kragenpoboxcom kragen sitaker august 7th entity known idefense sent announcement appended email briefly idefense bills global security intelligence company offering cash information security vulnerabilities computer software publicly known especially promise tell anyone else kind secret traffic allowed continue pose serious threat computer communications infrastructure moment dominant paradigm computer security research known full disclosure people discover security vulnerabilities software tell vendor short later vendor chance fix problem publish information including code exploit vulnerability possible method proven far superior old paradigm established cert late 1980s proponents might call responsible disclosure never release working exploit code never release information vulnerability vendors released patch procedure often left hundreds thousands computers vulnerable known bugs months years vendors worked features often even patches released people wouldnt apply didnt know serious problem underground computer criminal community would often discover exploit holes months years responsible disclosure process kept victims connections underground vulnerable problem vulnerabilities widely known much less dangerous victims take steps reduce potential impact including disabling software turning vulnerable features filtering traffic transit detecting responding intrusions therefore much less useful wouldbe intruders also software companies usually see security vulnerabilities software pr problems prefer delay publication expense fixing bugs long possible idefense offering new alternative appears far dangerous either two previous paradigms want buyer marketplace secret software vulnerability information rewarding discoverers vulnerabilities cash long snosoft group security researchers evidently including criminal elements apparently made offer sell secrecy software vulnerability information software vendor specifically apparently made private offer hewlettpackard keep vulnerability hps tru64 unix secret hp retained snosofts consulting services hp considered extortion responded legal threats snosoft published information allowed happen cause two problems together add catastrophe first secret software vulnerability information available highest bidder nobody else reasons explained later think highest bidders generally organized crime syndicates although obvious sellers second finding software vulnerabilities keeping secret become lucrative many talented people result responsible disclosure days good guys remain vulnerable months years majority current vulnerabilities kept secret ive heard argued highest bidders generally vendors vulnerable software dont think thats plausible someone steal 20 000 software bug lets software vendor never held liable often fact people administer software arent liable either credit card data stolen ecommerce site example knowing vulnerability anyone else might save website administrator time might save software vendor negative pr net thief thousands dollars think highest bidders early vulnerability information lucrative thieves use execute largest heists without getting caught inevitably means organized crime syndicates although particular gangs good networked theft may yet exist might occasional case market leader microsoft could make money giving competitors bad pr gang could make theft think remoteroot hole samba example right people know find security exploits either motivated personal interest subject motivated public interest motivated desire individual recognition personally know criminals benefit exploits creating marketplace secret vulnerability information would vastly increase availability information people afford pay spies terrorists organized crime lets let happen original idefense announcement sunil james mailtosjamesidefensecom sent wednesday august 07 2002 1232 pm subject introducing idefenses vulnerability contributor program greetings idefense pleased announce official launch vulnerability contributor program vcp vcp pays contributors advance notification vulnerabilities exploit code malicious code idefense hopes might consider contributing vcp following provides answers basic questions program q work idefense understands majority security researchers publish security research compensation rather could number motivations including following pure love security research desire protect harm targeted networks desire urge vendors fix products publicity often accompanies disclosure vcp want research made public internet community would also like paid workthe compensation depend among things following items kind information shared ie vulnerability exploit amount detail analysis provided potential severity level information shared types applications operating systems software hardware potentially affected verification idefense labs level exclusivity data granted idefense q contribute vcp vcp open individual security research group entity q launching program timeliness remains key aspect security intelligence contributions lists take time publication public large often many services charge clients access without paying original contributor idefense program contributor compensated idefense labs verifies issue idefense clients public large warned timely manner q gets credit contributor always credited discovering vulnerability exploit information q contribute vcp active welcome begin contributing today learn go httpwwwidefensecomcontributorhtml questions would like sign contributor vcp please contact us contributoridefensecom regards sunil james technical analyst idefense idefense global security intelligence company proactively monitors sources throughout world technical vulnerabilities hacker profiling global spread viruses malicious code ialert security intelligence service provides decisionmakers frontline security professionals network administrators timely access actionable intelligence decision support cyberrelated threats idefense labs research wing verifies vulnerabilities examines behavior exploits malicious code discovers new softwarehardware weaknesses controlled lab environment httpxentcommailmanlistinfofork thu 22 aug 2002 002454 0400 edt underground software vulnerability marketplace hazards