Prohibition For 0-Day Exploits

Unless you've been playing Rip Van Winkle, the ability for security researchers to monetize exploits is nothing new -- it arguably was started by TippingPoint's ZDI group buying 0-days in 2005 so it could build IPS signatures ahead of everyone else. The idea of buying exploits then branched to a different path where software vendors would offer a "bug bounty" to learn of holes in their products. Google has paid big money during the past few years on its bug-bounty program, and recently announced a large increase in what it'll pay for each bug. Microsoft and a number of other vendors also have spent on their bug-bounty programs to broaden their efforts to protect their software. This has been a net positive, both allowing researchers to pay their bills, as well as improving vulnerable software.

But according to The New York Times, no one is spending bigger than governments to acquire and control attacks they can then use as part of offensive, intelligence-gathering campaigns. Pollyannas may welp at this reality, but it's not really different than advanced arms research or any other investments made to advance military activities.

The U.S spends billions on advanced military research and on shiny toys like ray guns and scanners for bioweapons, among other programs. Why wouldn't governments spend some money on tools that could result in a game-changing attack such as Stuxnet? Of course they would, and they do. Many may dispute the concept of "cyberwar," but clearly the folks holding military purse strings believe their is a cybercomponent to future warfare ,and they are investing to gain that advantage.

Moreover, you don't have to read the latest Vince Flynn novel to see how cyber-\intel improves the effectiveness of spycraft, and any advantage can save military and intelligence lives. At least, that's how the power brokers are going to justify it.

Yet, would governments at some point decide the best approach would be to regulate the market for exploits? Maybe trying derail it? Chris Borgen wrote about the issues of regulating the purchase of these 0-day exploits, and it's a fascinating read. He goes through a history of how governments got involved in the trade and how they are using the exploits. But then he gets into how some regulators are trying to figure out how to regulate the sale of these munitions, given that evil regimes can buy 0-days and wreak havoc. OK, maybe not havoc, but can certainly cause heartburn.

Chris' points revolve around the perverse incentives developing on the regulatory front. Initially, there was a disincentive to regulating the exploits, since governments like to buy things out of the public (and regulators') visibility. But as these governments continue to invest in their own research capabilities to develop their own attacks, the need for externally sourced exploits wanes. At that point, they may be more interested in regulation, if only to take these alternative sources of exploits, potentially selling exploits to adversaries, out of play. Or at least make it harder for them to do business. So Chris hopes for no regulation because he wants to "keep the world safe for exploits." Yes, it's very counterintuitive, but so is most of the security business.

Personally, I don't think regulatory efforts on 0-day attacks will go very far because folks are equating software code to free speech -- even code intended to steal something from you. You have to love lawyers. But all the same, even if something does get passed to regulate and/or try to prevent the sale of exploits, exploits will still be sold, most likely to the governments that have regulated their sale. Yes, that's a pretty cynical way of looking at things, but it's reality. There was a market for exploits before any regulation, and there will be a market should any regulation come into play.

If you don't believe it, just bust out your history books and go back to the 1920s. The U.S. government banned the sale of alcohol during Prohibition, but it certainly didn't stop the production or consumption of alcohol. What it did was create a thriving black market for booze. How does this situation end any differently? Yeah, it probably doesn't.