wanting this except Real just wants it for criminal uses" is ridiculous to say the least.

hahahah

[vespacide2]

How about:
3 cents, a half-eaten snickers bar, and nasty bout of syphilis.

Re:I for one ...

[clarkkent09]

Easy solution from Real's point of view: don't release products with major security flaws. If you do, don't expect people to put in lots of work to find them and then give them to you for free.

Interesting problem.

[v(*_*)vvvv]

With software is it even possible to ship a product without a defect?

In any other industry the manufacturer is responsible for their products. With software, the situation is quite different because software runs in an environment, and the environment has its own defects. It also evolves and changes. For example, a Windows application can break at anytime because of something in Windows or something new on the system. This doesn't just include mistakes. Sometimes a perfectly harmless update or patch can have adverse effects .

Of course, none of this matters because all software ships with a disclaimer. So REAL doesn't really care... But still it is an interesting problem.

The Evgeny Legerov Charity Organization

[Anonymous Coward]

Geeze Evgeny Legerov, you won't just give us the solution? You mean we have to pay you to be our security adviser?

Companies too cheap to pay for Q/A deserve it

[Anonymous Coward]

I've only worked with one company in the last 3 years at least -- that would pay the expense for a permanent Q/A person. When developing software, companies will pay for time to code extra last minute features but not do any Q/A for them.

What are all those out of work Q/A people to do?

Not trying to be a smart-ass, but...

[s_p_oneil]

Does anyone use RealPlayer? I mean, it's worse than QuickTime (and I HATE QuickTime).

Re:Not trying to be a smart-ass, but...

[EEPROMS]

At a meeting of fellow anime fans someone turned up with a DVD full of real media ripped files, we all laughed when we saw the files on the big screen (no one asked for a copy either). These days everything is either xvid/AVI/mp3 or the much preferred H.264/mkv/OGG (or AAC) high res files.

Re:Not trying to be a smart-ass, but...

[stonertom]

Does anyone use RealPlayer? I mean, it's worse than QuickTime (and I HATE QuickTime). To be fair to Real, have you ever used it on anything that isn't Windows? RealPlayer is fucking horrible on windows ("Why would this stupid user have assigned media to other players? I'll change that"), but on both Mac and Linux it's a perfectly usable player for streaming media.
TBH, dunno if it's still as bad on windows. Last time I had a home windows box, it was vista in a VM to test it for "I'm an idiot" security (search "windows vista crack" and get all you find haha)

Re:Not trying to be a smart-ass, but...

[Britz]

For some reason VLC didn't work with the BBC English learning page for my girlfriends Windows XP laptop. I tried to make it work, but to no avail. She uses Firefox for accessing that page. The only way to make it work was to copy the URL of the audio and paste it into VLC.

Installing Realplayer and turning off the autostart options proved to be the easy solution. Also Realplayer always works now with streams. No VLC hassle anymore.

Re:Not trying to be a smart-ass, but...

[LooseBrie]

Sadly the BBC radio website enforces RealPlayer to play any show.

Re:Not trying to be a smart-ass, but...

[freedom_india]

Your girfriend's PC probably died after that.
Seriously, have you ever used Real Player 7 or 8 or even the latest one?

And you are calling VLC a bad player??

That's bad. Not even you can respect yourself anymore.

Nothing's free...

[Quixote]

If a pharmaceutical company comes up with a cure for (say) AIDS, should they be forced to give it out to the rest of the world for free? I mean, lives are at stake there, and presumably lives are more valuable than Junior's ability to play the latest Brittney hits.

If the prevailing logic (that the Russian company should cough up the goods for free) is applied, all pharma companies would be non-profit charities...

Re:Nothing's free...

[Idiot with a gun]

If that logic were applied, everything would be a charity. Then again, that would be nice if everything were done for free.

Re:Nothing's free...

[Hoch]

Mod parent up. Best analogy of the whole page.

In addition, if there isn't a market for disclosure, there will always be the black market.

Re:Nothing's free...

