Hacker News Reader

I'm uncomfortable with vulnerability markets for other reasons. But, anyways, you write:

For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak.

Two things.

First, you're not clear on why this would be a bad thing. The flaws are there whether insiders out them or not. The implication in your comment is that we'd be better off with those flaws kept secret. Obviously, we'd all be happier if the vendor outed their own flaws, or if a non-"mercenary" researcher outed them for public consumption. But even private vulnerability sales have the effect of eventually burning the bug.

Second, it's a little naive to think that most flaws are known only to insiders. In fact, the advantage insiders have in getting full access to repositories is probably dwarfed by the advantage attackers have in committing entire careers to studying exploitable bugs. For most competent researchers, lack of source code is just a speed bump.

On your second point...

Yes but having a paid insider gives you a major advantage. You can now seed vulnerabilities, and derive a predictable income stream from these seeded vulnerabilities.

What is more scary to me is that big money is involved here. What if you can't get a developer to be tempted by money to insert vulnerabilities for you, and you start using a more heavy handed approach (death threats etc).

Also by paying developers to insert vulnerabilities, you no longer need experts looking for vulnerabilities. These experts are in short supply, so it might become a more viable path.

This is why I am uncomfortable with vulnerability markets...

First, I thought you were simply talking about insiders who had knowledge of targeted software. Here it seems like you're talking about moles being paid to insert new vulnerabilities.

But even then, I don't find this threat particularly credible. After all, what we're talking about here are W2 employees with social security numbers or immigration tracking committing galactically expensive torts against their employers and in all likelihood most of the Fortune 500, in addition to (in all probability) multiple felonies. How much money do you think Endgame can afford to pay these people to shoulder that risk? There's a reason this doesn't actually happen all the time.

>> There's a reason this doesn't actually happen all the time.

How can we be sure this doesn't happen all the time though? I suppose because it hasn't leaked into the media, but still...

For interest sake, you mentioned you are against vulnerability markets. Why so?

Realistically in my experiences every large company has "skeletons", which are primarily known to insiders and of which outsiders have less knowledge.

Be that a product which is known not to have as rigorous a security regime as others, or perhaps a service which is considered "legacy" and not developed actively.

When offensive companies start hiring people to get access to that information to use against their prior employers, I think that's not great for overall security.

I didn't think I was implying that keeping flaws secret in the long term was desirable, I don't think it is.

Also whilst I agree it's naive to suggest that only insiders know most flaws, I feel that it's also reasonable to suggest that insiders have information which would be useful to attackers, and that could be tapped by hiring them.

As I said originally that was just one example of where I think potential problems could arise from "vulnerabilities as a product", but I'd be interested to hear what you think are the downsides to vulnerability markets.

You seem to be describing companies that are institutionally concealing serious product flaws from their customers, and suggesting that overall security as a public policy goal is improved by a strategy of just hoping that reverse engineers won't notice.

that's not what I was intending to describe. I was suggesting that insiders have inside information and sometimes that is relevant to attacking companies, such that hiring those insiders could be useful to them.

and definitely not hoping that reverse engineers won't notice, I've been in security long enough to see all my pronouncements of "you know someone could do x" and more come true...

I'm not sure that you've clarified anything with this comment. "Insider knowledge of information relevant to attacking software" is "insider knowledge of product flaws". Flaws need to be fixed, not concealed.

Institutional knowledge is about process as well as the software. Knowing the magic words and people can make social engineering or avoiding countermeasures much easier, even in the absence of an explicit software flaw.

Now we're playing Six Degrees of Kevin Bacon. We start out with moles inserting vulnerabilities. Then it's insiders who know about flaws. Then insiders who know about weak spots to look for flaws in. Now it's magic words to help with social engineering. At some point, these stop being important considerations for public policy.

I think the point is, it's extremely likely you'd end up in a situation where someone intentionally introduces a hard to detect flaw. If the flaw is then sold to a government agency: 1. The person who introduced the flaw will not suffer any consequences. 2. You've now set the precedence that it's free game for people to intentionally leave holes in software and get paid to do so.

