Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Bill Gates Should Buy Your Buffer Overruns

CmdrTaco posted about 7 years ago | from the we're-having-a-sale-today-on-core-dumps dept.

Security 196

Slashdot regular Bennett Haselton has written in with his latest essay. He starts "WabiSabiLabi generated some controversy recently by announcing their eBay-like site for security researchers to sell security exploits to the highest bidder. But WabiSabiLabi didn't create the black-and-grey market for security exploits, they merely helped draw attention to it. There's nothing that companies like Microsoft can do about the black market where security exploits sell for tens of thousands of dollars, but there's one obvious thing they can do to help protect users: offer to buy up the security vulnerabilities themselves. If they did that, then the exploits would probably never make it onto a black-market auction in the first place, because the "white hat" researchers would have found them and reported them first. Thus I think WabiSabiLabi is doing the world a favor, by shining a spotlight on the black market that thrives when companies won't pay for security bug reports." Click that magical little read more link below to continue the thought.

Really, what is a good argument against companies paying for security exploits? It's virtually certain that if a company like Microsoft offered $1,000 for a new IE exploit, someone would find at least one and report it to them. So the question facing Microsoft when they choose whether to make that offer, is: Would they rather have the $1,000, or the exploit? What responsible company could possibly choose "the $1,000"? Especially considering that if they don't offer the prize, and as a result that particular exploit doesn't get found by a white-hat researcher, someone else will probably find it and sell it on the black market instead? (Throughout this discussion, I'm using Microsoft as a metaphor for all companies which have products in widespread use, and which do not currently pay for security exploits even though they could obviously afford to.)

Perhaps you say that you would be willing to report bugs to Microsoft for free, and I respect people who do that out of selflessness, but that's not the point. Even if you and some other people would do "white-hat testing" for free, there are more people who would do it if there were prizes. The amount of people willing to do security testing for free, has not been enough to keep exploits from being found and sold on the black market -- but if Microsoft offered enough money, it would be. Obviously if Microsoft offered more than the black-market prices, everyone would just sell their exploits to them. But probably Microsoft could offer much less than the black-market prices and still put the black market out of business, because there are lots of researchers who wouldn't sell exploits on the black market even for tens of thousands of dollars, but would be willing to participate in a legal Microsoft "white hat" program for much less money.

Microsoft would undoubtedly say that they do their own in-house testing, and indeed the offer of a prize should not be used as a substitute for good security testing within a company. But at the same time, the fact that a company does their own testing isn't a good reason for not offering a prize. If a company says that they already do their own in-house security audits to catch as many bugs as they can, that still doesn't answer the question: given that a cash offer would probably result in an outsider finding a new exploit that they missed, why wouldn't they want to take it? Even if there are already outsiders who willingly find new exploits and turn them over to Microsoft for free, there's almost certainly at least one more exploit out there that would be found if they offered a cash prize. (And if the cash prize doesn't turn up any new exploits, then the company doesn't pay out and has lost nothing.)

I've done security consulting for companies like Google and Macromedia who paid me "by the bug", so you might think I'm biased in favor of more such "bounty" programs because I think I could make money off of them. Actually, I think that if Microsoft and most other large software companies offered security hole bounties to everyone in the world, almost all exploits would be picked clean by other people, and my chances of getting anything out of it would go way down, and there would be one less buffer protecting me from having to get a real job. But most people's computers would be safer.

Microsoft does in fact "pay" for security exploits in their own way, by crediting people in their security bulletins. To some people, who report exploits in hopes of being recognized, this is apparently enough. And there are third-party companies like iDefense who will buy your security exploits and then use them to gain reputation-credits for themselves, by handing them over for free to the software developer and warning their own clients about the potential risks. But there are a lot of people including me who have found exploits in the past, but don't consider the benefits of being mentioned in a Microsoft security bulletin to be worth the effort of finding a new one. And even the benefits that iDefense gets from reporting security holes, are evidently not sufficient for them to offer enough money for exploits to compete with the black-market prices (if iDefense got that much benefit out of it, then they'd be able to offer so much money that nobody would sell exploits on the black market). So using recognition as payment is evidently not enough; as Lord Beckett says, "Loyalty is no longer the currency of the realm; I'm afraid currency is the currency of the realm."

A cash prize program might mean that some people get mad when they are turned away for offering "exploits" that don't really qualify, but so what? What are they going to do for revenge, release their "exploit" into the wild? If it's not a real exploit, then it won't do any harm, and if it is a real exploit, then Microsoft should have paid them after all! Some people might threaten to sue if they aren't awarded prizes, even if the rules of the program state clearly that Microsoft is the final arbiter of what counts as an exploit. Maybe in some rare cases they would even win. But all of this could be considered a cost of running the program, just like the cost of giving out the prizes themselves -- and all insignificant compared to the cost of an exploit that gets released into the wild and allows a malicious site to do "drive-by installs" of spyware onto people's machines.

Probably the real reason Microsoft doesn't pay for security exploits is that they don't pay the full price for those drive-by installs and other problems when a new exploit is discovered. I've heard hard-core open-source advocates say that either (a) Microsoft should be held liable for the cost of exploits committed using flaws in their software, or that (b) users of Microsoft software should be held liable for exploits committed through their machines (which would drive up the cost of using Windows and IE to the point where nobody would use it). If that happened, Microsoft probably would pay for security exploits to forestall disaster. But let's make the reasonable assumption that neither of those liability rules is going to come to pass. The real price that Microsoft currently pays for security exploits is in terms of reputation, and the price they're paying right now is too low, because people don't realize that Microsoft could find and fix a lot more bugs by spending only a tiny amount of money -- but chooses not to. Despite all the snickering when "Microsoft" and "security" are used in the same sentence, most people seem to believe that Microsoft is doing everything they can to prevent users from being exploited. But as long as Microsoft doesn't pay for security holes, they're emphatically not doing "everything they can".

It's not that I think security bosses at Microsoft are trying to screw anyone over. They probably just have an aversion to the idea of paying for security holes, and what I'm arguing is that such an aversion is irrational. The people they would be paying money to are not criminals or bad people, they're legitimate researchers who just can't afford to do work for Microsoft for free when they could be doing something else for money. Offering cash will bring in new exploits, and every exploit that is reported and fixed is one that can't be sold on the black market later.

There are some interesting details that would have to be worked out about how such a program would be implemented. For example, what happens if Bob reports an exploit, and then Alice later reports the same exploit, before Microsoft has gotten a chance to push the patch out? Microsoft wouldn't want to pay $1,000 to both of them, because then whenever Bob found an exploit, he could collude with Alice so that they both "independently" reported the same bug and got paid twice. Microsoft could pay only Bob, but Alice could get so disillusioned at getting paid nothing that she might stop helping entirely. My own suggestion would be to split the money between all researchers who report the same bug in the time window before the fix is pushed out. If 10 researchers happened to report the same bug and each only got a paltry $100, some of them would quit in disgust, but if researchers start to leave because the average payout-per-person has fallen too low, then that will drive the average payout back up, so the number of active researchers stays in equilibrium.