[Anonymous Coward]

There's a rather significant difference though: If that Russian company chooses to sell their information, I doubt there is any danger to anyone's life, even if they can't afford to pay. So if they choose that business strategy, fine with me! I'm not so fine if a company would charge through the nose for a cure for AIDS. In fact, I would say screw those patents and what-nots and let others produce the cure too. But then again, I'm not such a big fan of patents in the first place...

Re:Nothing's free...

[eulernet]

Come on, your logic is flawed !

Suppose that a company found the cure for AIDS, does that mean they will sell it only to the highest bidders ?

Millions of people are dying, but you'll only save the richest ones ?
I question your ethics !

Instead of selling their exploit (I imagine that hackers will easily pay for this, since they make money from exploiting such security holes), they should disclose the exploit in 30 days.
This will make help them to be known, and may attract clients, and they can provide it to their customers meanwhile.

Re:Nothing's free...

[jimicus]

If a pharmaceutical company comes up with a cure for (say) AIDS, should they be forced to give it out to the rest of the world for free?

Erm... I interviewed with a pharmaceutical company some years ago and in the course of my research I discovered that they had invented a number of medicines which were on some sort of a list held by the World Health Organisation of "drugs which are so important to public health all over the world that international law states that they must be made available universally at a reasonable cost".

I didn't research this any further, but I'd expect any half-decent cure for AIDS to find itself on that list so quickly the pharmaceutical company would be saying "damn! wish we'd spent the money on trying to cure baldness!" quicker than you can say "retrovirus".

Re:Nothing's free...

[Rich0]

In fact, I would say screw those patents and what-nots and let others produce the cure too. But then again, I'm not such a big fan of patents in the first place...

That's ok - most world governments tend to agree with you. Then again, maybe that's why most private pharma companies don't spend much money working on a cure for AIDS.

I see it the other way. Where do you want companies focusing their efforts - on erectile dysfunction medication or cures for plagues? If you want them to focus on the latter, then don't reward them for the former while punishing them for the latter! Life-saving medicines are exactly the kinds of things that companies should make lots of money on. Governments just need to stop spending so much on bombs and make it a little easier for people who can't afford the drugs to obtain them - not try to make them free...

Re:Non free morals, the victim is also a criminal.

[bluefoxlucid]

It's a wonderful charity to create something like Ubuntu and all the programs and tools and kernel code that went into it; but should McDonalds be giving its food away for free because you need food to live? You have to get it somewhere, and everyone else is charging. I can't tell the difference between an idiot and an idealistic marxist living in a fantasy world.

Work for free, but be ethical?

[saikou]

I am not sure I understand correctly, where people got the idea that that particular security research company sells info to "the bad guys". Unlike the open source software, inspecting and finding flaws in black box type of systems is more labor intensive (perhaps some of it can be automated but only some). Someone has to pay for this. Because if they do "the ethical thing" they will have no money to pay rent and buy food, and won't be able to continue what they do. That way users will still "suffer due to bugs", except it's more likely that some shady company will be able to afford to pay someone to find exploits for them ONLY versus selling it to other security testing companies.

Easiest solution is, of course, to pay for updates via cooperation between multiple companies that just happen to have extremely buggy software. If you have regular zero day exploits popping up every month, those $10000 are well spent. They don't want to pay their developers to change the process and improve the testing, then they pay third party for black-box audits and fix problems after the fact.

If you want to get on ever higher ethical horse, think about ethical problems of the company that keeps releasing buggy stuff over and over and over again. If you accidentally add poison to your cookies every few months (instead of just laxative, because you give the cookies away for free and get a fee from anti-diarrheal manufacturer for spikes in consumption), wouldn't you have ethical obligation to stop the bakery and re-evaluate your process? Of course pointing finger at third party that does poison testing of baked stuff and sells results to merchants and labs is much easier.

Re:Non free morals, the victim is also a criminal.

[willyhill]

The more reprehensible of non free software companies will deny a flaw exists when it's presented to them and beg the discoverer to keep quiet while they "fix" the problem ... forever and then act angry when the flaw is revealed to the public.

