// Workers AI · dad joke modeWhat did WabiSabiLabi say to its date? "You're imperfectly perfect for me.
| Type | Online marketplace |
|---|---|
| Industry | Cybersecurity |
| Founded | July 2007[1][2] |
| Founder | Roberto Preatoni |
| Headquarters | , Switzerland[1] |
| Key people | Herman Zampariolo (chief executive) Roberto Preatoni (director of strategy)[1][2] |
| Products | Vulnerability marketplace OneShield unified threat management appliances[3] |
WabiSabiLabi or WSLabi was an online marketplace selling computer exploits in an auction format. The company claimed that security researchers who disclosed vulnerabilities to software vendors would be more fairly compensated for their work by selling on the trusted platform.[4] However, only a year after opening the marketplace, the company was considering shutting it down due to lack of paying customers. The company was considering moving to a subscription service to more adequately compensate security researchers.[5] Customers who purchased exploits included the companies Verisign and 3Com.[2] Founded in July 2007, a cofounder was arrested on spying charges in November of that same year.[6][2][7]
Background
[edit]By the middle of the 2000s a commercial market in undisclosed software flaws had taken shape around a handful of intermediaries, and independent researchers had little basis on which to value what they found.[1] Paying outside researchers for vulnerability reports was pioneered by iDefense and subsequently adopted by firms including Immunity and 3Com's TippingPoint division, with payments that tended to reach a ceiling of around US$10,000; sales to government agencies were reported to fetch $50,000 or more, and the criminal market more still.[8][1] The researcher Charlie Miller, in a paper given at the Workshop on the Economics of Information Security, described finding an exploitable flaw in Samba in 2005, asking $80,000 for it and eventually selling it to an unnamed government agency for $50,000 without learning what it was used for.[1]
These arrangements were themselves disputed. Critics of iDefense's Vulnerability Contributor Program argued that the identity of an anonymous seller could not be established and that information could not be controlled once it passed to a third party. Comparable objections were raised to TippingPoint's Zero Day Initiative, while both companies pointed to their vetting procedures.[9]
The Zero Day Initiative passed its purchases to vendors at once, whereas brokers such as Netragard and Immunity did not always do so, since disclosure reduced the value of what they had acquired.[1]
Launch and business model
[edit]WabiSabiLabi Ltd., based in Chiasso, Switzerland, opened its marketplace to trading in the first week of July 2007.[1][10] The company, which also operated under the name WSLabi, presented itself as a neutral, vendor-independent Swiss laboratory.[10] According to Forbes, its name joined a Japanese term for imperfection to a German abbreviation for laboratory.[1] Although several firms already bought vulnerability research privately, contemporary reports described WabiSabiLabi as the first open marketplace for it.[9][2]
Registered researchers submitted their findings to the company, which verified them in its own laboratories and packaged them with proof-of-concept code before listing.[8][9][10] A seller could opt for an auction with a predetermined starting price, a fixed price open to as many buyers as wished to pay it, or an exclusive sale to one buyer; the platform also provided Dutch auctions, a "Buy Now" facility and a set running time for each lot.[8][9][10] Zampariolo said the company would advise sellers on format and starting price, and that research fetching $300 to $1,000 in an exclusive sale to a single company might realise ten to twenty times as much through the portal.[9][10]
Both parties were required to identify themselves to the company, though transactions could be conducted under pseudonyms, and personal data was kept on a separate system from the technical details of the vulnerabilities.[8][9] Prospective buyers were screened; the company said the checks covered convictions for computer crime and included matching the identity documents supplied against bank account details.[1][11] Dark Reading reported that the procedure was not otherwise set out and that in practice it consisted of a telephone number and a faxed copy of an identity card.[10] Material derived from an illegal source or activity was not accepted, but The Register remarked that it was unclear how the rule would be enforced, and Dark Reading noted that the company did not say whose law defined illegality, a point given weight by legislation recently adopted in Germany against unauthorised access to computers.[8][10]
Use of the marketplace was announced as free to researchers and buyers alike for its first six months, after which a commission of 10 per cent was to be introduced.[8][1] By late September 2007 Dark Reading described the 10 per cent commission as already being deducted from each sale, and reported that the company also ran a vulnerability database as a separate service.[11]