Another issue: What happens if a researcher reports an exploit confidentially, and then the next day, the exploit appears in the wild? If Microsoft's policy was that they would pay for the exploit anyway, then a researcher would have no incentive not to sell the exploit twice, once to Microsoft and again on the black market (whereupon it might start being used in the wild). On the other hand, if Microsoft refused to pay for exploits that were released in the wild before they issued a patch, then that might leave many researchers feeling cheated if they turned in a genuine exploit and got nothing just because someone else sold it on the black market before the patch came out. My suggestion would be to simply pay for exploits even if they did subsequently get released on the black market -- on the theory that of the white hat researchers who turn in bugs to Microsoft, most of them would be ethically opposed to selling exploits to black marketeers, so they shouldn't be punished if the exploit ends up on the black market since they probably weren't the ones who put it there. Another would be to make the payout so large that even if researchers got no payment when the exploit got leaked into the wild before a patch was issued, the payout from the times that they did get paid, would more than make up for it.

But whatever rules are decided upon, there should be some sort of monetary rewards for people who confidentially report security flaws to big software companies. Whatever you can say about the merits of rewarding people through "recognition", or through social pressures to practice "responsible disclosure", the one obvious fact is that it hasn't been enough -- exploits still get sold on the black market, and every exploit that gets sold on the black market, would have been reported to Microsoft if they'd offered enough money. The talent is out there that could find these bugs and get them fixed. Most of them just can't afford to donate the work for free -- but the amount of money Microsoft would have to pay them, is far less than the benefits that would accrue to people all over the world in terms of fewer drive-by spyware installs, fewer viruses, and fewer security breaches. And if these benefits were reflected back at Microsoft in terms of greater user confidence and fewer snide jokes about "Microsoft security", then everybody would win all around. There are no barriers to making this happen, except for a mindset that it's "bad" to pay for security research. But if you prevent millions of Internet Explorer users from being infected with spyware, you deserve to at least get paid what Bill Gates earns in the time it took you to read this sentence.

cancel ×

196 comments

oh hey bill (-1, Offtopic)

BlackMacUser (1009741) | about 7 years ago | (#19902267)

hey baby hey baby hey

Both ends against the middle (5, Funny)

Gothmolly (148874) | about 7 years ago | (#19902327)

Why couldn't I sell my exploit to the black market, THEN sell it to Microsoft a day or two later?

-1, Duh

Re:Both ends against the middle (5, Insightful)

illegalcortex (1007791) | about 7 years ago | (#19902391)

You could, and that would probably still be a GOOD thing. Because if MS fixed it quickly, it means those who purchased the exploit would get a lot less for their money. Therefore, they'd be less willing to buy exploits in the future, or at least pay less.

Such a market wouldn't be about *exclusive* knowledge of exploits.

Re:Both ends against the middle (5, Funny)

dvice_null (981029) | about 7 years ago | (#19903097)

I got the perfect solution for Microsoft. They should call their next version of Windows a "Sheep". What kind of a criminal would risk getting cought and ending up in news articles that have titles like "Mr X got cought exploiting a hole in Sheep". How would you explain that to your parents?

Re:Both ends against the middle (2, Insightful)

TubeSteak (669689) | about 7 years ago | (#19903185)

Because if MS fixed it quickly, it means those who purchased the exploit would get a lot less for their money.
That is a huge assumption to make.

MS regularly sits on vulnerabilities for months instead of patching them.

By creating such a marketplace, MS effectively gives away information on which non-public vulnerabilities they are aware of, but have yet to patch. That can't be a good thing.

Re:Both ends against the middle (1)

Joebert (946227) | about 7 years ago | (#19902467)

Because whoever you sold it to on the black market would more than likely make your life a living hell, if not just kill you if they ever found out you did that.

Re:Both ends against the middle (1)

shmlco (594907) | about 7 years ago | (#19903171)

So why not sell it to Microsoft first, THEN sell it to someone else. Odds are that they can make use of it before Microsoft gets around to fixing it and releasing it on "patch Tuesday".

Although, when you stop to think about it, what's really stopping someone from selling it as many times as they want? If they're the kind of person who'd create it and sell it in the first place, I'm supposed to believe their "promise" that they won't sell it to anyone else?

"No, no. This is the only copy of the disk. Really."

Re:Both ends against the middle (1)

Kadin2048 (468275) | about 7 years ago | (#19903271)

Although, when you stop to think about it, what's really stopping someone from selling it as many times as they want? If they're the kind of person who'd create it and sell it in the first place, I'm supposed to believe their "promise" that they won't sell it to anyone else?

Um, threat of a very, very painful death? You'd be dealing with some very unpleasant people here; I think they might interpret such behavior as treachery.

Wow... Brilliant! (1)

Dan_Bercell (826965) | about 7 years ago | (#19902619)

Another post by someone who only read the title!

Re:Wow... Brilliant! (2, Funny)

Gothmolly (148874) | about 7 years ago | (#19902897)

You must be new here.

Hrmm...Bounty Hunters... (2, Funny)

Citius (991975) | about 7 years ago | (#19902769)

So, will we get massive Clone armies for hunting down rebel security holes? Boba Fett to the rescue!

Re:Both ends against the middle (3, Insightful)

altoz (653655) | about 7 years ago | (#19902779)

That'll work once but won't work the next time. Any market has its reputation system and if you're known to sell to both (an obvious thing since Microsoft will have patched it shortly), I'm sure people will bid less and less for your exploit.

Plus, do you really want to screw over black market customers? They're not your typical customers. I'm sure they'll do a lot worse than not shopping from you again if you screw them over (think identity theft or worse).

Re:Both ends against the middle (1)

MysteriousPreacher (702266) | about 7 years ago | (#19902789)

Depends who you sell it to. Double-cross the wrong people and I reckon you'd be getting a beating from some nasty gentlemen. The criminals who bought the exploit might also be a bit violent.

Re:Both ends against the middle (1)

HappySmileMan (1088123) | about 7 years ago | (#19902879)

You coudl easily do it, but it'd get patched by MS quicker than if you only sold it to black-hats

What thought? (-1, Offtopic)

Anonymous Coward | about 7 years ago | (#19902335)

What thought?

Will they really only sell it once? (3, Interesting)

beuges (613130) | about 7 years ago | (#19902337)

What's to stop someone getting paid big bucks by microsoft for vulnerabilities, and then reselling the same exploits to the next highest bidder as well? I'd imagine that the people in the business of selling exploits to the highest bidder aren't the most ethical types to begin with.