This seems very unlikely, since intentionally introducing product flaws is at the very least an incredibly damaging tort, not just against your employer but against everyone who ends up using the software.

I think that the idea of software bugs (vulnerabilities) as a product is a scary concept and a bad precedent for overall security

That was my first impression as well however, after giving it some thought I wish there are more vulnerability trading companies. The point is that currently this business is reserved for government sponsored customers:

According to three sources familiar with Endgame’s business, nearly all of its customers are U.S. government agencies.

Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them. To some extent such outsourcing already exists in the form of pen-testing companies, but it seems like a different league.

interesting idea, to an extent this already exists with bug bounty programmes that a number of companies have in place.

The risk is where either the company doesn't have a programme of that kind, or where the value of the bug is substantially higher to the offensive industry, than the product company...

> Expanding this business to the private sector might have positive effects. Corporations could buy the "zero days" in their own products in order to fix them.

I should point out that some companies are already getting vulnerabilities reported to them for free (in the best case, for the price of a symbolic bounty program) and fail to fix them. See http://reverse.put.as/2014/10/31/patching-what-apple-doesnt-... for one recent example that comes to mind. Giving them the opportunity to pay market prices for the vulnerabilities is not going to improve the situation.

Everything else remaining identical, the only thing the emergence of a free market for vulnerabilities will make efficient is the exploitation of victims that aren't informed of and do not have the capacity to fix them.

The only real fix to the current situation starts with legislation that aligns the interests of the companies that rely on vulnerable code and those of their users. Forbidding the trading of vulnerabilities won't help, and encouraging it won't help either. Recent legislation in the EU forcing companies to disclose security breaches they are aware of is a first, baby step in the right direction. There are many essays by Bruce Schneier on this topic, here is one picked at random: https://www.schneier.com/blog/archives/2004/11/computer_secu...

It would also help if we got OSes that do not give applications blanket rights to read and write everywhere and use as much processing power as it likes. Abandoning the shared security model would help a lot.

I'm having a hard time coming up with an example of a critically important vulnerability that relied on permissions models. Arbitrary code execution is usually game-over no matter what privilege level you have.

The exception to this is sandboxing, which is effective (but unreliable) in limited, specific scenarios but not at all effective for the general problem of controlling real, full-featured user programs. Compare the Chrome content sandboxes to the Apple application sandbox.

The fundamental problem with trying to retard vulnerability markets is that vulnerability research is expensive. There aren't that many people who can do it(†).

You could conceivably ban overt vulnerability sales. But that doesn't actually fix anything, because the firms that want to buy bugs now will simply retain researchers directly instead of licensing their work product.

You could even conceivably ban commercial vulnerability research. ACLU's vulnerability markets guy has come close to suggesting that in the past. But that also won't fix anything. Firms that are using vulnerabilities illegally would continue to (now illegally) fund vulnerability research --- an activity that is far harder to monitor than actual hacking, which is already hard to monitor. The net effect would be to clear the industry of everyone doing "benevolent" research --- no more Metasploit, but lots more VUPEN(††)-type stuff.

† Where "it" means the kind of vulnerability research that commands 5-6 figure premiums, virtually none of which is web app security work

†† Full disclosure: I know fuck-all about VUPEN and am just using the name as a shorthand for "the vulnerability boogeyman".

As another slightly less draconian approach than actually trying to ban vulnerability research, what about mandating a market where researchers have to sell to the developers and developers are obliged to buy from the researcher, with a middle-party setting the prices.

That might serve to provide incentives to the vendors who aren't already working actively on their security to do so, and also reduce (although obv. it wouldn't eliminate) the number of vulns going straight to offensive products.

So I have two options: I can sell work product in a market controlled by "the FCC of vulnerabilities" with capped upside, or I can work directly as a 1099 contractor at an enormous daily rate for firms that will pay to get vulnerabilities before vendors do.

Why would I take the market route?

In this case what are the firms who pay these rates doing with the information?

Defensive work (e.g. IPS vendors) well after they've got their early day protection they can just sell on to the vendor.

