Slashdot Mirror
Security Research and Blackmail
harryjohnston alerts us to a story picked up by a few bloggers in the security space. A Russian security research company, Gleg, has discovered a zero-day in the latest version of RealPlayer 11. But they won't reveal details to Real, or to CERT, despite repeated requests. Details are available only to their clients who pay a lot of money for early access to such knowledge. To describe Gleg's business model Daniweb rather cautiously puts forward the word "blackmail." The story was first exposed in Ryan Nariane's Securitywach blog.
Seems fair they have information and want to be paid for it
How about just "proprietary knowledge".. ya know, like the source code of Real Player?
How we know is more important than what we know.
It's called capitalism, and it's been breaking out in eastern Europe ever since the USSR fell. In unregulated areas (i.e. new markets) they have a much more "pure" concept of it than the west. The public good is a socialist idea. This same thing happens in a lot of places in the west where there are shops that specialize in IP of some sort. They have to make their living somehow. It's just that people are used to security companies giving this stuff away for free.
boldly going forward, 'cause we can't find reverse
I don't call it blackmail, I call it a free market...
Companies have a financial incentive for keeping their products secure, open source projects have less of an issue because the money just isn't in it.
All this is - is one company spending real money, hiring well paid analysis to plow through machine code or source code and analyse vulnerabilities.
The reason they can afford to do this is because the market is full of companies willing to pay for this stuff...
Thats where your code of ethics goes out of the window!
With open-source projects, there is still a market of companies using that software but at the same time there's a limited timespan before it's usually discovered by somebody else.
You know very well that if you advertise you've found a security flaw in open source XX product you're going to have hundereds of people scrutinising it and to develop a fix - because it's benificial to everybody (so the code of ethics lives strong).
It doesn't help that `Real' has a bad reputation, but by doing this and with holding it, Gleg are doing exactly what they set out to do in the first place and doing as any successful business man/woman does: identifying the market and targeting it appropriately.
This happens every day not just in software security, but in every other industry yet people just consider it a normal day in the office and maybe grumble a bit about it.
In an ideal situation ethics and social benifit would come first though... yet this is in practice incompatible with the free market, just for the reasons above.
If this is valuable information (as in there are people willing to pay money for it) why should they give it for free? Companies pay good money to consultants to come over and fix problems with their business, why shouldn't they have to pay people who help them fix problems with their software products.
Negative moral value of force outweighs the positive value of good intentions.
Not blackmail. But poorly designed software tends to have security bugs.
These bugs pose a problem for users of the software. It makes sense that third party services exist that scour software for bugs like this, for the benefit of the software's users and prospective users.
So they can know whether to use the software or whether to take extra precautions/refrain from using it.
The cost of performing this type of analysis is high. Much time and energy is required.
It makes sense that you need to pay to review their findings in detail, or to review them before they are publicly released (for free).
If they merely submit their findings to the software vendor, then they have provided the vendor with high-quality, costly labor for free.
Why should the software vendor get free labor from security researchers, and be able to freely follow poor design practices in the design of their software, while relying on the public to find and report the issues gradually? (For them to lazily fix _after_ the defect is drawn to their attention)
If the security researcher wishes to serve the community, then they have the option of practicing full disclosure, but they may be more fairly compensated for their work by providing paying customers with key information in advance, so their customers can mitigate the problem, before it has become public (and known to the bad guys).
One way you mitigate the problem is very simple: uninstall the defective real player 11. Re-install the fixed version, when it becomes available.
Yes, but you have missed the key point.
There are three classes of potential customers: product owners, users, and criminals. If the researcher makes it clear they are willing to sell their information to the third class - criminals - then it matters little if they are also willing to sell to the other two classes or not.
Clearly, the implication is they do not want to sell to the product owner class as that would be a single sale. By selling the information to users and criminals they ensure that they have a substantial number of potential sales as well as motivating the users to buy rapidly or else they will be victims of the criminal class.
According to Russian copyright law, "purely informational reports on events and facts are not copyrightable". The copyright on the code itself belongs to RP (and copyright to all other flaws discovered by this Russian company belong to their respective owners), and the simple informational fact of knowledge about flaw is not subject to copyright.
RP can legally subscribe to be a "customer" of this security firm, and then just take all information they deliver, and pass it on to all parties involved (in other words, send flaws to all companies whose code has a vulnerability the relevant information). Several companies can team up and split the "subscription fee".
Consider this to be the security (and legal) version of ripping a pay porn site and dumping the contents on eMule. The Russian company won't go far with a single paying subscriber.
If you sell software under a restricted proprietary license you have set the rules for all dealings with with your code as being based purely on monetary gain. So if some programmers figure out a security flaw with your software they like you "don't have to give away their code or IP for nothing" because you also insist on not give away your IP either.
All the Aunt Tillies out there who use Windows because it came installed on their computers and have no idea what an operating system is. They use IE for the same reason, and when they want to hear an audio file, guess what IE tells them to install? One hint: it won't be VLC.
Good, inexpensive web hosting
Does anyone use RealPlayer? I mean, it's worse than QuickTime (and I HATE QuickTime).
If the prevailing logic (that the Russian company should cough up the goods for free) is applied, all pharma companies would be non-profit charities...
This is exactly what the Tippingpoint zero day initiative is for. To give credit and a bit money to researchers who spend time and effort to discover vulnerabilities in software.
Sure these researches should get money/credit, but what if they become greedy or irresponsible?
Hmmmm...
I am in the lawn care business. I know why your lawn is dying. I will make it green, for a fee.
I am in the computer tech business. I know why your sound card has a problem. I will fix it... for a fee.
I am in the computer tech business. I know how to fix the virus(es) in your computer. For a fee.
I am a chef. I know how to cook your dinner. Do you expect the recipe for free?
And so on. It would be "giving to the community" to give them the information for free, but this kind of business model *IS* all around us. No point in singling them out.