Re:Will they really only sell it once? (1)

h4rr4r (612664) | about 7 years ago | (#19902461)

This is why the best system is to make it open.
Then everyone knows about it and at least the users have a chance to work around the issue.

Who cares how many times they sell it? (5, Insightful)

vortex2.71 (802986) | about 7 years ago | (#19902477)

Who cares how many times they sell it? The point is that Microsoft can buy it and then fix it, thus elliminating the market value of the exploit. If someone can sell it to other people then good for them. Its still in Microsoft's best interest to buy it as early as possible and fix it as early as possible.

Re:Who cares how many times they sell it? (1)

jkrise (535370) | about 7 years ago | (#19902821)

But what if the original seller leaks it to someone else before a fix, and this new bloke tries to sell the same hack independently to Microsoft? Unless MS is telling others of what vulnerabilities and hacks they have already bought - which is unlikely if not impossible - this scheme will not work.

In fact it could make things much worse - people will now have direct financial incentive to cause havoc by exploiting unfixed vulnerabilities.

Re:Who cares how many times they sell it? (1)

Monchanger (637670) | about 7 years ago | (#19903163)

> The point is that Microsoft can buy it and then fix it, thus elliminating the market value of the exploit.
Even after Microsoft "fixes" a security hole, the security problem isn't gone. It's only removed from patched computers. I don't recall what kind of numbers are involved, but there's still plenty of value in an "old" exploit, especially for thugs targeting home users' computers.

> Its still in Microsoft's best interest to buy it as early as possible and fix it as early as possible.
If it is so clearly in their interest, as your proof-less assertion claims, why don't they? Why haven't they spent some of the widely press-released security efforts for Vista in creating an exploit bounty program? Why don't they blow Linux away every time we see a new stupid apples-to-oranges comparison of which is the more secure? Or are you suggesting that the endless resources of Microsoft, enjoyed by corrupt researchers and politicians, can't find their way into the black market?

Re:Who cares how many times they sell it? (1)

modecx (130548) | about 7 years ago | (#19903237)

This all assumes that Microsoft gives a flying fuck. They clearly do not--or they do not have the resources to fix their holes in a timely manner. How many vulnerabilities have they actively known about that went unpatched for months on end? I can think of a few, and those are the ones that made it public.

Furthermore, if MS were to do this, it would validate the exploit market more than it would help create bug free Windows. That's like, if President Lincoln said "we've got all the money in the world so we're going to free the slaves by buying them all up from the slavers, and then we're gonna bring 'em up north and let 'em go", the problem is that such an action creates demand. The prices would go up, and the slavers would start enslaving more people from Africa to fill the hole in the market. In the end, all you do is create a feedback loop of stupidity.

Re:Will they really only sell it once? (1)

Plutonite (999141) | about 7 years ago | (#19902613)

Because if you do that once or twice you will get tracked down via the money lead. If I were MS or any other customer I would require some identification, preferably through the financial institution that I'll be sending the money to.

Re:Will they really only sell it once? (1)

kebes (861706) | about 7 years ago | (#19902677)

But who is the "next highest bidder"? If you sell your vulnerability to MS and also the black-market, for instance, then you're screwing both of them... and they will notice. MS will notice the vulnerability in the wild, and if it happens repeatedly, they will probably stop trusting you.

If the black-market guys notice that MS came up with a patch surprisingly quickly after you sold them the exploit, they are going to be very angry, because you've very much decreased the value of the exploit. And I would imagine that cheating black-market guys is not a smart thing to do... if they lack ethics in the "break into computers" department they may behave similarly in the "break your legs" department.

So, at the end of the day, how are you going to sell an exploit twice? Few would try, and fewer still would get away with it.

Basically, legitimacy (2, Insightful)

Flying pig (925874) | about 7 years ago | (#19902753)

It makes far more sense to be a legal, well rewarded security researcher with a useful CV than a criminal. Nothing gives a person ethics like being well paid for it.

Re:Will they really only sell it once? (1)

Jeff DeMaagd (2015) | about 7 years ago | (#19902775)

I wouldn't worry about it. The original post has some misguided view of reality, with a misguided enough perspective to not realize what is wrong with it when put to practical use.

Anti-terrorism...? (3, Interesting)

Bat_Masterson (250306) | about 7 years ago | (#19902915)

I wonder if this strategy could be used as a means to averting terrorism?

That is, don't just offer large amounts of money for the most important terrorists (like bin Laden), but also offer varying amounts of money for reports that stop terrorism.

could make sense... (0)

Anonymous Coward | about 7 years ago | (#19902343)

I wonder what the real cost of finding an exploit is for a company like Microsoft... If its more than a 1,000 dollars then they should fully embrace this model

Bad Idea (1)

hauntingthunder (985246) | about 7 years ago | (#19902353)

"what I'm arguing is that such an aversion is irrational"

You will get scum atempting to extort money from companies.

Offer mony for doing bad things and people will do bad things

Bad Idea? (1)

vortex2.71 (802986) | about 7 years ago | (#19902535)

Finding a security hole isn't necesarily a "bad thing". Its just information, which can be used by the company to fix the vulnerability or by unsavory people to exploit the software.

Finding an exploit is not a "bad thing" (2, Insightful)

benhocking (724439) | about 7 years ago | (#19902649)

Using an exploit maliciously is, but finding the exploit is not a bad thing. In fact, it's a good thing. Hence, it should be rewarded.

Re:Finding an exploit is not a "bad thing" (1)

hauntingthunder (985246) | about 7 years ago | (#19902771)

well finding the exploit is not always a bad thing

Trouble is if thers a cash incentive bad people will get involved its just human nature why else are there spammers and other such skum.

There already is a cash incentive (1)

benhocking (724439) | about 7 years ago | (#19903179)

There already is a cash incentive and bad people are already involved. The idea is to provide a cash incentive for (more) good people to get involved in a positive way.

Re:Finding an exploit is not a "bad thing" (1)

Culture20 (968837) | about 7 years ago | (#19903253)

There's already a _greater_ cash incentive for the scum, and they're already finding exploits. What is needed is a lesser, legal cash incentive for the good guys, so that the good guys find them first.

Sig (0, Offtopic)

Darlantan (130471) | about 7 years ago | (#19903047)

While I like your sig (though I don't recognize it as a reference), what the hell is a Zu-30? The closest I can come up with would be the Tunguska AA system being incorrectly referred to as the ZSU-30-6.

You might consider revising it to ZSU-23 (actually, ZSU-23-4 would be more accurate -- that's the old Shilka, but they're still used IIRC) or 2S6 (Tunguska).

Failing that, could you at least tell me where the line is from?