The company's case for the marketplace rested on a rejection of unpaid disclosure. Its founders held that the convention of ethical disclosure had long been turned to the advantage of vendors and security suppliers, who obtained the results of independent research at no cost, and drew a comparison with pharmaceutical research, where no equivalent expectation applied; the site accordingly adopted what it called a not-for-free-disclosure policy, publishing only enough about each lot to convey the nature of the problem without technical particulars.[10] Preatoni put the same argument more bluntly, saying researchers were told that being ethical meant giving their findings away and that this amounted to blackmail.[1] In a statement issued at the launch, Zampariolo set the little over 7,000 publicly disclosed vulnerabilities analysed during the previous year against an estimate that as many as 139,362 might be present in code each year, and said the marketplace would allow researchers to obtain a fair price instead of surrendering their findings for nothing or selling them to criminals.[8][9][10] He added that few researchers were prepared to report what they found, for fear of being taken advantage of.[9]
Four lots were on offer when trading opened. They included a memory leak in the Linux kernel starting at 500 euros and an unpatched buffer overflow in Yahoo! Messenger 8.1 with a minimum bid of 2,000 euros, the listing for which stated that it could be exploited remotely by anyone in the victim's address book, with some interaction from the victim required.[10][1][9]
Operations
[edit]Within the first days of trading the site had drawn 34,000 unique visitors, a small proportion of them from the United States military, according to Zampariolo.[1] Preatoni later said the most frequent visitors were, in order, Cisco, Microsoft, IBM, Veritas, Symantec, F-Secure, the United States Army, Oracle, VeriSign and SAP.[11]
By the end of September 2007, the company reported more than 1,000 subscriptions and 128 vulnerabilities received, of which eight had been traded through the site. Fifteen were listed at that point, none of which had attracted a bid. Completed sales of zero-day flaws and accompanying proof-of-concept code had ranged from a few hundred euros to 5,000 euros. Buyers were security companies, while sellers were either security companies or independent researchers.[11]
In mid-October the company said it had received more than 150 submissions in its first two months and registered about 1,000 sellers, with asking prices between 100 and 15,000 euros. Among the vulnerabilities listed were 51 affecting Windows, 29 in web applications, 19 in Linux, 10 in enterprise software from SAP, two relating to Mac systems and one concerning IBM. Forty submissions had been turned down, on grounds including the use of what the company termed illegal methodology, such as reverse engineering of protected software; previously published vulnerabilities and flaws in bespoke software were also ineligible. The company stated that about two-thirds of submissions cleared its vetting.[12]
In September 2007 Preatoni outlined plans extending beyond the auction. The company intended to build a hardware intrusion detection system drawing on the zero-day signatures accumulated through the marketplace, paying researchers on a continuing basis when their discoveries entered the database, an undertaking he estimated would require about two years; it also intended to open the platform to intellectual property other than security research, and was in discussion with an unnamed security research company about marketing products through the site.[13]
In late September 2007, WabiSabiLabi was among the outside parties invited to Blue Hat, Microsoft's twice-yearly closed meeting in Redmond, Washington, between external researchers and the company's own staff; other speakers at that session came from IOActive, SPI Dynamics, Coseinc, Leviathan and Sabre Security, alongside Symantec, Sourcefire and TippingPoint. Dark Reading described the invitation as the most unexpected on the list. Preatoni said he had been somewhat surprised to be asked, that he had used the occasion to explain how the site worked and to correct what he saw as misconceptions about it, and that the reception had been largely favourable.[11]
Reception
[edit]The marketplace was contentious from the outset and was widely expected to revive argument over how flaws should be disclosed.[9][10] Critics objected that it turned vulnerability research into a commodity sold to whoever bid highest, that the eventual use of a purchased flaw could not be established, and that many large software companies declined on principle to buy vulnerabilities at all.[11]
Robert Hansen, chief executive of SecTheory, said his chief concern was the difficulty of telling a legitimate buyer from one intending to misuse what he bought, adding that the largest software companies had repeatedly said they would not purchase vulnerabilities.[10] Eric Maiwald, a senior analyst at the Burton Group, considered the venture irresponsible, arguing that flaws already known to some would now become available to people who had previously had no means of obtaining them, and that the disclosure debate scarcely needed further fuel.[9] David Dewey, team manager at IBM's X-Force research group, called the purchase of flaws a false economy even when the intention was to report them: in his view those willing to sell to the highest bidder would always do so, those motivated by principle were unmoved by payment, and a bounty could therefore influence only the researchers between the two.[1]
Responses were not uniformly hostile. Jeremiah Grossman, chief technology officer of WhiteHat Security, said it was the first auction implementation he had seen and that a small number of successful transactions might substantially change how the disclosure process was understood, and he expected a number of researchers to try it.[10] Preatoni, the company's director of strategy, maintained that the volume of research reaching the marketplace showed it was serving as a lawful outlet, steering findings away from illegal use and providing researchers with regular and legitimate income.[12]
