Security company launches eBay for bugs
448921
(InfoWorld) - Psst. Want to buy a zero-day? A Swiss startup called WabiSabiLabi has some for sale, but to qualified buyers only. On Tuesday, the company launched a security vulnerability marketplace, where details on unpatched software flaws can be bought and sold. By Thursday, the site was offering details on four bugs in products such as the Linux kernel and Yahoo Messenger. No bids had yet been registered, and asking prices for the research ranged between â¬500 ($681) and â¬2,000 A zero-day vulnerability is a previously undisclosed bug that has not been fixed by the vendor. WabiSabiLabi argues that the computer industry's ethical disclosure policies have led to a raw deal for security researchers, who typically are not paid for disclosing vulnerabilities. "Nobody in the pharmaceutical industry is blackmailing researchers (or the companies that are financing the research), to force them to release the results for free under an ethical disclosure policy," the WabiSabiLabi Web site states. Representatives from WabiSabiLabi could not immediately be reached for comment. The company bills its marketplace as a way for "security researchers to get a fair price for their findings and ensure that they will no longer be forced to give them away for free or sell them to cyber-criminals." But to David Perry at Trend Micro, it looks like something else. "It's going to be eBay for vulnerabilities," he said. Although WabiSabiLabi says it will sell details only to legitimate buyers, Perry is concerned that the site could be used to put dangerous information into the hands of criminals. "We're looking at the potential of cyber warfare coming up," said Perry, who is Trend Micro's global director of education. "Now we're going to peddle vulnerabilities in a winner-takes-all auction. How do we know who's good and who's bad when we do this?" Security researcher Cesar Cerrudo said that while it's uncommon for researchers to go underground to sell their vulnerabilities, it does happen. "Researchers will try to get money in the easier and faster way, and sometimes that can only be done in the black market," said Cerrudo, CEO of Argeniss Information Security. WabiSabiLabi is run by Herman Zampariolo, formerly CEO of Italian networking vendor iLight SpA. It lists Roberto Preatoni, founder of the Zone-h.org cyber-defacement Web site, as its strategic director. Like eBay, WabiSabiLabi offers sellers a variety of options. Research can be offered at a fixed price, sold at auction, or sold to a number of different buyers in what is known as a Dutch auction. WabiSabiLabi will test the research to make sure the vulnerabilities operate as advertised, and the company will also vouch for the sellers and buyers, who can remain anonymous and trade under nicknames. Companies such as 3Com's Tipping Point division and VeriSign's iDefense Labs have offered cash for this type of research before, but this is the first time that such an open marketplace has been created, Perry said. Argeniss's Cerrudo doesn't share Perry's fear of the vulnerabilities being misused. "This is already happening in the underground," he said, "but with a public service like this, I think things are a little clearer."
532099
(InfoWorld) - PayPal unveiled a new Security Key on Friday that will add an additional layer of security to user accounts and help prevent online criminals from gaining access to them. The PayPal Security Key is a small electronic token that generates a unique code that can be used in addition to a user name and password when users sign in to their PayPal account.                                                     The company announced the news as part of eBay's week-long Developer Conference in Boston. It provides PayPal customers with so-called "two factor" authentication that makes it harder for online criminals to raid accounts, even if they do trick users into giving up their user name and password using online "phishing" scams, according to Michael Barrett, chief information security officer at PayPal. "This is something that will help the community to be more secure," Barrett told InfoWorld. PayPal and parent company eBay are top targets for online scam artists, who use dummy Web sites in so-called "phishing" attacks that attempt to trick users into revealing their user name and password. Those accounts can then be raided or used to fraudulently purchase goods. The Security Key isn't a silver bullet for phishing attacks, but just one part of a multi-pronged defense by PayPal and eBay, Barrett said. In recent months, the company has begun digitally signing all outbound e-mail messages and putting pressure on ISPs to take action on fraudulent mail that claims to come from both eBay and PayPal. More recently, the companies have been working with two leading ISPs in a beta program to automatically block all non-signed e-mail that claims to come from eBay or PayPal, according to Barrett and eBay CTO Scott Thompson. PayPal has been testing a beta version of the Security Key program in Germany and has already issued tens of thousand of the password tokens to its users. Already, the favorable response from users has been strong. "We never advertised this. It was all by word of mouth, but it's still been extremely popular," Barrett said. Starting Friday, PayPal will begin making the Security Key, which is part of the VIP (VeriSign Identity Protection) Network, available to its U.S. customers for a one-time fee of $5.00. PayPal users in Germany and Australia will also have the option to receive a Security Key, and PayPal plans to add other countries in the near future, according to a PayPal statement. PayPal and eBay began working closely with VeriSign after a deal to buy VeriSign's payment gateway business in October, 2005. PayPal has no plans to charge its customers for the token beyond the initial $5.00, which covers shipping and handling. Nor will the company levy a subscription fee for the two-factor authentication service. "This isn't something we're making money on," Barrett said. That said, PayPal will be paying attention to the number of users who adopt the password token and to the company's rate of fraud in an effort to figure out whether the tokens are worth the cost of the program, he said. Currently, fraudulent transactions amount to around $35.2 million dollars a year, or one third of one percent of PayPal's total global payment volume of $11 billion, Barrett said. Lowering that fraud rate even a little could offset the cost of the program. PayPal is also taking cues from other online financial services firms like eTrade, which launched a program in 2005 to allow all its U.S. account holders to use an RSA SecurID token for two-factor authentication, Barrett said. "eTrade has been pretty bullish about this," he said. "One thing that they noticed is that the customers who have (the token) use their account more because they feel safer," he said. Even before the news was announced, PayPal and VeriSign were promoting the new program on the floor of eBay Live at the Boston Convention Center, and VeriSign employees were handing out free PayPal tokens to attendees and signing them up for the new program. Charles Hu, an eBay Live attendee who sells concert tickets under the name "SummerComets" on the online auction Web site, said that he liked the idea of having an additional layer of security for his eBay account. "I'm always worried that someone will steal my password," Hu said. "I've seen (the password tokens) used in other industries, too." However, Hu wasn't ready to sign up for the program because he was worried that doing so would lock his wife out of their eBay account. "She's back at the hotel, so if I sign up now and they change our account, she's not going to be able to log in," he said. Barrett said that PayPal was prepared for the increased support calls that will come after the secure tokens are in widespread use but says that his company has a duty to protect customers from scams, even if it adds to the cost of doing business for PayPal and eBay. "Customers have been telling us they want this, so we're going to give it to them," he said.