You mean like Mozilla? I'm not sure if private security mailing lists, "confidential bugs" and all that are reprehensible, but they might be. Or do you mean another type of "reprehensible"?

Their existence may be repulsive

You mean like Mozilla, or do you mean another type of "repulsive"?

My patience for these parasites is exhausted.

Indeed.

Re:Non free morals, the victim is also a criminal.

[QuantumG]

And so we face, in the twenty-first century, a very basic moral question. If you could make as many loaves of bread as it took to feed the world, by baking one loaf and pressing a button, how could you justify charging more for bread than the poorest people could afford to pay? If the marginal cost of bread is zero, then the competitive market price should be zero too. But leaving aside any question of microeconomic theory, the moral question, "What should be the price of what keeps someone else alive if it costs you nothing to provide it to them", has only one unique answer. There is no moral justification for charging more for bread that costs nothing than the starving can pay. Every death from too little bread under those circumstances is murder. We just don't know who to charge for the crime.

      - Eben Moglen

Hire them to pentest your crappy player, Real

[Elbarfo]

After just taking a look at Real's market cap (a whopping $831 Million! - my gawd is it really worth that much?!), and Q4 revenue of $125 Million (!), the 10k they would spend on them is a tiny little drop in the bucket compared to what they should already be spending on heavy pentesting anyway. 10k wouldn't even cover the cost of Mt. Dew and Cheetos for a year of a highly qualified pentesters time.....

How much would it damage Real if they (Gleg) just released the exploit into the wild? Far more than 10k's worth, assuredly.

Why not compromise

[martinlp]

This is exactly what the Tippingpoint zero day initiative is for. To give credit and a bit money to researchers who spend time and effort to discover vulnerabilities in software.
Sure these researches should get money/credit, but what if they become greedy or irresponsible?

Re:Why not compromise

[Anonymous Coward]

Then would be others that could dedicate full time to the job and get properly paid that will do the research and would fix it. How is that those software companies make money and want to get the information for free? Doesn't sounds to you a little bit abusive from their side. I charge you for soft/services and get stuff free from you. Good, another reason I have choosen to switch to the other side. I do the soft and you do the researh and hand it over to me for free and if somebody suffers is the users. I will always win ;) jajaja.

Re:Non free morals, the victim is also a criminal.

[Anonymous Coward]

1- Bread is not software. Bread cannot be duplicated endlessly.
2- The marginal cost of bread is not zero. Not by far. Just like the cost of software is not zero, except when you duplicate it infinitely. See 1.
3- Moglen, like Stallman, believes we should all live in a barter-based society where we trade stuffed animals for steaks and toilet papers for C compilers. It's a nice vision that has never been proven to work beyond small social structures.
4- You lose at teh analogies. Thanks for playing.

Create EXPLOIT. Tease Masses with cure. PROFIT !

[Anonymous Coward]

Explain the concept of capitalism in eastern Europe:

  1. Create EXPLOIT

  2. Tease Masses with cure

  3. PROFIT !!

  4. Release EXPLOIT

  5. Grab another bucket full of vodka

  6. VOMIT !!

nothing

[vespacide2]

How much would it damage Real if they (Gleg) just released the exploit into the wild? Far more than 10k's worth, assuredly.

If it was released into the wild, Real could (most likely) have it patched in a matter of hours.
The fact that they're not releasing it into the wild is a problem. Until it gets released (or Real pays up or finds it themselves) it will be a nasty weapon used for nefarious deeds.

as they should be

[vespacide2]

It's so disgusting that US companies hold back the spread of medicine for profit.

Re:Non free morals, the victim is also a criminal.