Offensive (e.g. "cyberweapons" ugh I had that term). well that's the point I'm making that whole industry is bad for defensive security as it involves keeping vulns secret as long as possible, so they can be used by them.

Gov's have to make a choice whether that's an industry they want to encourage, be neutral to, or discourage.

But given this line of thinking is one you'd disagree with, what option for addressing the problem do you prefer?

What difference does it make what they do with it? Stipulate for now that they use them to hack Russian and Chinese computers. That is, stipulate that there is a good public policy reason to regulate that kind of work. How would you accomplish that regulation? What, exactly, would you ban?

If you can't articulate a reasonable and effective regulation that would control vulnerability research, regulation will do more harm than good: it will wipe out beneficial research and drive talent towards malicious research.

It's not on me to come up with a way to "address" the "problem". Doing nothing seems like a more credible response than trying to outlaw specific kinds of computer programming.

Indeed, however in the same way as it's not up to you to "address" the "problem" nor is it up to me :)

Doing nothing would seem like a losing response given the current swing of events but I'll defer to your greater experience.

BTW I'd respond to the other threads but HN seems to object to deep threads.

On "flaws fixed rather than concealed" sure in a perfect world they do, but limited resources == prioritization and some systems and packages inevitably get left behind, insiders know which those are..

What do I, as a user and customer of software, care why companies harbor known security flaws (that, after all, is what you're talking about)? Hope is not a strategy. Those flaws are going to be discovered whether or not insiders leak them.

I'm not sure where I said hope was a strategy, I said insiders might have information that's of value to attackers (unless I got my threads mixed here)

The solution is obvious: all software development needs to be classified as a utility and regulated under Title II.

It's a systemic problem. One option is to decriminalize cracking, and then to associate a fine with creating vulnerabilities. It's straightforward to find the original author of some code. $500 maximum fine, or something on that level.

Changing the system (obviously) has a bunch of other obvious (and a bunch of unforeseeable) consequences. However, code would get a whole lot tighter.

> Corporations could buy the "zero days" in their own products in order to fix them.

The implicit threat that if you don't pay enough to secure exclusive access to the zero-day, it will be sold to others who may use it against you - that seems a lot like blackmail. It's different with bug bounty programs, which are not explicitly set up to compete with the price a vulnerability would get on the black market, but rather to incentivize civic-minded responsible disclosure.

Assuming the exploitation of a vulnerability is considered illegal, selling the vulnerability to someone who you have reason to suspect will exploit it should also be illegal, surely?

> And then you have open source software which is heavily used in a lot of commercial products that might get attacked. With this kind of thing there's a big incentive not to report bugs to the project but to sell them to a company who has no incentive to see them fixed...

Then a lot of people need to revisit their own thoughts on exactly why they use open source, and the consequences of what happens if it goes away.

> For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak.

That might happen, but it depends on intent. Products may be realized to be weak afterwards, due to a changing software landscape, so the company hiring them is a good thing - the software gets fixed in some way, and a need was fulfilled.

Then the question becomes: how likely do you think it is that someone purposefully creates a flawed product in order to make a gain later, after the project has been completed, released; after they have left the job; after they have been hired by these testing companies? It sounds as likely to me as people purposefully putting back-doors into software for future self interest. There exists another outlet for unethical intent, but in my opinion, the problem begins with ethics to begin with.

Software is too complex to perfect. There will always be bugs. Regulation of industry and regulation of the regulatory bodies is additionally, very complex. The idea of regulating where knowledge is allowed to flow on top of that horrifies me: i.e., whether a developer is allowed to work at one of these companies eventually, in judgment of prior work.

I wish people had greater incentive to maintain a standardization of ethics, but this is all theoretical to begin with, at least from my direct observations. There is nothing to judge unless it happens, and then the best one can do is act.

t's not a giant leap from "not reporting a bug" to "deliberately inserting a bug" and then selling details of it.

This has aleady been going on, publicly, for many years and is the value proposition of several companies.

Take a look at TippingPoint ZDI and VUPEN. All they do is find/buy vulnerabilities, privately weaponize (or provide mitigations for) them, and sell the new product to companies and governments.