Slashdot Mirror
Netragard Ends Exploit Acquisition Program After Hacking Team Breach
Trailrunner7 writes: After the fallout from the HackingTeam breach, Netragard, a company that buys and sells exploits, has decided to shut down its exploit acquisition program. Leaked documents show that Natragard was selling exploits to the Italian maker of intrusion and surveillance software. In addition, documents further showed that the company sold its products to a variety of oppressive regimes, including Egypt and Ethiopia. A company statement reads in part: "We’ve decided to terminate our Exploit Acquisition Program (again). Our motivation for termination revolves around ethics, politics, and our primary business focus. The HackingTeam breach proved that we could not sufficiently vet the ethics and intentions of new buyers. HackingTeam unbeknownst to us until after their breach was clearly selling their technology to questionable parties, including but not limited to parties known for human rights violations. While it is not a vendors responsibility to control what a buyer does with the acquired product, HackingTeam’s exposed customer list is unacceptable to us. The ethics of that are appalling and we want nothing to do with it."
Our motivation for termination revolves around ethics, politics, and our primary business focus.
My sides! My sides! Look out Major Tom!
Translation: CIA and NSA are pressuring us for exclusivity.
Seriously, who would believe a sleazy company that makes money off exploits is worried about "human rights violations".
They went in and full well knew or should have known what they got into. So no, I'm not buying this in the least. It just means they're spineless cowards.
If they had any ethics, they either wouldn't haven gotten into this obviously immoral or at least amoral game in the first place, or, going in knowing full well what they got into and why, they'd have the balls to see this through now. So I call them cowards. Spineless cowards. Contemtible wretches.
Pretty much no better than the rest of the s'kiddie scum in computer "haxx0r" security land, but that doesn't make them any less abject.
So, these fine and respectable folks are shocked, shocked that dodgy reselling of exploits might be going on. Really. How utterly plausible.
Unless you are selling to an end user who does their own development, what other possible outcome could you expect? They only want to purchase the exploit from you because they think that they can package it up and sell it on to enough of their own customers to come out in the black. That is a situation where all the incentives push toward transactions being largely secret and provide an incentive to try to be as 'flexible' as possible when screening potential purchasers. The only reasonable expectation is that the exploit you are quietly selling is going to end up in some potentially troubling places.
Just stop. You will never, ever, be a replacement for the Golden Girls cosmonaut.
Meanwhile, Intertrode (who just happens to have the same owners) have now covertly begun an open exploit acquisition program.
Anti 2nd-Amendment zealots would disagree.
And, although the above lists mere tort-claims, there are movements afoot towards criminal liabilities for gun-sellers as well. For the Greater Good.
In Soviet Washington the swamp drains you.
So would that include the US government and its allies? The Washington gang certainly falls under "parties known for human rights violations" (including torture)
"I opened my eyes, and everything went dark again"
Why in the name of hell would we want a replacement for the Golden Girls cosmonaut, if it comes to that?
I'm a bit torn with this news
On one hand it reduces innovative and creative ways to abuse bugs without letting the author know about it but on the other hand who will fund these poor megalomaniac power-crazy companies.
Maybe I'll start a kickstarter campaign:
Here's little 5 year old suzy. She's crying.
Reporter: Why are you crying suzy?
Suzy: Who's going to pay companies to be unethical now that it isn't popular?
Reporter: Good question suzy! And now the weather forecast with Jim.
(grin: this is going to get downvoted :)
"selling their technology to questionable parties" as if there were any other kind of customer paying for such.
Our motivation for termination revolves around ethics, politics, and our primary business focus. The HackingTeam breach proved that we could not sufficiently vet the ethics and intentions of new buyers. HackingTeam unbeknownst to us until after their breach was clearly selling their technology to questionable parties, including but not limited to parties known for human rights violations.
So you were selling these hoping that it would save the whales or make the bunnies happy? You're selling vulnerabilities that you acquire. Specifically weapons and like all weapons, it's a commodity based business and you took the money. The remorse is a bit late and a bit shallow because a weapons manufacturer doesn't feign surprise when somebody gets killed with their product.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
What did you expect your customers to do with the knowledge about unpatched, unknown 0day exploits? Make a funny little collection to show around to their friends?
"Hey, Fred, look what I got! It's a genuine 0day that MS doesn't know about yet. Ain't it cool? Huh? No, why would I use it?"
Seriously, what did you expect?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
They expected customers to use the exploits to gather evidence as permitted by warrants, ultimately to lock up bad guys.
Of course. Sure. Absolutely.
When you sell weapons, you accept that there is a pretty good chance that they will be used for something a normal person would consider "evil". Claiming it ain't so either means you're lying or that you should not do business. Like, ever. And hand your effects over to a custodian. Because you're very blatantly unfit to understand how the world works.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Have you ever seen HackingTeam & Netragard in the same room, at the same time? No? Because they're the same person!
Surely the reason they are stopping the program is because Darkode forum was raided and the administrators arrested, the forum for buying and selling exploits some of which may be used for illegal purposes!
So this company has realized that what its doing may be a MAJOR FUCKING CRIME, and perhaps they were even some of the buyers and sellers on Darkode.
I don't think it has much to do with Hacking Team, because the timing is just after the Darkode raid.
but there are human rights violations in every country on this planet, just like there are criminals in every city on the face of the earth
questionable regimes MY ASS
They expected the digital rebel good guys to use them against the guys do the gathering, warranting, lobbying, etc the real bad guys. And spammers and malware people of course but that's just collateral damage.
When you sell weapons to civilians you expect nothing of the sort. Civilians using weapons to do something normal people would consider evil is exceeding rare. In the US for instance there are millions of guns in civilian hands but civilians kill people with guns very very rarely. Gun death statistics for a year are well below automobile death statistics in a day and almost in almost all cases the shooter is an agent of government (usually police domestically).