Feeds

Firm offers to patent security fixes

Cash from chaos

The Power of One eBook: Top reasons to choose HP BladeSystem

The market for software vulnerabilities just got even more complex with the arrival of a firm that offers security researchers a chance to profit from their work by patenting security fixes.

Intellectual Weapons offers a revenue split with researchers who embark on what it admits is an ambitious strategy. It claims rival schemes offer only a fraction of the income its approach, which it defends as ethical, offers.

Any old flaw

Schemes such as iDefense's Vulnerability Contributor Program and 3Com's Zero-Day Initiative offer flaw finders a chance to get paid for their work. In return, security firms get the chance to add protection for upcoming flaws to their products, a useful "value-add" in the highly competitive security tools marketplace. Payments vary but tend to max out at around $10,000.

For flaw finders with the right contacts, sales to government agencies might fetch as much as $50,000 or more, depending on the vulnerability. Selling flaws direct to hackers through the underground black market in flaws offers an even greater potential (albeit illicit) reward.

Governments, much less black-hat hackers, are unlikely to disclose vulnerabilities to suppliers since the value of flaws to them is measured by their longevity and effectiveness as a tool to break into systems.

Weapons of flaw

IP property outfit Intellectual Weapons works with researchers to obtain and enforce patents relating to fixes for security vulnerabilities. The scheme works by attempting to license the fix to suppliers of vulnerable products, their competitors, and vulnerability protection firms.

Intellectual Weapons said it fully expects "major battles" in enforcing its IP, which is just as well since the firm's business plan puts it toe to toe with Microsoft's formidable team of lawyers. Security researchers need perseverance in order to stand a chance of scoring half the revenues from licensing offered by the firm.

Security researchers approaching Intellectual Weapons need to have big cajones, the firm advises. Intellectual Weapons said it developed an approach to streamlining the patent application and licensing process, but admits it is still far from straightforward.

"If this sounds too daunting, you are free to give your discoveries to your employer, help vendors secure their products for free, show off to your friends, grovel for security jobs, or sell your raw discoveries to middlemen for a fraction of their true value. We only want people who dare to play for high stakes," it said.

Intellectual Weapons is only interested in original vulnerabilities, discovered without resorting to illegality. Its preference is for security fixes that are difficult to "design around" and innovative, such that it's more likely to be granted a speedy patent. Technical elegance or other more general security imperatives don't really come into it.

The firm quotes examples of smaller firms who've come ahead of IT giants in patent fights to support its business model, which it claims is more akin to traditional "responsible disclosure" than the "patent trolls" its detractors might compare it to. The firm is yet to come up with examples of its own.

More about the firm can be found here. ®

Designing a Defense for Mobile Applications

More from The Register

next story
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.