3Com launches vulnerability-buying program

[Ghaith Nasrawi]

folks,

as it was announced few minutes ago that "3Com launches
vulnerability-buying program" (through TippingPoint, a company 3Com
acquired earlier this year)

http://www.securityfocus.com/news/11253
http://www.zerodayinitiative.com/

so what do you think about this step? Obviously, they are trying to
fight public disclosure of security vunl's (that why bugtraq exists)
and buy the information so they can have 0day signatures to
TippingPoint IPS solution.





Ghaith Nasrawi.

[Matt Palmer]

--yLVHuoLXiP9kZBkt
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Jul 25, 2005 at 02:03:51PM +0000, Ghaith Nasrawi wrote:
> as it was announced few minutes ago that "3Com launches
> vulnerability-buying program" (through TippingPoint, a company 3Com
> acquired earlier this year)
>=20
> http://www.securityfocus.com/news/11253
> http://www.zerodayinitiative.com/
>=20
> so what do you think about this step? Obviously, they are trying to
> fight public disclosure of security vunl's (that why bugtraq exists)
> and buy the information so they can have 0day signatures to
> TippingPoint IPS solution.

It's probably pretty good for TippingPoint customers. Seems pretty
reasonable from a commercial point-of-view -- if enough extra people buy the
software to offset the cost of the purchases, then it's a win for 3Com. I
doubt that they'll be offering the sort of money that is going to make a
real clueful zombiemaster roll over and play ball, however, so in the same
way that paying police informants hasn't eradicated crime, I don't think
this is going to be a solution to the problem. It's an interesting take on
the situation, though.

- Matt

--yLVHuoLXiP9kZBkt
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFC5vA+BEnrTWk1E4cRAnwGAJ4i2o/f+P63PBxN6RPMBA/ohzLRXQCfcgzV
y6Auy2S7gAVMVzdh39KAxEc=
=f7Ol
-----END PGP SIGNATURE-----

--yLVHuoLXiP9kZBkt--

[Paul Schmehl]

--On Monday, July 25, 2005 14:03:51 +0000 Ghaith Nasrawi
<libero@aucegypt.edu> wrote:

> folks,
>
> as it was announced few minutes ago that "3Com launches
> vulnerability-buying program" (through TippingPoint, a company 3Com
> acquired earlier this year)
>
> http://www.securityfocus.com/news/11253
> http://www.zerodayinitiative.com/
>
> so what do you think about this step? Obviously, they are trying to
> fight public disclosure of security vunl's (that why bugtraq exists)
> and buy the information so they can have 0day signatures to
> TippingPoint IPS solution.
>
Not so obviously. IDefense has been doing this for a couple of years. By
paying for the vuln research they get to be first to announce the vulns to
the community. Looks like TP is going to do the same thing.

I doubt they'd get any 0day sigs, since they'd be buying others' research.
The horse is already out of the barn by then.

Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/