[ news_security_news ]
Vulnerabilities On The Auction Block
Doug Caverly
Staff Writer
2006-07-14
 Insider Reports RSS Feed
If you happened to discover a security vulnerability, what would you do with that information? Perhaps nothing, and just continue to sit on your rear. Maybe you'd tell the affected company about it and hope for good karma. And apparently there's another (not necessarily malicious) possibility - you might try to sell the vulnerability.
As strange as it sounds, this has happened (and is continuing to occur). Techdirt noted a case in which "someone who worked out a security flaw in Microsoft Excel sent the company the details of the flaw, and then turned around and offered up the details on eBay. eBay shut down the auction, pointing out that they have a ‘policy against encouraging illegal activity.'"
Although selling the information was not necessarily the kindest, sweetest thing to do, "illegal" might be an overstatement - after all, the seller didn't create the flaw. Microsoft still seemed more concerned over the auction than the vulnerability, though. A press report, according to Techdirt, said, "Microsoft is aware of the reported flaw and has been working with eBay on the matter."
A more recent article indicates that the practice is still continuing, though, and even becoming increasingly common. Carlo wrote that "many security companies themselves are shelling out for the vulnerabilities, under the guise of the greater good, but really getting the information to give themselves a head start in closing the vulnerabilities, and enhancing their products and reputation."
It's an interesting idea; certainly within the bounds of capitalism, it just operates on the more cutthroat end of things. But as Carlo said, "perhaps giving malware authors incentives to turn their work over to software developers or security companies isn't such a bad idea."
Add to | DiggThis | Yahoo! My Web
Technorati: Sales of vulnerabilities
About the Author:
Doug is a staff writer for SecurityProNews, InternetFinancialNews, SearchNewz, and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