Arrest of Roberto Preatoni
[edit]On 5 November 2007, Preatoni was among those arrested by police in Milan in connection with a long-running investigation into spying at Telecom Italia, and was charged with unauthorised access to computer systems and with wiretapping.[2][14] A company representative confirmed that the person held was WabiSabiLabi's founder but declined to comment further, and the marketplace continued to operate in his absence.[2][14] He had spoken at Microsoft's Blue Hat meeting a few weeks earlier.[2]
The case concerned Preatoni's earlier work as a penetration tester and had no bearing on his activities at WabiSabiLabi.[2][14] According to reports in the Italian press, he had been one of ten members of a team ostensibly engaged to test Telecom Italia's information security, whose members were accused of intercepting communications and gaining unauthorised access to systems belonging to Carla Cico, chief executive of Brasil Telecom, the investigations firm Kroll, and two journalists at the newspaper Libero.[2][14] Four people had been charged in the same affair in January 2007, among them Telecom Italia's security chief technology officer and its former head of security.[2][14] Stefano Zanero, a security consultant in Milan, described the affair as politically charged and difficult to assess from the outside.[2]
Preatoni was questioned for several days and released after an application to the court reviewing his detention.[15] Writing publicly in April 2008, he said he had spent the intervening months weighing whether his continued involvement was good for the company and whether he should go on representing it in public, and concluded that he would remain, confirming that he would appear for the firm at a security conference in South Africa the following month.[15]
Decline
[edit]By October 2008 the marketplace had failed to establish itself. Preatoni said that researchers had recognised the value of such a site but that very few buyers had been willing to use it, remarking that it had not worked well and had come too early; no final decision on its future had then been taken.[3]
The company turned instead to OneShield, a line of unified threat management appliances developed with the Italian firm Eurotech. Purchasers were to pay a monthly subscription for access to the company's existing library of zero-day signatures, to which new signatures would be added as they were acquired, and the subscription revenue was to be shared with researchers in the form of monthly royalties – an arrangement Preatoni presented as another way for independent researchers to make a living from their work. Prices for the appliances and the subscription were not disclosed; distributors had been secured in North America and Europe, and the company was seeking one in Asia.[3] Writing in 2014, Algarni and Malaiya referred to WabiSabiLabi as a vulnerability auction site that had been active some years earlier.[16]
See also
[edit]- Zone-H, website defacement database also created by Roberto Preatoni
- TheRealDeal
References
[edit]- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Greenberg, Andy (9 July 2007). "A Hacker's Nasdaq". Forbes. Archived from the original on 25 June 2021. Retrieved 17 September 2026.
- 1 2 3 4 5 6 7 8 9 10 11 12 McMillan, Robert (2007-11-06). "WabiSabiLabi founder arrested in Italy". Computerworld. Retrieved 2022-03-29.
- 1 2 3 Lemon, Sumner (29 October 2008). "WabiSabiLabi may close 0day auction site". InfoWorld. Retrieved 18 September 2026.
- ↑ Lemon, Sumner (2007-09-25). "WabiSabi Labi aims to be more than an eBay for zero-days". Computerworld. Retrieved 2022-03-29.
- ↑ Lemon, Sumner (10 October 2008). "WabiSabiLabi may close 0day auction site". NetworkWorld. Archived from the original on 2 Dec 2008. Retrieved 28 March 2022.
- ↑ "News: WabiSabiLabi launches vulnerability market". Network Security. 2007 (8): 1–2. 2007-08-01. doi:10.1016/S1353-4858(07)70068-5. ISSN 1353-4858.
- ↑ "eBay-like marketplace for vulnerability exchange opens - SC Magazine US". 2008-08-30. Archived from the original on 30 August 2008. Retrieved 2022-03-29.
- 1 2 3 4 5 6 7 Leyden, John (6 July 2007). "Security flaw marketplace lays out its wares". The Register. Retrieved 17 September 2026.
- 1 2 3 4 5 6 7 8 9 10 11 Brenner, Bill (6 July 2007). "Zero-day auction site opened by Swiss lab". Computer Weekly. Retrieved 17 September 2026.
- 1 2 3 4 5 6 7 8 9 10 11 12 13 Wilson, Tim (5 July 2007). "An Auction Site for Vulnerabilities". Dark Reading. Retrieved 17 September 2026.
- 1 2 3 4 5 6 Higgins, Kelly Jackson (28 September 2007). "Microsofties Check Out Vulnerability Auction Site at Blue Hat". Dark Reading. Archived from the original on 7 June 2023. Retrieved 17 September 2026.
- 1 2 Leyden, John (12 October 2007). "Security vuln auction site pulls in research". The Register. Retrieved 18 September 2026.
- ↑ Lemon, Sumner (25 September 2007). "WabiSabi Labi aims to be more than an eBay for zero-days". InfoWorld. Retrieved 18 September 2026.
- 1 2 3 4 5 Leyden, John (8 November 2007). "Security researcher cuffed in Telecom Italia spying probe". The Register. Retrieved 18 September 2026.
- 1 2 Leyden, John (14 April 2008). "Preatoni breaks silence over Telecom Italia spying probe". The Register. Retrieved 18 September 2026.
- ↑ Algarni, Abdullah; Malaiya, Yashwant (2014). "Software Vulnerability Markets: Discoverers and Buyers". Retrieved 17 September 2026.