Auction site sells security exploits
604138
Company founder says eBay-like site WabiSabiLabi will improve security by ensuring researchers get a fair price for their work.
78271
People selling items over the internet or through newspaper adverts are warned of a sophisticated fraudulent payment scam.
448921
(InfoWorld) - Psst. Want to buy a zero-day? A Swiss startup called WabiSabiLabi has some for sale, but to qualified buyers only. On Tuesday, the company launched a security vulnerability marketplace, where details on unpatched software flaws can be bought and sold. By Thursday, the site was offering details on four bugs in products such as the Linux kernel and Yahoo Messenger. No bids had yet been registered, and asking prices for the research ranged between â¬500 ($681) and â¬2,000 A zero-day vulnerability is a previously undisclosed bug that has not been fixed by the vendor. WabiSabiLabi argues that the computer industry's ethical disclosure policies have led to a raw deal for security researchers, who typically are not paid for disclosing vulnerabilities. "Nobody in the pharmaceutical industry is blackmailing researchers (or the companies that are financing the research), to force them to release the results for free under an ethical disclosure policy," the WabiSabiLabi Web site states. Representatives from WabiSabiLabi could not immediately be reached for comment. The company bills its marketplace as a way for "security researchers to get a fair price for their findings and ensure that they will no longer be forced to give them away for free or sell them to cyber-criminals." But to David Perry at Trend Micro, it looks like something else. "It's going to be eBay for vulnerabilities," he said. Although WabiSabiLabi says it will sell details only to legitimate buyers, Perry is concerned that the site could be used to put dangerous information into the hands of criminals. "We're looking at the potential of cyber warfare coming up," said Perry, who is Trend Micro's global director of education. "Now we're going to peddle vulnerabilities in a winner-takes-all auction. How do we know who's good and who's bad when we do this?" Security researcher Cesar Cerrudo said that while it's uncommon for researchers to go underground to sell their vulnerabilities, it does happen. "Researchers will try to get money in the easier and faster way, and sometimes that can only be done in the black market," said Cerrudo, CEO of Argeniss Information Security. WabiSabiLabi is run by Herman Zampariolo, formerly CEO of Italian networking vendor iLight SpA. It lists Roberto Preatoni, founder of the Zone-h.org cyber-defacement Web site, as its strategic director. Like eBay, WabiSabiLabi offers sellers a variety of options. Research can be offered at a fixed price, sold at auction, or sold to a number of different buyers in what is known as a Dutch auction. WabiSabiLabi will test the research to make sure the vulnerabilities operate as advertised, and the company will also vouch for the sellers and buyers, who can remain anonymous and trade under nicknames. Companies such as 3Com's Tipping Point division and VeriSign's iDefense Labs have offered cash for this type of research before, but this is the first time that such an open marketplace has been created, Perry said. Argeniss's Cerrudo doesn't share Perry's fear of the vulnerabilities being misused. "This is already happening in the underground," he said, "but with a public service like this, I think things are a little clearer."
754814
A controversial new site that auctions information on software vulnerabilities to the highest bidder may be the wave of the future.
63220
Going, going, own3d Security researchers have discovered a sophisticated botnet attack targeting eBay customers, particularly those in the UK.â¦
319877
From disguising applets to look like part of Windows to co-opting security tools, Web crooks use a variety of methods to bypass your system's safeguards.
450803
Sneaky program takes a different tack to capture people's passwords and potentially steal money.
497821
Alternative browser features protection against online scams.
462213
Auction company sets up free, private mail service in attempt to derail scam artists using its good name.
120056
'Trust and safety' board in emergency shutdown Hackers brazenly posted sensitive information including home addresses and phone numbers for 1,200 eBay users to an official online forum dedicated to fraud prevention on the auction site.â¦
466855
New service helps companies thwart online scams.
271223
Security experts have identified a development kit that can set up a scam site in as little as two seconds on a compromised server.
490723
A growing number of people are turning to the online auction site not for knickknacks and trinkets, but for serious hardware and building materials.- The Washington Post
54743
Some unscrupulous vendors manage to worm their way into price comparison site listings. Knowing how these shopping engines work can help you avoid the bad apples.
209504
A promotion for the tools blog Toolmonger.com gives an audience a chance to watch a shack get hacked to pieces.
395819
It's a case of the professional fraudsters scamming the amateurs with a phishing tools supply site.
68684
Image files found on image-hosting sites look harmless, but conceal PHP exploit code.