bugtraq - Re: 3Com launches vulnerability-buying program

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <DBF999A38E58A9A00A9E45B6@utd59514.utdallas.edu>
Date: Tue, 26 Jul 2005 15:03:41 -0500
From: Paul Schmehl <pauls@...allas.edu>
To: bugtraq <bugtraq@...urityfocus.com>
Subject: Re: 3Com launches vulnerability-buying program


--On Monday, July 25, 2005 14:03:51 +0000 Ghaith Nasrawi 
<libero@...egypt.edu> wrote:

> folks,
>
> as it was announced few minutes ago that "3Com launches
> vulnerability-buying program" (through TippingPoint, a company 3Com
> acquired earlier this year)
>
> http://www.securityfocus.com/news/11253
> http://www.zerodayinitiative.com/
>
> so what do you think about this step? Obviously, they are trying to
> fight public disclosure of security vunl's (that why bugtraq exists)
> and buy the information so they can have 0day signatures to
> TippingPoint IPS solution.
>
Not so obviously.  IDefense has been doing this for a couple of years.  By 
paying for the vuln research they get to be first to announce the vulns to 
the community.  Looks like TP is going to do the same thing.

I doubt they'd get any 0day sigs, since they'd be buying others' research. 
The horse is already out of the barn by then.

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/