Slashdot Mirror
Security Research and Blackmail
harryjohnston alerts us to a story picked up by a few bloggers in the security space. A Russian security research company, Gleg, has discovered a zero-day in the latest version of RealPlayer 11. But they won't reveal details to Real, or to CERT, despite repeated requests. Details are available only to their clients who pay a lot of money for early access to such knowledge. To describe Gleg's business model Daniweb rather cautiously puts forward the word "blackmail." The story was first exposed in Ryan Nariane's Securitywach blog.
How about just "proprietary knowledge".. ya know, like the source code of Real Player?
How we know is more important than what we know.
It's called capitalism, and it's been breaking out in eastern Europe ever since the USSR fell. In unregulated areas (i.e. new markets) they have a much more "pure" concept of it than the west. The public good is a socialist idea. This same thing happens in a lot of places in the west where there are shops that specialize in IP of some sort. They have to make their living somehow. It's just that people are used to security companies giving this stuff away for free.
boldly going forward, 'cause we can't find reverse
If this is valuable information (as in there are people willing to pay money for it) why should they give it for free? Companies pay good money to consultants to come over and fix problems with their business, why shouldn't they have to pay people who help them fix problems with their software products.
Negative moral value of force outweighs the positive value of good intentions.
Not blackmail. But poorly designed software tends to have security bugs.
These bugs pose a problem for users of the software. It makes sense that third party services exist that scour software for bugs like this, for the benefit of the software's users and prospective users.
So they can know whether to use the software or whether to take extra precautions/refrain from using it.
The cost of performing this type of analysis is high. Much time and energy is required.
It makes sense that you need to pay to review their findings in detail, or to review them before they are publicly released (for free).
If they merely submit their findings to the software vendor, then they have provided the vendor with high-quality, costly labor for free.
Why should the software vendor get free labor from security researchers, and be able to freely follow poor design practices in the design of their software, while relying on the public to find and report the issues gradually? (For them to lazily fix _after_ the defect is drawn to their attention)
If the security researcher wishes to serve the community, then they have the option of practicing full disclosure, but they may be more fairly compensated for their work by providing paying customers with key information in advance, so their customers can mitigate the problem, before it has become public (and known to the bad guys).
One way you mitigate the problem is very simple: uninstall the defective real player 11. Re-install the fixed version, when it becomes available.
I'm sure that you'd easily come up with a lot of reasons why it isn't cool.
On certain superficial moral levels, sure - proprietary closed-source shops would have it coming in a fashion. They make money from hidden information, so hiding information from them until a fee is paid sounds a bit like karma.
OTOH, that's not how we're supposed to work as a community, for one simple reason: end-users don't deserve the grief (which they would get in increased costs that would be passed onto them). Morally, a security researcher isn't supposed to hold information hostage and then credibly claim to be part of any ethical hacking community. At level best, they would be called grey hats; many would rightly call them black-hats.
Sorry, but there's a distinct lack of responsibility and ethics going on here, no matter how much you think the primary target may deserve it.
Quo usque tandem abutere, Nimbus, patientia nostra?
I have this lovely demonstration, but you have to pay me to show you how it works. How do we know it is a real hack? How do we know it isn't a shake down?
This is a shade of Fermat's last theorem. Wiles, after he finally proved it, said that he doubted Fermat actually knew a viable proof.
We don't know what these guys have. Whether it's blackmail or not, it still smells bad. I think the money would be better spent on real security researchers who disclose what they find.
Nearly fifty percent of all graduates come from the bottom half of the class!
How does your argument differ from the profession of a lock smith? They know how to get in your house, and you can pay them to get you into your house. Now is it ethical to withhold information that could be used to hurt others, I would say that I personally think no But if they have discovered something that is beneficial to someone compensation does not seem unfair if reasonable.
Drug companies worldwide hold proprietary information that would greatly benefit the public but rather than release it they use it to further their own research. Obviously if you take that away you might as well ditch capitalism while you are at it.
By they way Real can simply have some moog in their office pretend to be a customer of the gleg service and buy the data and then pass it on to real. If there is some contractual reason why they can't they can just have that moog work out of a country where the contract means nothing and then leak the info to real. I mean seriously how hard could it be.
I don't see it that way. In my view, they're not "threatening damage" but promising results. They're essentially saying "Hey Real, if you hire us to do a security audit, we can guarantee we will find at least one serious vulnerability, and your money will have been well spent." It's a bit disingenuous to phrase it this way, but it essentially boils down to the same thing.
