Slashdot Mirror
Exploit Sales: the New Disclosure Debate
msm1267 writes "There are a lot of echoes of the disclosure debate in the current discussions about vulnerability exploit sales. The commercial exploit market has developed relatively quickly, at least the public portion of it. Researchers have been selling vulnerabilities to a variety of buyers – government agencies, contractors, other researchers and third-party brokers – for years. But it was done mostly under cover of darkness. Now, although the transactions themselves are still private, the fact that they're happening, and who's buying (and in some cases, selling) is out in the open. As with the disclosure debate, there are intelligent people lining up on both sides of the aisle and the discussion is generating an unprecedented level of malice."
WTF is this article even about?
Three days from now?? Thats tomorrow!! ~Peter Griffin
The only interesting exploit is one that hasn't been patched, right? So anyone who discovers, sells, or buys an exploit knows of a vulnerability and is choosing not to disclose it.
By not disclosing a vulnerability, you are allowing others to be vulnerable. It's hard to argue that this is ethical behavior...
Here's an analogy: what if, for every nuke the U.S. destroyed, a nuke disappeared from every other nuclear arsenal in the world? That's what it's like.. by keeping a vulnerability secret, it can be used against anyone using the software. By disclosing the vuln, everyone can patch, disable, or protect the vulnerable software.
About as good as any other weapons market willing to sell to whoever is the highest bidder...
"When information is power, privacy is freedom" - Jah-Wren Ryel
it's clear that reporting a vulnerability to someone in a position to actually fix it (such as the developer of the software) often doesn't work so well. We've seen severe negative effects as they strive to cover up rather than address the vulnerability, attacking the messenger instead. What better way to escalate a bug and get it fixed, than to sell it to the highest bidder and see it get exploited in the field by bad actors?
Oh, there's better ways, they just haven't been implemented yet.
Like a national center for vulnerabilities disclosure, or computer break in laws that actually make sense in the context of their subject.
Sowing chaos does not lead to more order, only more disorder.
Two wrongs don't make a "right." Just because a vendor fails to adequately address a vulnerability does not make it ethical to exploit that vulnerability.
If the bug is reported to the developer and they do nothing, I don't feel bad for the developer and I can understand why the person who discovered it wants to get paid.
If I lived in a world that didn't require money, it would be different.
But either way, I do feel bad for the end users.
National Disclosure Centers are only as good as the organizations that take their disclosures.
I worked pretty closely with the DOC CIRT when it was first formed. It did not matter how many CIOs were involved in the process of forming it, or what they agreed to do, or what channels of communications were established. There were always groups that would not / could not work to address issues when they happened.
I don't think passing more laws has much affect on the issue either. Laws are regulatory and fall very much into the camp of attorneys, who rarely understand their implications in terms of infrastructure. Have spent many days on the phone with people for OIG seeking clarification on regulatory guidelines for handling systems, without getting the impression they understood much more than how to work the on / off switch.
This is a supply and demand problem, but a very special one. There is not enough demand for patches and security solutions prior to an incident, and there is not enough supply of secure code available to combat the threat. If anything, a solution lies with manufacturers, but there has to be a serious market for secure solutions for it to happen (and a willingness of buyers to invest in products that go down this route).
In other words, organizations needs to stop buying windows and start buying hardened Linux platforms. I honestly don't believe there is another way.
Just out of curiosity how would replacing windows with linux prevent a spear phishing attack?
In the context of laws, I'm actually thinking of laws that would protect security researchers who are publishing these vulnerabilities.
I would also love to hear what you think "secure code" is, what if the vulnerability is in a lower OSI layer as plenty often are?
two lefts though can reverse a right
There is nothing different between this and the practice of huge companies selling death machines to the militaries of the world, and the occasional non state para military planing a takeover or something - tanks, bomber jets, missiles and so on - how is this any different? the security researchers work to create a product - i.e. a vulnerability, then sell that information, the product of their effort - to a willing customer.
Its a nasty business, you can question the morals and ethics of it, but it really is no different than companies that sell guns and bombs to whatever crackpot thug has a truck full of cash or gold bars...
So far, your incompetency has been our collective weakness, now your incompetency can mean profit for someone other than yourself! Sucks to be you.