Feeds

Firm offers to patent security fixes

Cash from chaos

Protecting against web application threats using SSL

The market for software vulnerabilities just got even more complex with the arrival of a firm that offers security researchers a chance to profit from their work by patenting security fixes.

Intellectual Weapons offers a revenue split with researchers who embark on what it admits is an ambitious strategy. It claims rival schemes offer only a fraction of the income its approach, which it defends as ethical, offers.

Any old flaw

Schemes such as iDefense's Vulnerability Contributor Program and 3Com's Zero-Day Initiative offer flaw finders a chance to get paid for their work. In return, security firms get the chance to add protection for upcoming flaws to their products, a useful "value-add" in the highly competitive security tools marketplace. Payments vary but tend to max out at around $10,000.

For flaw finders with the right contacts, sales to government agencies might fetch as much as $50,000 or more, depending on the vulnerability. Selling flaws direct to hackers through the underground black market in flaws offers an even greater potential (albeit illicit) reward.

Governments, much less black-hat hackers, are unlikely to disclose vulnerabilities to suppliers since the value of flaws to them is measured by their longevity and effectiveness as a tool to break into systems.

Weapons of flaw

IP property outfit Intellectual Weapons works with researchers to obtain and enforce patents relating to fixes for security vulnerabilities. The scheme works by attempting to license the fix to suppliers of vulnerable products, their competitors, and vulnerability protection firms.

Intellectual Weapons said it fully expects "major battles" in enforcing its IP, which is just as well since the firm's business plan puts it toe to toe with Microsoft's formidable team of lawyers. Security researchers need perseverance in order to stand a chance of scoring half the revenues from licensing offered by the firm.

Security researchers approaching Intellectual Weapons need to have big cajones, the firm advises. Intellectual Weapons said it developed an approach to streamlining the patent application and licensing process, but admits it is still far from straightforward.

"If this sounds too daunting, you are free to give your discoveries to your employer, help vendors secure their products for free, show off to your friends, grovel for security jobs, or sell your raw discoveries to middlemen for a fraction of their true value. We only want people who dare to play for high stakes," it said.

Intellectual Weapons is only interested in original vulnerabilities, discovered without resorting to illegality. Its preference is for security fixes that are difficult to "design around" and innovative, such that it's more likely to be granted a speedy patent. Technical elegance or other more general security imperatives don't really come into it.

The firm quotes examples of smaller firms who've come ahead of IT giants in patent fights to support its business model, which it claims is more akin to traditional "responsible disclosure" than the "patent trolls" its detractors might compare it to. The firm is yet to come up with examples of its own.

More about the firm can be found here. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.