[QuantumG]

Moglen, like Stallman, believes we should all live in a barter-based society where we trade stuffed animals for steaks and toilet papers for C compilers. It's a nice vision that has never been proven to work beyond small social structures. I think he says it better than you:

We wanted freedom of knowledge in a world that didn't give it, which burned people for their relegious or scientific beliefs. We wanted democracy, by which we meant originally the rule of the many by the many, and the subjection of today's rulers to the force of law. And we wanted a world in which distinctions among persons were based not on the color of skin, or even the content of character, but just the choices that people make in their own lives. We wanted the poor to have enough, and the rich to cease to suffer from the diseases of too much. We wanted a world in which everybody had a roof, and everybody had enough to eat, and all the children went to school. And we were told, always, that it was impossible.

      - Eben Moglen

Common Business Model!

[Jane Q. Public]

Hmmmm...

I am in the lawn care business. I know why your lawn is dying. I will make it green, for a fee.

I am in the computer tech business. I know why your sound card has a problem. I will fix it... for a fee.

I am in the computer tech business. I know how to fix the virus(es) in your computer. For a fee.

I am a chef. I know how to cook your dinner. Do you expect the recipe for free?

And so on. It would be "giving to the community" to give them the information for free, but this kind of business model *IS* all around us. No point in singling them out.

Re:Common Business Model!

[Anonymous Coward]

I am in the lawn care business. Somewhere in your neighborhood there is a tunnel that leads to a secret door in your basement. I will reveal it to anyone who pays my fee.

I am in the computer tech business. I happen to be the only one who knows how to control a virus in your computer. For a fee, anyone can now exploit your computer for their own ends.

See the difference yet?

Re:Common Business Model!

[Shadowlore]

A fundamental flaw, Jane, in your analogies exist, but I won't tell you about them.

Ok, seriously though, it is there. There is one and only one party that can actually fix the problem: Real.
Surely this company doesn't have legal access to the source and legal authority to "fix it" and ship it out, right?

Seems virtually everybody commenting here missed that bit. According to the article, this group/company refused to let Real have the information only "other paying customers". None of your analogies apply. I'm sure Real could, if they wanted to, easily afford to be a paying customer.

Here is one that does:
I know there is a flaw in your car's alarm. I'm not going to tell you what it is, period. But I will sell the information to the local car thieves. For a fee.

Now, that isn't blackmail either. Blackmail would be me trying to get you to do something (other than pay me money since that would be extortion) or I will release the information to people you don't want to have it.

Is it wrong? Absolutely. Is it illegal? Maybe:

"It has probably been latent for many months. Real's customers were vulnerable as soon as they downloaded this version of RealPlayer. There is currently knowledge circulating in criminal circles and attackers are using it to compromise Real's customers."

It's called being accomplice. In some jurisdictions, knowing something illegal is going on, having an ability to do something about it, and choosing not to is a crime. It may even be able to be called suborning(?) illegal activity.

If this was about a vulnerability is voting machines, would you maintain your position? If I knew a way to make a voting machine do what I wanted, say tally up more votes for a candidate of my choice, I could get very rich selling that information to the right people. Even if I sold it to libertarians, I'd still be in the wrong (but sorely tempted!).

Capitalism never trumps basic morality. That's not capitalism that's greed. Calling it, or accepting it as, a "common business model" is wussing out. "Everybody does it" is not just for people who want to justify doing it, it is much more useful to those who don't want to feel any responsibility to do something about a wrong or have to admit something is wrong. To do so when that comparison is faulty is just plain messed up.

Me, I don't use or like Real. But it's still wrong.

Simple Solution

[DingoTango]

CERT needs only to attach a license to their security advisories indicating, for example, unlimited right to use EXCEPT for named companies such as Gleg. Since Gleg undoubtedly uses much of CERT's content for their other advisories to paying customers, this would give them an incentive to share their information with the same community that they rely heavily upon.

QED
IANAL YMMV

This only strengthens my resolve

[ajs318]

The only way that the computer-using public can be properly protected from the most egregious excesses of the computer industry is for Government to mandate that every piece of computer software must be supplied with Source Code, or not at all.

Just because you get the Source Code doesn't mean you would have to get distribution rights (see PGP usage licence, Skype / Flash developers' licences and pre-GPL Java licences for examples of licences which grant access to Source Code while restricting distribution). And lack of Source Code hasn't done much to stop Office and Windows from being pirated.

