Recognize-Security

Read the following argument by Dino A. Dai Zovi, Charlie Miller and Alex Sotirov – No More Free Bugs.

Basically, the argument states:

• Security vulnerabilities have high value and finding them is hard work and cost a lot of money. And there’s a market out there for them.
• Vendors relays on security researchers to choose the “responsible disclosure” way and report bugs they find (for free).
• Reporting security vulnerabilities is a risky business, legally and professionally.
• Reporting security vulnerabilities without any legal agreements pretty much sucks.
• Reporting security vulnerabilities for free – sucks too.

In my opinion, vendors should have a pre-made agreement, written by the company CSO/security manager, backed up by the company CEO and the company lawyer, for vulnerability disclosure and rewarding methods. Price can be calculated by the vulnerability severity and probability level (CVSS style) and the technical details and further work the security researcher provide. For example, the researcher wrote a PoC exploit code – low value. Researcher wrote a reliable universal exploit code – high value.
This way, security researchers will have more than enough reason to disclose vulnerabilities to vendors and get reward for it as it should be, instead of choosing other way (and in my opinion, the wrong way) to gain profit, either money or just fame.

The opinions about the “no more free bugs” argument around the world are mixed. Ross Thomas of SophosLabs thinks the security industry sunk in to a new level of lameness. Adam O’Donnell say there’s nothing to be excited about and there were never such a thing as free bugs.

I think there is nothing new under the sun. Vendors won’t rush to make vulnerability disclosure rewarding agreements just because three top security researchers state the party is over and no bugs will be given away for free any more. Security researchers and bug hunters are still stuck with the dilemma of the actions to take after finding a bug – responsible disclosure, full disclosure, selling it to whoever are willing to pay or doing nothing with it.

Categories: Security News

1 Comments | Comments RSS | TrackBack URL