Economics (5, Insightful)

gad_zuki! (70830) | about 7 years ago | (#19902361)

If MS offers 10,000 dollars per exploit then thats going to be the minimum bid in the market. Someone will then offer 10,500 and the enterprising hacker will go for the extra cash. I dont see how MS's involvment can help this.

What might be more interesting is to dock 10,000k from the salaries of the security team everytime someone finds a serious exploit. Sometimes punishments are far more effective than rewards.

Re:Economics (4, Insightful)

cowscows (103644) | about 7 years ago | (#19902615)

Yeah, except that you'd very quickly find yourself without a security team.

Re:Economics (2, Funny)

Fx.Dr (915071) | about 7 years ago | (#19902849)

So what you're saying is - Microsoft has nothing to lose?

Re:Economics (2, Insightful)

MartinG (52587) | about 7 years ago | (#19902661)

What might be more interesting is to dock 10,000k from the salaries of the security team everytime someone finds a serious exploit

Who the hell is going to work there with such an utterly idiotic policy?

Surely one aspect of this is that they should be looking to attract good people to the team. Threats of "fines" is hardly the way to do it.

That was already addressed (3, Insightful)

benhocking (724439) | about 7 years ago | (#19902699)

There are a lot of intelligent people who would be willing to do it legally for far cheaper prices than the black market will pay to do it illegally. Not everyone is immoral. Personally, I'd like to believe that most people are basically good people.

Re:Economics (2, Insightful)

fermion (181285) | about 7 years ago | (#19902951)

In summary, the exploit will generally be more valuable to the attacker than the defender, for many different reasons. Mainly, a baddie might buy a ten exploit for $150K, use one or 2, perhaps make 200K, and while the profit margin may not be great, a profit might at least be generated. On the other hand, MS might get those same exploits for $100K, but where is the upside? Did the exploits cost them anything? No, they externalize all those expenses to the government and the customer. Sure they can afford to lose that $100K, they probably lose that much every week on xBox, but unlike xBox buying exploits does not buy them marketshare, at least not yet.

Then we have more insidious versions of this story. Sell two low level exploits to MS, get 20K. Use the 20K to capatilize a third major exploit. Such a plan, in recursion, will finance quite a nice bot shop with no money down.

Ultimately, this is not something that will be solved by hiring people to chase the horses after the barn door has been left open. It is similiar to missle defense. In principle it is not all that hard(although in principle it is really hard), but even after solving the really hard physics issues, one realizes that, for instance, once the launch vehicle has released the payload, say 100 projectiles, only one of which is live, it becomes a numbers game of the defender having to pay for 100 live interceptors, while the attacker only has to pay for on one live munition.

So, we get back to the recommendation of writing good code. And good code is not code without errors. Good code is code in which errors can be fixed quickly, and the extent of the codebase effected by said changes are limited. What we see with MS is not that the code has bugs. All code has bugs. It is that bugs appear to be, at least in some cases, difficult to fix, and sometimes those fixes break things that should not necessarily be related.

Re:Economics (1)

Smidge204 (605297) | about 7 years ago | (#19903145)

What might be more interesting is to dock 10,000k from the salaries of the security team everytime someone finds a serious exploit. Sometimes punishments are far more effective than rewards.

Let's fire one police officer for every crime that isn't prevented. Brilliant!

Here's a thought. Read the entire summary - the theory is to have an incentive for white/gray hats to get more involved, and so decrease the value of exploits by finding and patching them sooner. There is nothing you can do about the people who would look to sell them on the black market anyway, but you can entice other, more ethical people to get involved and tip the scales.
=Smidge=

Re:Economics (1)

krazo (220290) | about 7 years ago | (#19903343)

I think a lot of the issues could be resolved by not having the vendor pay the exploit finder directly and instead allowing people to speculate on the probability of a particular exploit being found.

This has a lot of parallels to the Policy Analysis Market [wikipedia.org] where the defense department tried to set up a futures market for predicting political developments in the middle east. There are some moral issues around the fact that you might be rewarding the wrong people with the system. My personal take is that information has some value when it's unknown and it may be the case that the "bad" people are the only ones with that information. It's worth rewarding them to get them to give that info up.

A predictive futures market in exploits might work well. If a contract appeared stating that a vulnerability in Java's image processing code would be found in six months and the price went through the roof, then Sun would know where to start investigating. When they found the exploit, the people who predicted it early would get paid off. It basically rewards people with insider information.

A person who discovered an exploit would then be able to buy contracts for that exploit low, push the price higher, potentially by publicizing his/her having found it and then publicize the exploit when he/she felt the price was at its peak.

Trying to shop a vulnerability around the black market would inherently cause the price to rise as well, keying off the vendor to a possible exploit.

Also, (if my theoretical economics are correct) the stable price of an exploit contract would indicate its overall probability (x product is secure or not.)

Re:Economics (1)

vertinox (846076) | about 7 years ago | (#19903461)

What might be more interesting is to dock 10,000k from the salaries of the security team everytime someone finds a serious exploit. Sometimes punishments are far more effective than rewards.

Wrong. Studies have shown that negative reinforcement often has the reverse effect due to the fact it breeds contempt. After you punish the security so much that they have little left to work for, they'll probably start including exploits for spite.

Its human nature.

outsourced testing (3, Insightful)

ecklesweb (713901) | about 7 years ago | (#19902381)

Almost sounds like an argument to outsource testing to the general public and pay them for it. Not sure why MS would do this when they've been outsourcing testing to the general public for years and charging licensing fees for it!

Cynicism aside, do you think that it really makes business sense for MS to pay for vulnerabilities? Has their revenue really been hurt that badly from their current security practices?

I'd say their revenue has been hurt enough (1)

benhocking (724439) | about 7 years ago | (#19902745)

The key question is, IMO, has their revenue been hurt more than it would cost to pay for vulnerabilities? I'd say it has. Sure, you could argue that the revenue loss is not a large percentage of their total revenue, but presumably paying for the vulnerabilities would cost even less.

Re:outsourced testing (2, Insightful)

mr_mischief (456295) | about 7 years ago | (#19902783)

I'm not sure it's cynicism when it's so obviously true. In Microsoft's defense, it's very difficult to properly test everything for stability and performance against all the third-party hardware and software out there.

It's not that difficult, though, to check for buffer overruns, array bounds violations, and stack overflows these days. It's also not that difficult to use proper security protocols as opposed to crap like PPTP, for that matter.

I think Microsoft's public image has been hurt pretty badly by the likes of Nimda, Blaster, Melissa, and similar widespread attacks. Macs, Solaris, and Linux machines have strong arguments for them, but part of what market share they get would default to Microsoft if people hadn't had such poor experiences with Windows and Office. Heck, I'm a Linux guy, but I'm writing this from an XP box because for some things I still need Windows.