Mandatory provision of Source Code would enable third party code auditing, which is important from the user's perspective. A whole secondary industry could grow up around auditing code and supplying upgrades (and these companies would be ideally placed to monitor licence compliance; in fact, for them to supply upgrades to improperly-licenced software would constitute Aiding and Abetting piracy. There's already a non-computer parallel: try and buy a TV set from a high street vendor without some sort of evidence that you have a fully paid-up TV licence).

No doubt there will be howls of protest from software vendors, who have been getting away for far too long with shipping inferior product under the disguise afforded by not supplying the Source Code. Fuck what they think. Users outnumber vendors, and the needs of the many must outweigh the whims and caprices of the few.

Real has all the information already

[flyingfsck]

Real has the source code. They don't need to pay anybody else to find the bug, they can do their own code review.

Anti-Virus?

[tkrotchko]

"If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee?"

That's called Anti-Virus, and a lot of companies get rich from it.

No seriously, is that really any different than saying:
      "I know how to make sure you won't die from aids, but I won't save your life unless you pay me for the medicine"

If you accept the idea of Intellectual Property, I see this as a natural progression of IP. What's good for the goose is good for that gander.

Paying for exclusivity for virus exploit info :(

[ErkDemon]

It partly depends on whether the information was generated in-house by the company itself, or whether (as seems to be happening more often nowadays) they "bought in" details of a potential exploit through a brokerage firm, and paid for exclusivity to that information.
The second situation is much more dodgy.

It's paying for exclusivity that tips the situation over the edge into possible criminal conspiracy if a major exploit subsequently happens. If your house gets looted because you forgot to lock a door, and your neighbours say afterwards that that they saw your door open but didn't get around to telling you, you might be a little disgruntled about it, but they can say that they were acting in good faith. After all, they aren't responsible for your house, and it's not up to them to tell you how to run your own affairs.

But if you find out that your neighbours had seen your door open, and had then decided to cash in by selling that information to a dodgy local private security firm just before you got burgled, you might have a few questions. If, after the burglary, your neighbours explain that they weren't allowed to tell you, because the security firm had paid them specifically not to tell you about your house's vulnerabilities, then you may get rather upset and conclude that the security firm are probably a bunch of crooks, and that neighbour is a nasty two-faced criminal piece of shit.

If someone decides to be a good neighbour, that's great. If they decide not to be a good neighbour, that's usually their decision. If they decide only to help you out if you pay them, that's also often understandable.

But if people don't help you out because they're specifically being paid not to be neighbourly to you, and not to help you even for money, because a company that wants to sell you a service is paying folk not to do anything that might undermine their exclusivity, so that they can charge higher prices ... then that's something potentially very different.

In Soviet Russia...

[snarfies]

...security breaches YOU!

$10,000 for periodic updates

[mapkinase]

Seems like not a bad price for a company whose software runs in millions and millions of copies around the world.

If we assume that $10,000 is for a year: that is the cost of one tenth of a full time internally hired security expert.

I think Real should consider subscribing to the services of Gleg.

Re:$10,000 for periodic updates

[harryjohnston]

And the next "security research" company? And the next one? And the one after that? And ... well, you get the picture.

Alun Jones expressed it best: http://msmvps.com/blogs/alunj/archive/2008/02/07/1501848.aspx

Re:$10,000 for periodic updates

[mapkinase]

There are not so many really good reliable "security research" companies that sell their services. If they will subscribe to ten of them that will be still the cost of one full time security specialist.

The reference did not really say much compared to the ./ front page summary. I am not sure what is the purpose of the link.

Re:$10,000 for periodic updates

[harryjohnston]

How is subscribing to ten "good reliable" companies going to help if the next vulnerability is discovered by a not-so-good, not-particularly-reliable company?

Re:$10,000 for periodic updates

[mapkinase]

The purpose is not covering all vulnerabilities. That is impossible. The purpose is to cover reasonable number of them for a reasonable price.

