- Related Stories
-
Offering a bounty for security bugs
July 24, 2005 -
Hacking for dollars
July 6, 2005 -
3Com beefs up security with $430 million buy
December 13, 2004
Both security specialists are vying to be the first to know about vulnerabilities in companies' products. The idea is to gain a competitive edge by having security products that recognize more vulnerabilities that may be exploited in cyberattacks.
In an
Money has increasingly become an incentive for hackers. Programs such those from TippingPoint and iDefense offer a legitimate way for them to
iDefense said it did not make the changes in response to TippingPoint's competition, but to underscore its commitment to the program after being
Both iDefense and TippingPoint work with the person reporting a bug to disclose it to the maker of the faulty software so a fix can be produced.
Only a few companies pay security researchers for finding software vulnerabilities. iDefense's
TippingPoint will also try to sell its program to researchers at
Neither company discloses what amounts are paid for vulnerability information. However, Gael Delalleau, a French security researcher who has sold information to iDefense in the past, told CNET News.com that the
"That's less than a day's worth of consulting," he said in an e-mail interview.
Delalleau welcomes TippingPoint's
TippingPoint is not surprised by the competition. "There already was competition," said David Endler, director of security research at TippingPoint, also noting the underground market. "At the end of the day, the security researcher is going to be the winner."
Response to the programs has been mixed among security researchers. While Delalleau applauds the competition for adding to security intelligence, others distrust the security companies and wonder whether exploiting flaws or selling them to criminal hackers could be too much of a lure.
"Can the security companies truly be trusted to diligently help to find a fix when their product is, by its very nature, dependent on insecure applications?" said Keith McCanless, a security researcher who has been credited with finding security flaws in various products.
Emmanouel Kellinis, a security researcher in London, said he is certain many researchers would consider the programs if they can get paid. "On the other hand, there is a possibility that they can make more money by exploiting a vulnerability," he said.
See more CNET content tagged:
TippingPoint Technologies,
iDefense,
3Com Corp.,
payout,
Black Hat
