Gartner: Hack contests bad for business

[caveman-jim]

A pair of Gartner analysts denounced a recent hack challenge that uncovered a still-unpatched QuickTime bug, calling it "a risky endeavor" and urging sponsors to reconsider such public contests.

The research manager of TippingPoint, the company that paid $10,000 for the QuickTime vulnerability and its associated exploit, rebutted by saying that at no time was there any danger of the vulnerability escaping from responsible parties.

Dino Dai Zovi was the first to hack a MacBook Pro at CanSecWest, a Vancouver security conference held two weeks ago. For his trouble, Dai Zovi took home the $10,000 prize offered by TippingPoint's Zero Day Initiative, a bug bounty program that's been in operation nearly two years.

Security researchers have called the QuickTime bug, which can be exploited through any Java-enabled browser, "very serious." Apple Inc. has yet to patch, or announce when it will patch, the vulnerability.

Read more overreaction at ComputerWorld

[Nocturne]

Whatever happened to the exploit of safari (seemed a lot more important to me)? I'm sure the only reason why they didn't award that one is because it is specifically targetting just Apple systems.

These contests are crucial to maintaining development on fixing security exploits. Most often, the initial programmers made the mistake once, so they'll most likely make it again. Furthermore, independent hackers are usually the first the find the exploits, and it's certainly better to bribe them to give it up than have them use the exploits to make money in more fraudulent ways.

I think the most important thing is that this has shattered the ridiculous notion that apple's software is always secure. Almost reminds me of when Cisco (think it was them) claimed their new system couldn't be hacked, and it was a matter of hours before they were proved wrong.

[SirBaron]

^ QFT

Not only that if these exploits become more known to alot of people. It forces the company to fix the issue, otherwise it will of gone unnoticed except by a few of the hackers using it, with free reign.