If Microsoft and their Windows team did more than pay lip service to POSIX, security in depth, minimal daemon/services profiles, a powerful command line, standard networking instead of their proprietary stuff, and proactive security audits then lots of people who run Linux, BSD, Solaris, and OS X would never use anything but Windows. Some of us still would, but if Windows had enough POSIX support to run everything written for Unix, had the security of a decent Linux distro, only enabled what services you actually need running, and had a record of fewer actual vulnerabilities (and not just a comparison that their core OS has fewer "critical" bugs than all of the software that ships with RHEL, when RedHat is more likely to call something "critical" anyway), then why would people bother? OS X would be just for video, audio, and graphics people. Solaris, AIX, and other commercial Unixes would be real niche players. Linux and the BSDs would be mainly curiosities for tinkerers, just as MS tries to portray them, and would have only small installations in the business world. There'd still be a place for all of these, but they'd have a much harder time of it if Windows was real quality work in these areas.

In short, the embrace and extend tactics, the FUD MS spreads, and the NIH syndrome are finally catching up to Microsoft. So yes, I'd say that although they're not hurting much, what little pain they're having is in large part caused by their security practices.

Yeah this (3, Insightful)

Dunbal (464142) | about 7 years ago | (#19902399)

Makes much more sense than actually writing secure software in the first place, doesn't it?

This is a silly idea. It assumes that if Microsoft pays someone to keep quiet about a security vulnerability, no one, ever, will independently discover this SAME vulnerability. Human nature dictates that when you hand out money, you will quickly have people waiting in line.

Reminds me of the romans paying the barbarians NOT to invade them. Sure, give your enemy an income and make him rich. Makes a LOT of sense...

Re:Yeah this (2, Insightful)

khallow (566160) | about 7 years ago | (#19902571)

Sounds more analogous to bribing some barbarians to tell you what the tribe is thinking of doing. Then you can patch up your defenses and anticipate the sometimes enemy.

Re:Yeah this (3, Informative)

physicsboy500 (645835) | about 7 years ago | (#19902637)

The point of Microsoft bidding on a vulnerability is not to put a hush on it, but instead to do something about it.

The black market bidding wars currently exist because hackers want to get their hands on an unknown vulnerability they can exploit for a decent amount of time before it's discovered and patched, thus if Microsoft knows about it the value goes way down on the exploit because the time to patch is going to be vastly reduced. Microsoft won't (in theory) just sit on these bits of info (if they would like to remain in any way competitive), but instead use the info to produce a patch.

Re:Yeah this (1)

Dunbal (464142) | about 7 years ago | (#19903473)

The point of Microsoft bidding on a vulnerability is not to put a hush on it, but instead to do something about it.

They're not doing anything about it NOW. Why do you think that suddenly they want to pay, and hurry to fix it? And I am sure they know about most of their vulnerabilities.

Re:Yeah this (3, Informative)

vfrex (866606) | about 7 years ago | (#19902733)

What does it matter if the same vulnerability is discovered? Microsoft would buy the knowledge of the exploit, patch it, and it would no longer be an issue.

Re:Yeah this (1)

knewter (62953) | about 7 years ago | (#19903263)

It assumes that if Microsoft pays someone to keep quiet about a security vulnerability, no one, ever, will independently discover this SAME vulnerability.
Don't be retarded. It doesn't mean that. It means that a lot of times the ethical researchers will stay quiet, the group of people looking at bugs might increase (and would only get denser in the 'ethical' category). It means that MS will get first dibs on exploits rather than try to start thinking about a patch AFTER Code Red. It means an awful lot of good stuff. It's a good idea, for all of the thoughtful reasons mentioned in the article.

Don't do his logic the disservice of being viewed on the same page with your ignorance. The argument isn't that you buy the knowledge and don't fix the bug. The argument is you buy the overflow and patch it before someone else discovers it. And you make sure you get the info first by paying for it, less than the black market but on a legitimate market. It kills the black market AND makes the software more secure.

I honestly think something like this could legitimately make a proprietary OS more 'secure' than a free one. The market's an incredible thing.

Re:Yeah this (0)

Anonymous Coward | about 7 years ago | (#19903475)

Makes much more sense than actually writing secure software in the first place, doesn't it?

Your ignorance deceives you. Name one piece of software that can be guaranteed free of security issues - a product that has no dependencies on anything else, where the dependency could cause a vulnerability.

"Hello world" doesn't cut it - even that depends upon the C library and the OS.

Burn them at the stake (0, Troll)

Joebert (946227) | about 7 years ago | (#19902413)

We could always burn black-hat hackers at the stake, like we used to do with witches.

There's a perfrctly simple explanation (1)

$RANDOMLUSER (804576) | about 7 years ago | (#19902421)

So the question facing Microsoft when they choose whether to make that offer, is: Would they rather have the $1,000, or the exploit? What responsible company could possibly choose "the $1,000"?
The short answer is that Microsoft just doesn't give a damn. They fix security holes when forced to. If they were a grocer, you'd have to prove to them that you have shit before they'd sell you toilet paper.

Re:There's a perfrctly simple explanation (2, Funny)

Cro Magnon (467622) | about 7 years ago | (#19902531)

If they were a grocer, you'd have to prove to them that you have shit before they'd sell you toilet paper.


I'm running Windows! What more proof do you need?!

Black Hats versus White Hats (1)

skitheboat (901329) | about 7 years ago | (#19902429)

We need the Mad Magazine Spys [wikipedia.org] to weigh in on this matter ... or paint a house [watching-paint-dry.com] rather than the endless argument of what exactly is responsible disclosure.

Lengthy. (5, Funny)

Funkcikle (630170) | about 7 years ago | (#19902439)

Click that magical little read more link below to continue the thought.
At 11508 bytes, I am afraid my interest buffer would be overrun.

Hostage negotiations (1)

DirtySouthAfrican (984664) | about 7 years ago | (#19902451)

I dunno, this sounds a bit like the argument over whether or not one should negotiate with hostages or terrorists... Once the black hats figure out that their exploits are being "rescued", two things will happen: * Prices ("demands") will go up; these companies have deep pockets / lots of resources after all... want a chopper and $2 million? * The exploits will be re-sold... some exploits can't be patched immediately, and even if it can, millions of machines will remain unpatched over their lifetime. So if you can make ten grand from randsom, you can pick up some extra cash on the side by pimping out your victim. Maybe I'm taking the analogy too far.

Re:Hostage negotiations (1)

Culture20 (968837) | about 7 years ago | (#19903403)

Ransoming information isn't the cash cow you think it is. The black hats have more incentive to _not_ let the originating company know there is an exploit. What is needed is a way to make the good guys want to find the exploits first and do something about it.

