Slashdot Mirror
Bug Bounties: Outbidding the Black Hats
snydeq writes "Fatal Exception's Neil McAllister discusses whether independent software developers should follow in the footsteps of Google and Mozilla and begin offering bug bounties before black hats pay up for their undisclosed software flaws. 'Whichever side of the fence you fall on, the fact is that bounties are being paid for undisclosed software flaws. They're just not always being paid by the vendor who developed the software. As ever more commercial data moves into the cloud and the stakes for cyber crime rise, black hat hackers are offering real money for exploitable bugs. In turn, when exploits happen, vendors may be held legally liable for any customer data that was compromised. Maybe it's time more software shops thought seriously about using their own cash to turn the tide in their favor.'"
And we all know YOU work...
What a novel idea!
Give me Classic Slashdot or give me death!
Bug bounties are paid once. Meanwhile, there are many black hats who may be willing to pay for an exploit package, access to bot nets, etc. I imagine there is more money to be made using bugs for nefarious purposes.
The article's claim that Microsoft would have to open-up its source to allow bug bounties is rubbish. Google offers bounties for its web applications, and they are hardly open source. There are plenty of vulnerabilities that can be found using black-box techniques. Facebook isn't open source either and will shortly be offering bounties: http://news.softpedia.com/news/Facebook-Prepares-to-Launch-Bug-Bounty-Program-201405.shtml (I regret deleting my facebook account)
Experts like Schneier may point out that bounties don't offer great value for time for professionals, but as a student the money is quite an incentive for me.
Black hats dont give references...
Dilbert #1
Dilbert #2 -- Also explains IE 6
Learning HOW to think is more important than learning WHAT to think.
Sure, you could simply divert the rounded-off pennies of interest deposits to a swiss bank account. No one will ever notice, it's perfect.
Cash For Exploits has several problems:
1) a hacker that manages to engineer a zero-day has a whole line of customers willing to pay serious money for it. Malware authors that just got their cash cow's exploit patched last week are foaming at the mouth waiting for a new zero-day to put them back on track. They're making lots of money on their malware and are definitely willing to pay to keep it running a few more months. Companies aren't usually willing to pay a lot for an exploit. (there are exceptions but they are still uncommon) I'd love to see some hard numbers on what an average malware author nets a month.
2) said hacker can sell it more than once. Possibly many times. Why sell your exploit to the vendor once when you can sell it 100 times to other people? Is the vendor really going to be willing to pay you 100x what one desperate malware author can pay? Hard numbers on what a zero day ends up paying off would be really interesting to look at, and is what the vendors need to be considering when setting their bounties.
3) vendors downplay vulnerabilities as a way of life. They have every reason to tell you that the hole you discovered is of little value and try to cheat you on the payoff. On the other hand, selling it to the malware community is a reputation based system. Sell crap and it will hurt your reputation and hurt your business. They know a good exploit when they see it and will pay you what it's worth. The hacker can either make themselves the Bitch or the Man. Being the Man will naturally be more profitable.
4) if the vendors start snatching up the exploits, it's just going to drive up the price of them on the black market. And any good salesman sells to the highest bidder. At some point, the black market price is going to exceed whatever the vendors are willing to pay. Desperate customers with deep pockets will still get their hands on the exploits. (though this would arguably reduce the number of them in the wild due to higher cost)
5) lets not forget that if you create a legitimate reason to hack your product, it will increase the number of exploits found. Some consider this a good thing, but a lot of vendors consider this a bad thing. And they're usually impossible to convince otherwise.
I work for the Department of Redundancy Department.
I think software vendors not only need to buy up these bugs, but they need to deal with the fact that the person who found it is going to sell it to malware kit authors. The difference is that the vendors can start working on patching it and/or come up with work-arounds and notify customers.
Protection against crime is not an issue "the market should regulate". Basically paying for bugs -to protect yourself or your customers from illegal actions- is privatizing justice and a deeply undemocratic thing. To be protected from crime is what all the "security" measures by governments claim to be about and it is not a matter of weath how much or how good individual protection is.
Oh, the beautiful gloss of greality!
1. Program flaws into your own software. Hiding them is a lot easier with closed-source, by the way.
Not necessarily. That depends on the complexity of the vulnerability; who you're hiding from, and why/what people are looking for. The source code just makes certain obvious bugs easier to find.
There are more people who can read high-level source code than there are assembly hackers.
It's very easy to effectively hide flaws in plain sight, if you know what you are doing; closed source or not. Auditing source code is harder than utilizing techniques such as fuzzing.
There are some exploits discovered through source code analysis, but most vulnerabilities are discovered surreptitiously, by testing unusual conditions and finding that, the program crashes, or fails, on a certain input, for example.
The failure can then be explored, the binary can be dissassembled, to determine exploitability of the found bug.
For $1000 no. For $5000-$10,000 yes.
Only because we know companies like Google, Microsoft,Facebook and others have the money.
They pay pretty well if they trust you. They sure won't seize back what they just payed you. Email doubleplusgoodalbert at my gmail account if you'd like a job doing this. US citizens only, sorry.
"To create a bug bounty program with the breadth of Google's or Mozilla's, Microsoft would have to open its proprietary code to the rank and file."
The author starts off with the acknowledgment that vulnerabilities are _already_ being sold, then throws out this piece of nonsense. No, they really wouldn't have to open their codebase. MS bugs are already sold regularly. They're already sold on the black market, to governments, white hat organizations, and hoarded by exploit pack developers. And I think it's safe to say that few if any of those people had access to the source code.
On top of that, the way this was written it's untrue if this objection comes directly from Microsoft or if the author merely pulled it out of his ass. Boo.
Selling to a black hat is stupid, he/she will use it for criminal activities that will send you to jail as well as the Black Hat. Your future will be ruined unless an anti virus company hires you. They do have a history of hiring the bad guys.
Jack of all trades,master of none
So I wrote my 0day. It's just a denial of service at this point because the actual exploit is heap-based and I'm a total noob and cant write a heap based exploit. This is an application that if I were to nmap the internet I'm sure I would find LOTS of this; as the whole purpose of the application is about being web-faced. The actual software has been included in lots of products.
I contact the software developer and say, "Hey I have a denial of service vulnerability that could be written into a remote code execution but I'm rather new and dont really wish to do that. So it remains a DOS." They respond back to me "Since it's just a DOS we dont really care" though not in those exact words.
So what do I do? I could sell to some badguy who then builds the next largest botnet using it; which I then get kidnapped by organized crime and forced to code exploits. Or I could sit on it as if I never did anything. Well that's what I did mainly because it's a newb exploit and dont want to be embarrassed by how lame it is.
Guess what.. That's the majority of software developers. Which is why most vulnerabilities get dropped on exploitdb full disclosure and they make no money. The few vendors who will pay for bugs and work with researchers are genuinely good guys who want to secure their software.
What we need though is a Software Recall system. New 0day? code execution? All that software must be recalled and patched else you are liable for damages.
Let's step back a second. The reason that bug bounties exist is because these software makers want to avoid having to pay one or more salaries for security testing. Normal, law-abiding workers can't make a living by competing to find exploits. It requires tons of expertise and offers very little pay on a per-hour basis. If these companies are serious about security, they would start hiring more experts to do security testing full-time.
As long as companies are using bounties to avoid the real expense of security testing, they absolutely cannot be taken seriously when it comes to improving security. Outbidding black hats is just another punchline to the same joke.