iDefense Offers Bucks for New Bugs

Ready, set, hack: iDefense Labs's latest vulnerability contest targets none other than the Internet infrastructure.

iDefense is awarding anywhere from $16,000 to $24,000 to hackers who find a new (as in zero-day) vulnerability in Apache httpd, Berkeley Internet Name Domain (BIND) daemon, Sendmail SMTP daemon, Open SSH sshd, Microsoft Internet Information Server, or Microsoft Exchange Server.

"These are the core apps that allow the Net to run -- you've got Web servers like Apache, mail servers like Exchange and Sendmail, all part of any installation that connects to the Net," says Fred Doyle, director of iDefense Labs, a unit of VeriSign Inc. These applications could also be found in intranet environments, he says.

Doyle says iDefense chose the Internet technologies because they "looked like a good target, and we know it's going to be a difficult target." So iDefense extended the competition to both the second and third quarters of this year, with the deadline of before midnight, September 30.

iDefense will award $16,000 to the winning vulnerability for any of the Internet infrastructure technologies. The vulnerability has to be remotely exploitable, and allow arbitrary code execution, and you can win an extra $2,000 to $8,000 for a working exploit to go along with the bug.

Bug bounties are controversial, however, and the recent 3Com/TippingPoint $10,000 award at CanSecWest for hack-a-MacBook Pro (pwn-2-own) contest triggered more debate on the issue. 3Com/TippingPoint was accused by some critics of offering a prize that in turn gave it ownership of a potentially big bug it could use as a marketing tool for its own products. (See That's How Rumors Start).

"What bothered me on that was it's literally like the old fire insurance scams in New York by the mob. On one hand they are selling fire insurance, yet they are paying people to light fires," says Paul Henry, VP of technology evangelism for Secure Computing.

Henry says paying hackers to find vulnerabilities in other vendors' equipment and then offering paid services to protect users from it isn't fair, he says. "The bottom line is people paying them as subscribers were able get updates and literally protect selves faster than rest of user community, which had to wait for a patch from Apple."

"If you want to run contests, run them against your own gear," he says.

iDefense's Doyle says the company provides its customers as well as affected vendors with advanced notification of the vulnerability. "We are a responsible disclosure shop," he says. "We go to the vendor and our customers at the same time."

But critics say bug contests don't always yield leading-edge vulnerability research, anyway.

Meanwhile, here are some ground rules for the latest iDefense contest: The vulnerability must be in the latest (and patched) version of software (no betas, please); it must be original and not previously disclosed; it can't be used by any third-party software on the system; and no social engineering.

— Kelly Jackson Higgins, Senior Editor, Dark Reading