WabiSabiLabi may close 0day auction site

WabiSabiLabi may shut down its online marketplace for security vulnerabilities, focusing instead on the line of OneShield unified threat management (UTM) appliances it developed with Italian defense company EuroTech.

Last year, WabiSabiLabi opened an online auction site for unpatched security vulnerabilities, also called 0days. The company's stated aim was to provide a market that would allow independent security researchers to earn a living from the vulnerabilities they discover. To prevent vulnerabilities from ending up in the hands of criminals, only qualified buyers are permitted to use the WabiSabiLabi auction site.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

While security companies routinely pay researchers for vulnerabilities and then keep this information under wraps, some believe researchers should first disclose such vulnerabilities to vendors free and, when a patch is released, make details of the vulnerability publicly available, a practice known in the security community as ethical disclosure.

In the end, security researchers recognized the value of having an auction site like WabiSabiLabi, but very few buyers proved willing to use the site, said Roberto Preatoni, an Italian security consultant and WabiSabiLabi's director of strategy, in an interview at the Hack In The Box security conference in Kuala Lumpur, Malaysia.

"It didn't work very well. The marketplace was too far ahead of its time," he said, adding that a final decision on the fate of the marketplace has yet to be reached.

Preatoni believes the OneShield UTM appliances, designed to defend networks from attack, can provide an alternative way for independent researchers to earn a living from their work. Customers who purchase a OneShield device will pay a monthly subscription fee for access to WabiSabiLabi's existing library of 0day signatures, and new signatures will be continually added as they are discovered.

The subscription revenue will be shared with security researchers, who will earn a monthly royalty for their discoveries, Preatoni said. Pricing of the OneShield appliances and the cost of the monthly subscription were not immediately available.

Nevertheless, the line of security appliances, which Preatoni first discussed in an interview last year, are close to commercial release, with samples already available. OneShield has found distributors for the appliances in North America and Europe and is looking for one in Asia, he said.