682986
Now in beta test, EffectiveUI's new eBay Desktop is aimed at letting users shop, search and buy from their desktops instead of inside Web browsers, as well as to simplify user tasks and 'optimize rich media' along the way.
570924
The companies plan to share security features to help customers protect their networks from worms and viruses.
92354
Symantec Corp. is fishing for dollars with a new service designed to help companies combat the ongoing epidemic of online identity theft, or "phishing," scams.
466855
New service helps companies thwart online scams.
110633
Kits that claim to help people hack into computers have been discovered for sale on the auction website eBay.
754814
A controversial new site that auctions information on software vulnerabilities to the highest bidder may be the wave of the future.
335478
An anonymous group of malicious hackers reopened an online store that sells the stolen source code of prominent software products and is offering the code for Ciscoâs PIX firewall software to interested parties for US$24,000, according to messages
680026
New company in New York will emboss gadgets with custom artwork, and they're going to give away the business plan. Photos: Laser-etched laptops
558251
Panda Software today unveiled a service that lets banks and online merchants scan a consumer's PC for malware that could pose a threat to e-commerce.
26726
The company fixes a huge security vulnerability that made it possible for attackers to steal users' personal data. By the Associated Press.
308257
Online auction giant eBay has been slow to respond to concerns about pirated software being sold there, prompting the Software &amp; Information Industry Association (SIIA)&#160;to file nine lawsuits against eBay-based software sellers, an SIIA official said.The SIIA believes it is necessary to file the lawsuits because eBay has been largely uncooperative in cracking down on software piracy, said Keith Kupferschmid, senior vice president of the trade group&#39;s antipiracy division.&quot;We haven&#39;t had very much success in getting [eBay] to work with us,&quot; he said.SIIA has asked eBay to stop &quot;buy it now&quot; and one-day auctions for software, but eBay has not complied, Kupferschmid said. In many cases, sellers offering pirated software are looking to sell it quickly, he said. SIIA also asked eBay if the trade group could buy banner advertisements warning about piracy when a user is looking at software, but the auction site declined, Kupferschmid added. &quot;We shouldn&#39;t have to do that,&quot; he said. &quot;eBay should do that themselves.&quot;Two eBay spokespeople didn&#39;t immediately respond to a request for comments on SIIA&#39;s position.The lawsuits, filed in U.S. District Court for the Northern District of California, are the largest round the SIIA has filed since launching its auction-site antipiracy program two years ago, the trade group said in a news release. Seven of the lawsuits were filed Wednesday, the SIIA said. Two others were filed two weeks ago. Most of the lawsuits target eBay sellers of Abobe PhotoShop CS3; one of the lawsuits targets a seller of several Symantec software packages.The defendants are from Texas, California, Washington state, Illinois, and New Jersey.&quot;SIIA has declared war against those who continue to sell pirated software on auction sites such as eBay,&quot; Kupferschmid said. &quot;Our goal is to give illegal software sellers a rude awakening so that unsuspecting software buyers and legitimate sellers are protected. For too long, auction sellers have been able to sell pirated software while risking only the removal of their auction.&quot;Since launching its Auction Litigation Program about two years ago, SIIA has filed about 20 lawsuits, not including the nine from the last two weeks, Kupferschmid said. The SIIA has won about six of those lawsuits in court, but in every case, the lawsuits have resulted in the seller stopping unauthorized sales of software, he said.&quot;Ultimately, they have stopped selling the illegal software, and that&#39;s what we&#39;re trying to do here,&quot; he said.
656129
EBay's PayPal division recently snapped up Israeli security company Fraud Sciences, in a move that could help advance eBay in its long battle against online scammers.
698310
You can now bid on programs covering the full range of hacking software on eBay.
475446
EBay has big plans to provide more programming tools to its large community of third-party developers.
461540
Identity thieves armed with a brute-force botnet are uncovering valid eBay account data, a security firm says.