Swiss Security Firm Lets You Bid on Bugs
612424
With so much focus on security in the enterprise, it might have been inevitable. A Swiss security research lab is testing the market for zero-day vulnerabilities at an auction site called WSLabi. Security researchers stateside are skeptical.
7386
By Martha McKay, The Record, Hackensack, N.J.  Dec. 9--A Clifton security company has received an infusion of cash and  contracts from a California telecommunications equipment maker.   Shares of Electronic Control Security Inc.
489709
The Swiss National Bank on Friday  released terms of its temporary term auction facility:
351752
Software asset management tools vendor LogicLibrary on Wednesday plans to announce its acquisition of BugScan, which provides security analysis capabilities to identify code vulnerabilities before application deployment.
550626
Company patches one search engine security flaw and is notified of another.
320034
Antispam lawsuits and enforcement actions suggest that companies taking a wink-and-nudge approach to affiliates should be careful about how they lure paying customers. By Ryan Singel.
587682
A consortium of European companies, including Linux-distributor Mandrakesoft, has been awarded a three-year, $8.6 million contract to boost security of the open-source Linux operating system, the companies said Thursday.
652392
Lockheed Martin, Northrop Grumman and IBM are vying for a multibillion-dollar contract to build a database for fingerprints and other biometric information that the FBI is set to award this week.
646154
Security software maker announces plans to acquire Hacker Safe transaction certifier in a cash deal worth approximately $51 million.
21824
Software giant hopes to convince governments that its products are secure.
739909
(InfoWorld) - Hackers are hitting paydirt in their search for browser bugs. According to Symantec's twice-yearly Internet Security Threat Report, hackers found 47 bugs in Mozilla's open-source browsers and 38 bugs in Internet Explorer (IE) during the first six months of this year. That'sÂ up significantlyÂ from the 17 Mozilla and 25 IE bugs found in the previous six months. Even Apple's Safari browser saw its bugs double, jumping from six in the last half of 2005 to 12 in the first half of 2006. Opera was the only browser tracked by Symantec that saw the number of vulnerabilities decline, but not by much. Opera bugs dropped from nine to seven during the period. And while Internet Explorer remained theÂ most popular choice of attackers, no one is invulnerable. According to the report, 31 percent of attacks during the period targeted more than one browser, and 20 percent took aim at Mozilla's Firefox. "There is no safe browser," said Vincent Weafer, senior director with Symantec Security Response. "If you've got a browser, make sure you're configuring it correctly," he added. "That's a far better strategy than running some browser just because you haven't heard of it." Part of the rise is due to the growing market for vulnerabilities, Weafer said. Legitimate companies such as 3Com's Tipping Point and Verisign' s iDefense pay for this information, and there is also a growing black market for exploits. "People are encouraged and getting money for finding vulnerabilities, so now you have more people looking," said Weafer. Browser bugs are also relatively easy to find and exploit, said Marc Maiffret, chief technology officer with eEye Digital Security. "Everyone has realized that targeting the applications on the desktop is a better way to break into businesses and consumers and steal things than server flaws," he said via instant message. Businesses and consumers may both be targets, but home users are the victims in about 86 percent of all attacks, according to Symantec. And the U.S. is the biggest source of online attacks, thanks to its large number of compromised machines with broadband connections, Weafer said. About 37 percent of all online attacks originate in the U.S., he said. While there may have been more bugs in Mozilla than in IE, Symantec gave the open-source project high marks for its bug-fixing. On average, it patched bugs within one day of their public disclosure -- the fastest turn-around of all measured browsers. Opera came in second, averaging two days. Safari was next, with a five-day window, followed by Microsoft, which averaged nine days per patch. Microsoft may lag as a browser patcher, but when it comes to operating systems, the company leads the pack, according to Symantec. The slowest? Sun Microsystems.
641287
A Swiss Internet start-up is raising the ire of the computer security community with the launch of an online auction house where software vulnerabilities are sold to the highest bidder.
754814
A controversial new site that auctions information on software vulnerabilities to the highest bidder may be the wave of the future.
448921
(InfoWorld) - Psst. Want to buy a zero-day? A Swiss startup called WabiSabiLabi has some for sale, but to qualified buyers only. On Tuesday, the company launched a security vulnerability marketplace, where details on unpatched software flaws can be bought and sold. By Thursday, the site was offering details on four bugs in products such as the Linux kernel and Yahoo Messenger. No bids had yet been registered, and asking prices for the research ranged between â¬500 ($681) and â¬2,000 A zero-day vulnerability is a previously undisclosed bug that has not been fixed by the vendor. WabiSabiLabi argues that the computer industry's ethical disclosure policies have led to a raw deal for security researchers, who typically are not paid for disclosing vulnerabilities. "Nobody in the pharmaceutical industry is blackmailing researchers (or the companies that are financing the research), to force them to release the results for free under an ethical disclosure policy," the WabiSabiLabi Web site states. Representatives from WabiSabiLabi could not immediately be reached for comment. The company bills its marketplace as a way for "security researchers to get a fair price for their findings and ensure that they will no longer be forced to give them away for free or sell them to cyber-criminals." But to David Perry at Trend Micro, it looks like something else. "It's going to be eBay for vulnerabilities," he said. Although WabiSabiLabi says it will sell details only to legitimate buyers, Perry is concerned that the site could be used to put dangerous information into the hands of criminals. "We're looking at the potential of cyber warfare coming up," said Perry, who is Trend Micro's global director of education. "Now we're going to peddle vulnerabilities in a winner-takes-all auction. How do we know who's good and who's bad when we do this?" Security researcher Cesar Cerrudo said that while it's uncommon for researchers to go underground to sell their vulnerabilities, it does happen. "Researchers will try to get money in the easier and faster way, and sometimes that can only be done in the black market," said Cerrudo, CEO of Argeniss Information Security. WabiSabiLabi is run by Herman Zampariolo, formerly CEO of Italian networking vendor iLight SpA. It lists Roberto Preatoni, founder of the Zone-h.org cyber-defacement Web site, as its strategic director. Like eBay, WabiSabiLabi offers sellers a variety of options. Research can be offered at a fixed price, sold at auction, or sold to a number of different buyers in what is known as a Dutch auction. WabiSabiLabi will test the research to make sure the vulnerabilities operate as advertised, and the company will also vouch for the sellers and buyers, who can remain anonymous and trade under nicknames. Companies such as 3Com's Tipping Point division and VeriSign's iDefense Labs have offered cash for this type of research before, but this is the first time that such an open marketplace has been created, Perry said. Argeniss's Cerrudo doesn't share Perry's fear of the vulnerabilities being misused. "This is already happening in the underground," he said, "but with a public service like this, I think things are a little clearer."
337848
Software giant promises to deliver another tool to fight worms and viruses.
82006
Software vulnerabilities are bought and sold online, both by legitimate security companies and by thieves.
748665
Online portal says bugs could have let attackers alter appearance of pages and access a victim's data.