Re:Hostage negotiations (1)

Endo13 (1000782) | about 7 years ago | (#19903539)

You're kind of touching on my one issue I still had after reading through the whole thing. (He answered the rest by the end.) That being, he keeps making the assumption that the black market exists only because MS isn't buying up the security exploits found. Not so. The black market for such exploits will exist as long as they can be used for any malicious purpose whatsoever (not necessarily even just ones that are profitable). If MS were to offer a cash prize for turning in exploits discovered it would likely reduce the number sold on the black market, but it would certainly not eliminate that market. Even if MS were to offer extreme amounts of cash (say perhaps $100M US) there would still be a small number of exploits that would be used for malicious purposes before MS was notified of them. So in reality, the higher the cash prize MS were to offer, the lower the percentage of exploits released in the wild - but that percentage curve is currently unknown to anyone, so MS can't know for sure if it would be more profitable to offer cash prizes or not. Thus far it looks like they've rolled the dice and chosen not to offer that prize, and given their current monopoly status it would appear that decision has not adversely affected their market-share.

Dear Gunrunners: +1, Unbridled Corruption (-1, Offtopic)

Anonymous Coward | about 7 years ago | (#19902459)



Your highest bid becomes the next War On Fill_In_The_Blank

Please contact me [whitehouse.org] .

Remember: Only Patriots(tm) can spread Freedom(tm) and Democracy(tm)

Patriotickally,
George W. Bush

*tm A trademark of the world's largest crime syndicate

Dear Bennett, (-1, Flamebait)

Anonymous Coward | about 7 years ago | (#19902479)

Can you do us all favor and stop writing these retarded essays? Try getting a life or stick to your masturbatory regime more rigidly.

Smart about security? (0, Flamebait)

sleekware (1109351) | about 7 years ago | (#19902481)

Microsoft? Do something smart about security flaws? Impossible! ;-)

The answer is... (0, Flamebait)

laing (303349) | about 7 years ago | (#19902483)

Microsoft is not interested in fixing the problems with their operating systems. They need a certain number of bugs and annoyances present in the OS so the consumer will be unsatisfied and will rush to purchase the next "upgraded" OS. This business model has been hugely successful for them and it will continue to be until people wise up. Microsoft are capitalizing on human nature. Most people believe that "newer is better" but it is not always true.

--
Place creative sig here

Re:The answer is... (1)

Citius (991975) | about 7 years ago | (#19902717)

Well, that may be true to some extent, but why, then, would people running OS 9 ever upgrade to OS X? Human nature will want something newer regardless of whether it's actually improved (in stability) over the old; as long as the core hasn't *decreased* in effectiveness, I'm pretty sure that it'll appeal to most people. After all, most people also are very easily-led sheep. It's the odd one in the bunch that questions the system...that means you, /.ers.

Re:The answer is... (1)

CockMonster (886033) | about 7 years ago | (#19902919)

Does your job involve adding to and maintaining an OS? Mine does, your post is utter bollocks

Deserve to get paid (0, Offtopic)

michaelmalak (91262) | about 7 years ago | (#19902523)

But if you prevent millions of Internet Explorer users from being infected with spyware, you deserve to at least get paid what Bill Gates earns in the time it took you to read this sentence.
I deserve to get paid for reading that rambling story that contained no useful information past the summary.

Read more? (3, Funny)

yanos (633109) | about 7 years ago | (#19902559)

Click that magical little read more link below to continue the thought.

No no no no. That's sooo web 1.0. Now we say after the jump! You're so out of touch with the current trends of the blogosphere!

Re:Read more? (0)

Anonymous Coward | about 7 years ago | (#19903235)

You're missing the point!

Click that magical little read more link below to continue the thought.
is such a beautifully formed sentence!

mod 0p (-1, Offtopic)

Anonymous Coward | about 7 years ago | (#19902567)

is wiped oof and [goat.cx]

There aren't even MS exploits listed on the site. (1)

dami99 (1014687) | about 7 years ago | (#19902601)

This is stupid really.

- Selling exploits like this is only going to encourage crime -- anyone who thinks a big vendor like MS is going to buy exploits this way is fooling themselves.

- All of the exploits currently listed for auction are for "free" software. Who (except a very unlikely angel corporation) is going to pay for these exploits, except criminals?

(Note that I have no problem with vendors paying for this stuff, but this auction method exists to make money by selling exploits to criminals. Call it what it is.)

"Bill Gates Should Buy Your Buffer Overruns" (0)

Anonymous Coward | about 7 years ago | (#19902655)

That's the dumbest fucking idea I've ever heard since I've been at Microsoft.

640 buffer overruns ought to be enough for anybody! --Bill Gates

In Soviet Redmond, Bill Gates buys buffer overruns from YOU!

Thank you, thank you, folks! I'll be here all week. Try the veal!

(heh: my CAPTCHA was micros - no joke)

Good idea but (3, Insightful)

sheriff_p (138609) | about 7 years ago | (#19902681)

I think this is a good idea, but it's unlikely to happen - by buying such a thing, Microsoft sets themselves up in a position of liability - something that software vendors have so far largely managed to avoid.

Say they buy one exploit, but not another, and some company gets caught by the other. Microsoft have put themselves in a pretty nasty legal liability position there.

Additionally, it'll look a lot like endorsement of black-hat practices, something MS will want to avoid... ...

The Cheapest and Best Solution is... (1)

asphaltjesus (978804) | about 7 years ago | (#19902693)

Shout from the highest roof top in every city that black hats should be hanged. It won't be long before there's a mob ready to hang black hats. Better still, Microsoft comes out looking like the good guy.

Microsoft has employed this strategy for at least a decade now.

This story is preposterous.

Fix the problem... (0, Flamebait)

Deadstick (535032) | about 7 years ago | (#19902781)

...where it begins. Microsoft's security analysts have access to the source code. If they can't find exploits before outsiders find them by reverse engineering, you have prima facie evidence that M$ is (a) not hiring very talented analysts, or (b) not motivating the ones it has.

I've worked for a (non-IT) company where if you invented something that saved the company a million dollars, you'd get a coupon good for a clock radio or a DustBuster. Billion dollars, maybe some luggage...and you were bloody well expected to be grateful. For some reason, we didn't invent much. Meanwhile, the company was spending millions on the endless parade of corporate self-help scams (Zero Defects, TQM, ISO9000, ad nauseam) that produced less than they cost.

At a minimum, an analyst who documents an exploit should get some kind of bonus based on an estimate of the damage it would have caused in the wild. Further, I think they should be working in an adversary relationship with the developers...your typical coder should look on them about the way a detective looks on Internal Affairs.

rj

Poor Assumption (1)

PPH (736903) | about 7 years ago | (#19902817)

This assumes that the 'best' exploits make it to some sort of market. In my experience, the best ones are written as works for hire by organizations intent on committing political, industrial or financial espionage. They tend not to be widely distributed and don't produce easily detectable fingerprints in the form of network traffic, strange PC behavior, system crashes, etc. Many have yet to be discovered.


