[ISN] Swiss startup to offer zero day IDS

From: InfoSec News (alerts@private)
Date: Tue Sep 25 2007 - 22:02:43 PDT


http://www.techworld.com/security/news/index.cfm?newsID=10171

By Sumner Lemon
IDG News Service
25 September 2007

WabiSabi Labi, a Swiss start-up that caused a stir with the creation of 
an eBay-like marketplace for software vulnerabilities, is to start 
selling an intrusion detection system based on purchased zero-day 
exploits.

Its planned intrusion detection system, a tool that monitors a network 
or server for suspicious activity, will be based on a database of 
zero-days sold through the company's auction site, and researchers will 
receive continuing payments when vulnerabilities they discover are 
included, said company strategist Roberto Preatoni.

The only vulnerabilities that won't be included are those that are 
purchased using the exclusivity option.

"We are signing an agreement with a hardware producer and we are 
building, I can't say by when, but we will provide an intrusion 
detection system device based on zero-day signatures," said Preatoni, 
during an interview on the sidelines of the Hack In The Box conference 
in Kuala Lumpur, Malaysia.

WabiSabi Labi allows security researchers to submit unpatched software 
vulnerabilities, called zero-days, for sale on the company's auction 
site where qualified buyers can bid on them. The vulnerabilities can be 
purchased using an exclusivity option, which prevents them from being 
sold to anyone else, or they can be sold repeatedly to different buyers.

In addition, WabiSabi Labi is close to announcing an alliance with "a 
very well-known security research company" to market its products 
through the auction site, Preatoni said. He declined to name the company 
before the deal is made public.

"The next step will be to open up the marketplace to any sort of 
intellectual property, not just security research," he said.

The premise behind WabiSabi Labi's zero-day marketplace is that ethical 
disclosure - in which security researchers warn vendors about 
vulnerabilities in their software before disclosing them - is unfair, 
because the researchers are not compensated for the work they do. The 
startup wants to end the "free ride" that software vendors have enjoyed 
and see that hackers and researchers get paid a market rate for their 
efforts.

WabiSabi Labi isn't the first to offer hackers and researchers a way to 
earn money for the vulnerabilities they discover. Several security 
companies, including 3Com's TippingPoint division, VeriSign's iDefense 
Labs, and Immunity, pay researchers for zero-days.

WabiSabi Labi now hopes to combine its efforts to see researchers 
compensated for the work they do with aspirations of being a security 
vendor in its own right. 


__________________________________________________________________      
CSI 2007 is the only conference that delivers a business-focused
overview of enterprise security. It will convene 1,500+ delegates,
80 exhibitors and features 100+ sessions/seminars providing a
roadmap for integrating policies and procedures with new tools
and techniques.  Register now for savings on conference fees   
and/or free exhibits admission. - www.csiannual.com



This archive was generated by hypermail 2.1.3 : Tue Sep 25 2007 - 22:23:14 PDT