Think of it as "we guarantee value for your money" rather than "give us money or we guarantee you'll wish you had," which, if you consider missed opportunities valuable, mean the same thing.
How does your argument differ from the profession of a lock smith? They know how to get in your house, and you can pay them to get you into your house.
Great analagy! Lets work with that.
Can you pay a locksmith to open someone elses house for you? Can you pay him to show you how so you can do it yourself?
Of course not.
But it goes further than that... locksmiths are both Licensed, and Bonded in most civilised countries to help prevent exactly these sorts of activities, as well as any other sort of unethical activities he'd be able commit.
Now if the locksmith discovered some fatal flaw of some widely distributed type of lock, I wouldn't say he's obligated to turn the information over to the lock manufacturer. And if he wants to sell them the information that's fine too.
But in the meantime, he still can't go around disclosing the information (for money or otherwise) or using it himself, outside of the ehtical constraints of his trade. (that is of only openining locks for the owners, at their specific request.)
Your locksmith analagy is apt. Perhaps security researchers should also be licensed and bonded before they are allowed to to work professionally and provide services to the public. (Hobbyists hackers would still be free to bang away at their own locks in their own homes.)
It's one thing for RealMedia to cause damage (release a product with a security flaw in it). It is another thing to actively exacerbate this damage (release an exploit to the blackhat community for large sums of money, and refuse to tell the vendor what the exploit is).
I suppose this really comes down to the intent of the security firm. WHY did they go looking for vulnerabilities? A common theme I see repeated here is that they spent time and effort looking for vulnerabilities. Why would they do so? What is their profit model? I see three real(hehe) possibilities.
1. They are planning to sell the information to (criminal) third parties.
2. They are planning to sell the information to Real.
3. They are trying to sell services to Real.
The fact that they offer it to third parties before offering it to the vendor (or at least offering a grace period) is very telling. They are trying to coerce Real to buy the vulnerability information before attacks appear in the wild. Failing to do so would lose them profit and face in the digital world, especially as this is being highly publicized.
Thus, either the firm is finding and selling vulnerabilities for criminal purposes or doing so to pressure companies into buying them. Either way, they are doing harm (to Real and/or end users). While it may not be illegal per se, this is a very underhanded thing to do.
Here's a better analogy for a legal activity: auto makers who sell SUVs to whomever wants them, then tell the rest of us we need one to keep our families safe in the event of being hit by one. It's a classic arms race, the only real winner is the arms dealer.
According to Russian copyright law, "purely informational reports on events and facts are not copyrightable". The copyright on the code itself belongs to RP (and copyright to all other flaws discovered by this Russian company belong to their respective owners), and the simple informational fact of knowledge about flaw is not subject to copyright.
RP can legally subscribe to be a "customer" of this security firm, and then just take all information they deliver, and pass it on to all parties involved (in other words, send flaws to all companies whose code has a vulnerability the relevant information). Several companies can team up and split the "subscription fee".
Consider this to be the security (and legal) version of ripping a pay porn site and dumping the contents on eMule. The Russian company won't go far with a single paying subscriber.
If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee? I'm sure that you'd easily come up with a lot of reasons why it isn't cool.
Honestly, I couldn't. I am sure there are security experts out there who would be able to improve security of my house but I certainly wouldn't expect them to do it for free. This idea that if you find bugs in a software product, you have the responsibility to give that information to the company that makes it, and therefore help them improve their product, for free is completely bogus.
Sorry, but there's a distinct lack of responsibility and ethics going on here, no matter how much you think the primary target may deserve it.
I don't see any ethical problems here and its completely irrelevant who the party involved is. I would actually argue that there is more of an ethical problem with testing a company's product for free, as it devalues the work of their own QA personnel, and it encourages companies to release shoddy products too early, with expectation that paying customers will help them fix the bugs.
Negative moral value of force outweighs the positive value of good intentions.
Because if they don't, your kid can starve or freeze to death or get cooked in the summer. Babies have died in cars. And letting people off "because they can't pay" is complex and leads to scams and paranoia and all kinds of weird legal confusion so it's easier to just say "Screw this, don't worry about the money" and refuse to take payment at all. I guess some people just find it hard to put a price on someone's life, at least a price on a few dollars of gas and 20 minutes of work time against someone's life.
Support my political activism on Patreon.
Hmmmm...