The prices that these sorts of exploits command would make a significant hole in Microsoft's finances.

What's the big deal? (1)

Thyamine (531612) | about 7 years ago | (#19902837)

I guess I'm confused as to why this is different than the government/police offering up rewards for criminals and fugitives? Sure it would be nice if Microsoft could solve all of this beforehand with some well written code, but I can understand how things get through considering the size of their code base and the numbers of people trying to collaborate.

If we don't have a problem with paying to get criminals off the street, why should we care if someone is getting paid for an exploit. If all these 'gangs' of spammers/exploit writers really are trying to one-up each other, why not turn in competitors' exploits to make them less virile and screw them over.

No incentive, and some argument against... (1)

Bob-taro (996889) | about 7 years ago | (#19902861)

What's the incentive? Yes, people bash MS, and complain about all the bugs and exploits, but I don't think it's hurting their bottom line, so they've got no reason to change. I think it would be great and logical to have some kind of discretionary monetary reward system for reported vulnerabilities (just like you might reward someone who returned a lost wallet or something), but I'm a regular person. A high-level manager might see several problems with this:
  • Once you pay for the vulnerability, you've basically admitted it's there and that you didn't already know about it, and you might not want to do this.
  • Your testing staff might try to game the system.
  • You open the door to all kinds of bad publicity: people mad that their exploit didn't pay, or didn't pay as much as another, or was ignored (when it was really unfounded)
Some of this might have been addressed in TFA or even the summary (I didn't read the whole thing - sorry!). My point is just there are some negatives, and for a PHB they probably outweigh the positives (especially when measured in $)

Wouldn't work. (2, Insightful)

Spy der Mann (805235) | about 7 years ago | (#19902917)

OK, give us your info, and we'll pay you if we consider it's genuine.
(2 days later) Guess what, it's not a true exploit. Sorry, no pay.
(1 week later, at Windows update) We've fixed a patch for a recently discovered vulnerability!

Solving the drug problem by subsidizing dealers (2, Insightful)

BeProf (597697) | about 7 years ago | (#19902933)

Rewarding unethical behavior?

What could *possibly* go wrong?

Re:Solving the drug problem by subsidizing dealers (0)

Anonymous Coward | about 7 years ago | (#19903101)

I agree.

I think that Microsoft is evil --- but that doesn't justify blackmail!

"I know how to pick the lock on your house. Give me $10,000 and I'll tell you how to stop me. Otherwise I'll tell a thieving, murdering rapist how to do it. So do the ethical thing and give me the money --- I'll just tuck it into my white hat here."

A very simple fool-proof solution (1)

jkrise (535370) | about 7 years ago | (#19902969)

Would be for Microsoft to simply open source the entire Windows kernel and everything else. Winning the security race is an impossible task these days - it means buying positive press, paying for scumbag hackers who have no scruples etc. etc. It's clear over the past decade that it is impossible to add security as an after-thought to a shoddy security model.

If MS releases everything else except a few secrets and binary drivers, these security researchers will find their entire industry crumbling down instantly, and users will have a genuinely secure experience - since they will now be able to examine exactly what hackers and trojans are up to.

Of course, Microsoft's own Live One Care and tech support will suddenly be over-staffed, but that would be a pleasant problem, wouldn't it?

They're not interested (5, Interesting)

Archie Gremlin (814342) | about 7 years ago | (#19902997)

In my experience, MS aren't interested in reports of security holes anyway.

I found a security hole in an MS product about 6 months ago so I sent a full description with working test code to secure@microsoft.com.

I got an automated response (so far so good) but then I heard nothing more. After a month, I sent them another email to ask if they were doing something. Silence. Another month later I rang Microsoft support and asked them to give me an update. They told me that the case number doesn't exist and that they don't have a department called the "Microsoft Security Response Center".

Eventually I found an engineer who does support for the product with the security hole. He said he'd heard a _rumour_ about the MSRC and offered to track them down. Eventually, I got an email update from them saying "we might get round to fixing it in a few months."

In short, if they're not interested in free security reports, why would they pay for them?

It's target based performance metrics at work (0)

Anonymous Coward | about 7 years ago | (#19903199)

There's only one reason why everything in the modern world is turning to shit.

With arbitrary performance metrics set by clueless assholes in management, it's easier to meet goals by fiddling figures and ignoring problems. So not only are the Microsoft security response team ignoring reports, they're combining patches and silently patching in order to make the stats look good.

Proof that Microsoft still don't "get" security; they see it as a marketing exercise.

Re:They're not interested (3, Interesting)

tqbf (59350) | about 7 years ago | (#19903401)

I'm not sure why people are modding up a post that claims that the MSRC is a "rumor" inside of Microsoft. The MSRC is famous; news stories are written when people move to and from the group. They release all the Microsoft advisories, each of which typically elicit yet another news story. A position in the MSRC was listed as "one of the worst jobs in science" in SciAm (obviously wrong; people compete to get jobs there).

Why don't you tell us more about the security flaw you claim to have found?

Designed exploits (1)

Shotgun (30919) | about 7 years ago | (#19903041)

What about the exploits that aren't accidents, but are actually designed in, ie (har-har) Active-X controls that allow anyone to execute arbitrary, unrestrained code on every system that visits a website. Paying for someone to report these obvious exploits would amount to paying someone to call you an idiot.

The author's problem is that he thinks Microsoft should be concerned about delivering a good product. Everyone privy to how corporations work knows that the goal is only to deliver a product that the customer will pay for.

Microsoft Already Does Pay For Your Overflows (1)

tqbf (59350) | about 7 years ago | (#19903057)

No technology company in the world spends more money on security testing than Microsoft does. At any one time, it's likely that Microsoft retains a plurality of the security testing industry to perform code review and black-box testing on the myriad of products they are releasing this cycle. These aren't Microsoft employees; these are team members of the boutique security consultancies being paid directly by Microsoft to find vulnerabilities in products before they ship.

Microsoft is already paying for vulnerabilities. Investigate and you may find that just as Google singlehandledly jacked up the comp for every web-savvy C/C++/Java dev in the valley, Microsoft has amped up the bill rates for security consultants worldwide. Entire consulting outfits are built around pipelines of Microsoft work; some of the best and most famous researchers in the world work for these outfits.

Seven years ago, it was probably valid to single out Microsoft for carelessness about software security. But, just like this essay implies, software security is a problem that money can impact. Microsoft has lots of money. Since Windows XP, they have certainly put it where their mouth is.

