[Dailydave] Dave's CounterMeasure Talk

Tue Oct 30 15:41:35 EDT 2012

I enjoyed Dave's talk [1] and found the "trends in our industry discussion" keenly insightful.

This got me to speculating and extrapolating (and being overly philosophical,) given what appears are confluent market and geo-political forces driving two trends:

1. the trend of increasing demand by state actors for quality bugs.

2. the trend of discretion trumping disclosure when it comes to bug research.

What I find most interesting is the trend of increasing demand for 0days creating a large price disparity between vendor 0day bounties and the apparent willingness of governments to provide much higher compensations for 0day acquisitions [2]:

Basically, there is a large mismatch between vendor incentives to disclose vulnerabilities, and the prices being offered by governments.    It is this mismatch and its implications on vulnerability research which I find most intriguing.   Below I list a few more interesting questions which arise due to this observation.

Is this mismatch going to rapidly change the way hackers work with the tech industry (or rather, will not work with the tech industry), and even more so, will it alter where skilled hackers find markets for their capabilities?

Could this result in a giant sucking sound (to borrow from H. Ross Perot) as 0days are vacuumed up by state actors with deeper pockets than vendors (e.g. several orders deeper than a free mac, or $3133.70)?

Continuing along this line:  What are the implications of overt/covert government buying of 0days versus the present system, which had been stabilizing around an open market to match vendor bounties with vulnerability disclosure?

It would seem to skew the present market, but how much really?

Should it be a best practice/doctrine of governments that every 0day should be acquired, just in case?   Or, reworded... Could you picture a state actor purchasing an AngryBirds exploit as part of a cyber dominance doctrine?

Is a natural result of this trend a reduction, in terms of effectiveness, of commercial and open-source vulnerability scanning tools (which depend on a steady stream of fresh vulns for market share)?

Then, for the fun of it, I extrapolated our observed trends to a possible extreme:  Why not eliminate the middle man?  For example, is it realistic in any scenario that market forces and the threats/counter-threats of cyber-warfare lead governments to bypass independent vulnerability researchers and instead we see the software/controls industry work covertly with governments to intentionally design and embed difficult to detect (and trigger) vulnerabilities?

I think a new term is in order, to differentiate this concept from your classical trojan/backdoor; how about "MinusDay" (you heard it on dd first :-D)    I am not saying every product need have them, just products that are likely to be utilized by an adversary.

Restated: If exploit vectors really are that valuable, will corporations tend to become incentivized to "keep it in the family" and build them into critical systems themselves?   Given the observed trend of increasing value for 0day bugs, coupled with the fact that corporations are always seeking out new vertical markets which leverage existing specializations, does not this situation seems an entirely plausible?

Does this trend shred an underlying trust that might have been inherent in a global technology market place?   Are we seeing this trend already with Huawei, and Google out of china?

Remember the plane Boeing made for the Zemin that was full of listening equipment [3]?

Then I thought, are these concepts or trends, which I was thinking were novel observations, even new?

I am curious if others agree or disagree and would care to offer their predictions for our industry, in the spirit of fun discussion mainly.

Also, has anyone ever seen the owners manual for a 5ESS?

Cheers!

Dan

[1]. http://www.youtube.com/watch?v=vBQET68HHSg

[2]. http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/

[3]. http://articles.cnn.com/2002-01-19/world/china.plane.bug_1_boeing-official-boeing-jet-plane?_s=PM:asiapcf

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.immunityinc.com/pipermail/dailydave/attachments/20121030/65bc029e/attachment.html>