Feeds

Firm offers to patent security fixes

Cash from chaos

Intelligent flash storage arrays

The market for software vulnerabilities just got even more complex with the arrival of a firm that offers security researchers a chance to profit from their work by patenting security fixes.

Intellectual Weapons offers a revenue split with researchers who embark on what it admits is an ambitious strategy. It claims rival schemes offer only a fraction of the income its approach, which it defends as ethical, offers.

Any old flaw

Schemes such as iDefense's Vulnerability Contributor Program and 3Com's Zero-Day Initiative offer flaw finders a chance to get paid for their work. In return, security firms get the chance to add protection for upcoming flaws to their products, a useful "value-add" in the highly competitive security tools marketplace. Payments vary but tend to max out at around $10,000.

For flaw finders with the right contacts, sales to government agencies might fetch as much as $50,000 or more, depending on the vulnerability. Selling flaws direct to hackers through the underground black market in flaws offers an even greater potential (albeit illicit) reward.

Governments, much less black-hat hackers, are unlikely to disclose vulnerabilities to suppliers since the value of flaws to them is measured by their longevity and effectiveness as a tool to break into systems.

Weapons of flaw

IP property outfit Intellectual Weapons works with researchers to obtain and enforce patents relating to fixes for security vulnerabilities. The scheme works by attempting to license the fix to suppliers of vulnerable products, their competitors, and vulnerability protection firms.

Intellectual Weapons said it fully expects "major battles" in enforcing its IP, which is just as well since the firm's business plan puts it toe to toe with Microsoft's formidable team of lawyers. Security researchers need perseverance in order to stand a chance of scoring half the revenues from licensing offered by the firm.

Security researchers approaching Intellectual Weapons need to have big cajones, the firm advises. Intellectual Weapons said it developed an approach to streamlining the patent application and licensing process, but admits it is still far from straightforward.

"If this sounds too daunting, you are free to give your discoveries to your employer, help vendors secure their products for free, show off to your friends, grovel for security jobs, or sell your raw discoveries to middlemen for a fraction of their true value. We only want people who dare to play for high stakes," it said.

Intellectual Weapons is only interested in original vulnerabilities, discovered without resorting to illegality. Its preference is for security fixes that are difficult to "design around" and innovative, such that it's more likely to be granted a speedy patent. Technical elegance or other more general security imperatives don't really come into it.

The firm quotes examples of smaller firms who've come ahead of IT giants in patent fights to support its business model, which it claims is more akin to traditional "responsible disclosure" than the "patent trolls" its detractors might compare it to. The firm is yet to come up with examples of its own.

More about the firm can be found here. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.