There are differences between "true independent security research" and contract work for vendors. They're not clear-cut enough to make a value judgement. Researchers on contract to Microsoft get access to source code, developer documentation, test tools and the dev team. They also find problems before customers are exposed to them. On the other hand, indie researchers don't have to pass phone screens, know how to sell, or have the right contacts. Both groups find stuff.

It's worth noting that the overwhelming majority of external Microsoft findings in 2007 come from vendor-sponsored "research labs", usually attached to IPS signature farms (like the ISS "X-Force"). These groups strain the definition of "indie", are already well-compensated, and will continue to harvest findings whether or not an incentive scheme is created.

In any case, "WabiSabiLabs" is unlikely to have any impact here. Every major product Microsoft releases has been audited by a competant third-party. Microsoft has re-vamped their coding standards, deprecated old C/C++ idioms, introduced new ones, developed internal tools, adopted static analysis, and instituted a culture of security design reviews that starts before the first line of code is even written. As a result, a major "indie" Microsoft finding is a big deal. You'd be naive to put it on some fly-by-night auction site; a Microsoft remote code execution finding is already liquid in the grey market today.

it could work. (1)

ArcadeX (866171) | about 7 years ago | (#19903069)

Several arguements where covered, and comments are just rehashing them. Yes, you will have people that sell to both sides, yes prices may get driven up, but it's also going to drive up the number of honest people out there. For every exploit sold to both sides, how many will be discovered by honest people that otherwise wouldn't have invested the time without any returns. So what if an exploit is sold to both sides, better M$ be working on a patch while the blackhats are still making / destributing the explotation system vs. M$ being completely behind and the exploit in place before the patch comes. M$ could even go for something that doesn't really cost them as much, like instead of cash, copies of software. Blackhats aren't going to worry about something they would steal anyway, but many whitehats could put an MSDN subscription to use. It's almost like the old MAFFIA arguement... does it really cost M$ anything if they wouldn't have bought the software anyway, which only leaves them out the cost of the media.

what?? (1)

phantomfive (622387) | about 7 years ago | (#19903105)

Does he realize that he is talking to people who write software and operating systems in their spare time and give it away for FREE?? And he is trying to justify his greed to people who would mostly do what he wants for free as well? And he tries to manipulate us into thinking it's ok by using Microsoft as an example.

If he wants to try to make money off of exploits and the like, then let him go take it up with the vendors. There is no reason to try to appease his conscience by preaching here that we should agree with him. If you think it is a good idea dude, do it! Don't be bothering us about it or worrying what the rest of the world thinks of you.
--
Looking for a C/C++ job in Silicon Valley? [slashdot.org]

Same class of problems over and over again (1)

raddan (519638) | about 7 years ago | (#19903107)

As many people have pointed out, Microsoft's problem is that they don't seem to take the "big picture" approach to bug fixing often enough. I mean, how often have we known that buffer overflows are a problem? Microsoft itself even has a page on safe string handling functions [microsoft.com] to replace strcpy and its ilk. Switching to these functions is trivial.

Microsoft has harder problems facing it-- buffer overflows are only one class of problem. But it seems that Microsoft's highly compartmentalized development process prevents someone from saying, "You know what? We keep seeing the same kinds of bugs. We need to require that all our developers do X." Until someone at MS does this, we're going to see this patching go on indefinitely.

Bad Idea (0)

Anonymous Coward | about 7 years ago | (#19903141)

There is one word that describes this sort of thing: Blackmail. 'nuff said

The prize you can never win. (1)

db32 (862117) | about 7 years ago | (#19903157)

Step 1. Discover Exploit
Step 2. Submit Exploit to MS for prize
Step 3. MS rejects exploit saying they already were aware of that, thank you, try again.
Step 4. MS patches previously unknown vulnerability using free 0 day information.
Step 5. MS gets great PR for stepping up their security program and fixing tons of stuff.

You MIGHT get some of the big players to go ahead and play along and pay. But given the behaviors of most of the companies involved in the major security issues...good luck getting paid.

Non-Story: WabiSabiLabi (1)

Frosty Piss (770223) | about 7 years ago | (#19903207)

People keep submitting stories to Slashdot about WabiSabiLabi, but when you go there, there really isn't anything to see. Is WabiSabiLabi the story, or is the story WabiSabiLabi? Look, six months from now, WabiSabiLabi will be gone for fairly obvious reasons. It was a fair shot at Internet cash, but the Dot Com bubble burst, and people just are not really interested in that kind of business model anymore.

implications of a purchase (2, Interesting)

sanimalp (965638) | about 7 years ago | (#19903217)

This idea may seem great on paper, but in order to buy an exploit, a person would have to provide payment, which is the fatal flaw. Now, lets say the feds want to get a quick list of people that may be using exploits for unlawful computer access. subpoena the DB of the exploit auctioneer, and wa-la, a giant list of exploit users. Like shooting fish in a barrel. something tells me this exploit auction system may work ok if companies purchase it, but i dont think underground exploit buyers are going to surface to harvest exploits from this website..

No problem (1)

session_start (1086203) | about 7 years ago | (#19903233)

I've had comcast before, theirs along with several other sites say their site does not work with firefox, etc. however, using firefox and changed what the useragent sends does not break the site... In otherwords, it seems to be a simple check to see if your using IE, and if your not, they will tell you the site wont work, even though it really does (most sites). 1) Use firefox anyways 2) go to about:config 3) add config.about.agentoverride 4) set the string to the browser/os you want comcast to see.

Re:No problem (1)

session_start (1086203) | about 7 years ago | (#19903323)

LMAO, too much coffee, not enough sleep - wrong thread... i think you know where it goes though.

Microsoft Marketing (1)

hoy74 (1005419) | about 7 years ago | (#19903265)

If Microsoft would take on something like this; and their marketing department spun it the right way, it would be much cheaper than paying for Google ads.

Fortress (1, Funny)

Spazmania (174582) | about 7 years ago | (#19903315)

there's one obvious thing [Microsoft] can do to help protect users: offer to buy up the security vulnerabilities themselves.

Sure, because the way to keep folks off your lawn is to erect a fortress and then reward anyone who breaches it with cash.

Reporting security flaws to MS is useless. (1)

Repossessed (1117929) | about 7 years ago | (#19903433)

Because Microsoft's security strategy is to pretend that they have less security flaws than the competition. Even when they *do* admit to flaws, they're usually behind on patching them. In fact, the whole thing would be a bad idea for Microsoft as a result. They'd end up with a huge number of known flaws, and still lack the resources to do anything about them.

(I see far too many machine with eyeball identifiable malware despite the fact that the customer is fully patched, anti-virused, and anti-malwared (blacklists suck, they really do) to believe that MS is capable of coming even close to patching all the flaws. Even with the added protection of third party help.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...