I am in the lawn care business. I know why your lawn is dying. I will make it green, for a fee.
I am in the computer tech business. I know why your sound card has a problem. I will fix it... for a fee.
I am in the computer tech business. I know how to fix the virus(es) in your computer. For a fee.
I am a chef. I know how to cook your dinner. Do you expect the recipe for free?
And so on. It would be "giving to the community" to give them the information for free, but this kind of business model *IS* all around us. No point in singling them out.
Real has the source code. They don't need to pay anybody else to find the bug, they can do their own code review.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Your analogy is slightly off. Even from just reading the summary you can see that this is like a locksmith with a list of criminals who subscribe to his mailing list. The locksmith works out the vulnerabilities in your security (most houses are pathetically insecure via lockpicking anyway, if you really want into a house it's not gonna be hard to get in), then lets these criminals know them, but refuses to let you yourself know what the vulnerability is. He doesn't demand payment from you - he refuses to give you the information for any price, because you almost certainly won't pay as much as all his other clients. Because you have millions of houses, with millions of [currency]s worth of currency.
:P
For some reason when I first read the summary I was thinking of this company's clients as benign, but a second reading made me rethink
which is totally what she said
"Go ahead and advertise a "locksmith" service to open the doors on anybody's home, without the owner's consent, for a fee."
Nope, thats not fair. A fair comparison would be, "Go ahead and advertise a service which gives you the tools and information to open the doors on anyones home." I am quite sure that Gleg is not hacking into various servers for clients, but are providing information about a security weakness in a certain system for a fee to their customers. What a customer would do with that information is beyond the scope of this argument. Besides neither Gleg nor Real is a charity/ opensource/ community organization.
I see this as a good opportunity for a security firm to make a little cash for their efforts. The auction approach is not necessarily the best or most ethical approach as far as we, the consumers, are concerned, but we have no proof that they didn't approach Real prior to the auction, with a private offer.
Security firms take a huge risk these days even announcing they've found exploits and publishing them. How many links do you need to articles on lawsuits against blackhats for revealing an exploit, just because some software author doesn't want it known that they have security holes? I ask myself, "How many unpublished exploits are still to be found in existing platforms because the company knows about it but has buried the information and is in no rush to develop a fix?"
Seems like not a bad price for a company whose software runs in millions and millions of copies around the world.
If we assume that $10,000 is for a year: that is the cost of one tenth of a full time internally hired security expert.
I think Real should consider subscribing to the services of Gleg.
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
I think you've hit the nail on the head.
If the company knows of an exploit and wants to sell the information about it to the vendor that's perfectly fine as long as they aren't threatening to tell others about it.
It's much list noticing my neighbor has an open wifi point advertising his file shares. Nothing wrong with offering to show them exactly what the problem is for a fee. If he doesn't want to pay for my expertise -- well, I told him his wifi point is leaving him open to hackers, so he has been warned. Now if I say I'm going to sell the information to others if he doesn't pay me -- that's extortion.
I couldn't tell with certainty from the article whether or not the firm is showing the actual exploit to their subscribers or not. They may just be informing their clients of the existence of the exploit and giving guidelines about the severity and potential impact to business operations. If that's all they're doing, I'd say they are playing to win, but playing by the rules.
On the other hand, if they sold the actual exploit to their subscribers then they're criminals.
Life is short: void the warranty.
Suppose I run a company that does security work for my clients. One of the things I do for them is run a battery of tests to see if I can break their security via any of their installed software. It seems to me that you are arguing that if I find something I have a moral obligation to inform not just my clients, but the vendor of the software.
Well, that's an interesting argument. I'm not sure I agree, but I'm not sure I disagree either.
On one hand, making sure the vulnerability is explained in detail to the vendor so that the vendor can fix it helps everyone globally that uses their software. On the other hand, why should I turn the results of my work over to them for free when they could have (should have?) found the problem themselves. It's kind of grey to me, so that's why I described it as "playing to win". I'm not making any statement whatsoever as to what you call the "qualifications" of the recipient of the information.
My big point is that I would withhold rabid condemnations of the security firm unless they are actually releasing the technical details to the highest bidder while withholding those details from the vendor.
Reporting details free of charge to the vendor is magnanimous. Notifying the vendor and offering to sell them the details (contingent on proving to them the problem really is on their end) strikes me as simply business. Notifying the vendor that you are selling off the details to anyone willing to pay is blackmail.
Life is short: void the warranty.