Re:$10,000 for periodic updates

[harryjohnston]

Well, since most vulnerabilities are disclosed to the vendor when discovered, you can cover a "reasonable number" without paying a thing.

Of course, covering a "reasonable number" of known vulnerabilities doesn't actually help, since the bad guys are going to use the other ones. Ultimately, the only "reasonable number" of known vulnerabilities to fix is "all of them".

Re:$10,000 for periodic updates

[mapkinase]

I understand your fundamentalist approach to vulnerabilities.

Zero Day

[Stooshie]

Real Player does not contain a Zero Day. It contains a Zero Day Vulnerability. If it did contain a Zero Day it would have been put their by real. :-)

Bad Analogy

[Anonymous Coward]

That analogy sucks because the Russian researchers didn't come up with a cure for anything; they came up with a possible exploit.

Here's a better analogy:

If a pharmaceutical company discovers a weakness in a certain ethnic group's genotype that allows an agent (normally harmless) to selectively kill members of that group, should they be allowed to sell the information to third-world dictatorships?

If your logic is applied, the pharmaceutical company should be able to be a party to genocide, with no legal consequences whatsoever.

Criminals are part of our economy

[raftpeople]

There are three classes of potential customers: product owners, users, and criminals. If the researcher makes it clear they are willing to sell their information to the third class - criminals - then it matters little if they are also willing to sell to the other two classes or not.

Did you know that criminals drink Pepsi and eat at McDonalds?

How else are they...

[fozzmeister]

How else are they going to get paid? They did work, Real expect them to donate their work for free. I don't see it as unreasonable to ask for payment, whether Real think the price is too high is a matter for them (and their customers?)

Re:How else are they...

[harryjohnston]

They've already been paid. They have a customer base, or so they claim; and it is certainly in the interests of their customers, or their customers' customers, that the information also be provided to the vendor - unless, of course, their customers are planning to use the information maliciously.

You can't get anything right...

[vespacide2]

Hi nguy,
umm, ok, nobody else though of this because I'm a moron?
You do realize that doesn't make sense, right?

is that you morpheus?

[vespacide2]

Ok, so Real, (a huge company with tons of resources) was told about the exploit months ago and a video of the exploit in action has even been posted by Gleg and they still can't find it?
Yeah, they should have just found it before. (rolls eyes)
How? They can't even find it now.

Security holes are avoidable.

Yeah, everyone just chooses not to avoid them. (no one's got it figured out like you) (and your perfect code)
Even Slashdot won't claim that:

The comment engine is reasonably bulletproof

Re:Non free morals, the victim is also a criminal.

[dcam]

When did insurgence against imperialism become a bad thing?

When you are the imperialists. Next!

Re:Non free morals, the victim is also a criminal.

[Anonymous Coward]

How is it that you can think otherwise?

He's rational. You're a religious nut. Simple.

Anti-Intellectual Property

[gr8scot]

Seems like they leaked the information and want to be paid for that.

Re:I for one ...

[mysidia]

BS. You have no evidence that all their subscribers fall into those categories.

There can certainly be categories of potential subscribers that neither you nor I have anticipated.

Their service is not specific to Real: they are likely to have corporations as subscribers, corporations that are either in the business of writing one of the popular applications that has security issues, or are in the security business.

The vulnerability in Real would be merely one flaw that they have discovered in one particular software product.

Their purpose in life is not to solely share exploits related to Real products, therefore it makes no sense that their target audience has anything to do with real.

The subscription nature of such services, and the large number of software vendors and security vendors means that they _don't_ just make one sale, there is most certainly a large monthly fee involved.

Few sales are just fine, if the price is sufficient, and recurring prices are high enough.

You show no evidence that they target customers who have a possibility of using the information with criminal intent: whereas, it is very possible that they scrutinize their customers, they may perform background checks to help ensure that's not the case.

There is absolutely no evidence shown to support the contention that they are attempting blackmail or any kind of malice.