Is The Market For Security Vulnerabilities A Good Thing?

from the government's-open-for-business dept

It used to be that security researchers would often reveal security vulnerabilities as a way to build their name and get some attention. However, with so many cases of that backfiring and having the messenger blamed, it appears that the growing trend is for those who find vulnerabilities to simply sell them for thousands of dollars -- with the U.S. government being a prominent purchaser. Researchers can also sell the vulnerabilities to security companies or (of course) questionable black market contacts -- though, most ethical security researchers want to make sure whoever they sell the vulnerability to is going to inform the company that makes the software. Of course, the whole concept of "selling vulnerabilities" seems vaguely extortionist, as the implicit threat is that if the government doesn't buy it, the researcher always could sell it to those with less than noble intentions. At the same time, though, it is odd to hear security researchers complain that it's tough to sell to the government because it's not easy to find the right contacts -- as if the government buyers should more readily advertise themselves.

Reader Comments

Subscribe: RSS

View by: Time | Thread


  • identicon
    Anonymous Coward, 4 Jun 2007 @ 9:50am

    The real problem with this is only: what used to be a noble, academic pursuit is not sullied with the taint of money and lower motives. OK Fine, if thats how its going to be (as it inevitably must) then let us deal with it appropriately--clear and unambiguous bug bounties. Without that degree of certainty, those who feel as if theyre entitled to a bounty will get it, one way or another--thus the extortion.

    That will hold us for a while until the value of these exploits gets bid way up. Heres to hoping the supply of bugs can continue to expand and keep prices low.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 4 Jun 2007 @ 11:16am

    What's to stop them from selling to both the government and the black market, I know I would.. double dip the pen in both ink wells.

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 4 Jun 2007 @ 11:39am

      Re:

      Honour among hackers, my friend. Professional standards. Industrial hacking is respectable, as is friendly whitehat hacking for government. Betraying both will be appreciated by neither.

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 4 Jun 2007 @ 1:10pm

    Honour amoung hackers. Tell the Estonians about it...

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 4 Jun 2007 @ 2:00pm

    There's an interesting paper on this very problem that just got published in one of the Yale Law School journals: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=960239

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 6 Jun 2007 @ 12:32am

    Makes me wonder about all the ones sold exclusively to Uncle Sam. What sort of spying is being perpetrated against ordinary citizens? "Magic Lantern" is just the beginning.

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here



Subscribe to the Techdirt Daily newsletter




Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Close

Add A Reply

Have a Techdirt Account? Sign in now. Want one? Register here



Subscribe to the Techdirt Daily newsletter




Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Follow Techdirt
Special Affiliate Offer

Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.