-- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBMTO: N48 04'14.8'' E11 36'41.2'' http://eugen.leitl.org 83E5CA02: EDE4 7193 0833 A96B 07A7 1A88 AA58 0E89 83E5 CA02 ---------- Forwarded message ---------- Date: Thu, 22 Aug 2002 00:24:54 -0400 (EDT) From: Kragen Sitaker <kragen@pobox.com> To: fork@xent.com Subject: the underground software vulnerability marketplace and its hazards On August 7th, an entity known as "iDEFENSE" sent out an announcement, which is appended to this email. Briefly, "iDEFENSE", which bills itself as "a global security intelligence company", is offering cash for information about security vulnerabilities in computer software that are not publicly known, especially if you promise not to tell anyone else. If this kind of secret traffic is allowed to continue, it will pose a very serious threat to our computer communications infrastructure. At the moment, the dominant paradigm for computer security research known as "full disclosure"; people who discover security vulnerabilities in software tell the vendor about them, and a short while later --- after the vendor has had a chance to fix the problem --- they publish the information, including code to exploit the vulnerability, if possible. This method has proven far superior to the old paradigm established by CERT in the late 1980s, which its proponents might call "responsible disclosure" --- never release working exploit code, and never release any information on the vulnerability before all vendors have released a patch. This procedure often left hundreds of thousands of computers vulnerable to known bugs for months or years while the vendors worked on features, and often, even after the patches were released, people wouldn't apply them because they didn't know how serious the problem was. The underground computer criminal community would often discover and exploit these same holes for months or years while the "responsible disclosure" process kept their victims, who had no connections in the underground, vulnerable. The problem with this is that vulnerabilities that are widely known are much less dangerous, because their victims can take steps to reduce their potential impact --- including disabling software, turning off vulnerable features, filtering traffic in transit, and detecting and responding to intrusions. They are therefore much less useful to would-be intruders. Also, software companies usually see security vulnerabilities in their software as PR problems, and so prefer to delay publication (and the expense of fixing the bugs) as long as possible. iDEFENSE is offering a new alternative that appears far more dangerous than either of the two previous paradigms. They want to be a buyer in a marketplace for secret software vulnerability information, rewarding discoverers of vulnerabilities with cash. Not long before, Snosoft, a group of security researchers evidently including some criminal elements, apparently made an offer to sell the secrecy of some software vulnerability information to the software vendor; specifically, they apparently made a private offer to Hewlett-Packard to keep a vulnerability in HP's Tru64 Unix secret if HP retained Snosoft's "consulting services". HP considered this extortion and responded with legal threats, and Snosoft published the information. If this is allowed to happen, it will cause two problems which, together, add up to a catastrophe. First, secret software vulnerability information will be available to the highest bidder, and to nobody else. For reasons explained later, I think the highest bidders will generally be organized crime syndicates, although that will not be obvious to the sellers. Second, finding software vulnerabilities and keeping them secret will become lucrative for many more talented people. The result will be --- just as in the "responsible disclosure" days --- that the good guys will remain vulnerable for months and years, while the majority of current vulnerabilities are kept secret. I've heard it argued that the highest bidders will generally be the vendors of the vulnerable software, but I don't think that's plausible. If someone can steal $20 000 because a software bug lets them, the software vendor is never held liable; often, in fact, the people who administer the software aren't liable, either --- when credit card data are stolen from an e-commerce site, for example. Knowing about a vulnerability before anyone else might save a web-site administrator some time, and it might save the software vendor some negative PR, but it can net the thief thousands of dollars. I think the highest bidders will be those for whom early vulnerability information is most lucrative --- the thieves who can use it to execute the largest heists without getting caught. Inevitably, that means organized crime syndicates, although the particular gangs who are good at networked theft may not yet exist. There might be the occasional case where a market leader, such as Microsoft, could make more money by giving their competitors bad PR than a gang could make by theft. Think of a remote-root hole in Samba, for example. Right now, people who know how to find security exploits are either motivated by personal interest in the subject, motivated by the public interest, motivated by a desire for individual recognition, or personally know criminals that benefit from their exploits. Creating a marketplace in secret vulnerability information would vastly increase the availability of that information to the people who can afford to pay the most for it: spies, terrorists, and organized crime. Let's not let that happen. This is the original iDEFENSE announcement: From: Sunil James [mailto:SJames@iDefense.com] Sent: Wednesday, August 07, 2002 12:32 PM Subject: Introducing iDEFENSE's Vulnerability Contributor Program Greetings, iDEFENSE is pleased to announce the official launch of its Vulnerability Contributor Program (VCP). The VCP pays contributors for the advance notification of vulnerabilities, exploit code and malicious code. iDEFENSE hopes you might consider contributing to the VCP. The following provides answers to some basic questions about the program: Q. How will it work? A. iDEFENSE understands the majority of security researchers do not publish security research for compensation; rather, it could be for any of a number of motivations, including the following: * Pure love of security research * The desire to protect against harm to targeted networks * The desire to urge vendors to fix their products * The publicity that often accompanies disclosure The VCP is for those who want to have their research made public to the Internet community, but who would also like to be paid for doing the work.The compensation will depend, among other things, on the following items: * The kind of information being shared (i.e. vulnerability or exploit) * The amount of detail and analysis provided * The potential severity level for the information shared * The types of applications, operating systems, and other software and hardware potentially affected * Verification by iDEFENSE Labs * The level of exclusivity, if any, for data granted to iDEFENSE Q. Who should contribute to the VCP? A. The VCP is open to any individual, security research group or other entity. Q. Why are you launching this program? A. Timeliness remains a key aspect in security intelligence. Contributions to some lists take time before publication to the public at large. More often, many of these services charge clients for access without paying the original contributor. Under the iDEFENSE program, the contributor is compensated, iDEFENSE Labs verifies the issue, and iDEFENSE clients and the public at large are warned in a timely manner. Q. Who gets the credit? A. The contributor is always credited for discovering the vulnerability or exploit information. Q. When can I contribute? The VCP is active. You are welcome to begin contributing today. To learn more, go to http://www.idefense.com/contributor.html. If you have questions or would like to sign up as a contributor to the VCP, please contact us at contributor@idefense.com. Regards, Sunil James Technical Analyst iDEFENSE "iDEFENSE is a global security intelligence company that proactively monitors sources throughout the world -- from technical vulnerabilities and hacker profiling to the global spread of viruses and other malicious code. The iALERT security intelligence service provides decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. iDEFENSE Labs is the research wing that verifies vulnerabilities, examines the behavior of exploits and other malicious code and discovers new software/hardware weaknesses in a controlled lab environment." http://xent.com/mailman/listinfo/fork