WabiSabiLabi

» see wslabi.com as it lived, on the wayback machine

~ the last words ~

Four lots were on the board when trading opened in the first week of July 2007. One was a memory leak in the Linux kernel with a 500 euro starting price. One was an unpatched buffer overflow in Yahoo! Messenger 8.1, minimum bid 2,000 euros, listed with the note that anyone in the victim's address book could fire it remotely given a little cooperation from the victim. That was the shop window.

WabiSabiLabi Ltd was registered in Chiasso, a Swiss town that sits directly on the Italian border, and also traded as WSLabi. Forbes worked out that the name welded a Japanese term for imperfection onto a German abbreviation for laboratory. Herman Zampariolo was chief executive. Roberto Preatoni, who had already built the defacement archive Zone-H, was director of strategy and the louder of the two in public.

The argument underneath it was not new, but nobody had built a storefront on it before. Companies had been quietly buying vulnerability reports for years through iDefense and 3Com's TippingPoint, with payouts that mostly topped out near ten thousand dollars, while the same research sold to a government agency fetched several times that. The founders' position was that the convention of giving findings to vendors for free was a transfer of value from the person who did the work to the company whose code was broken, and Preatoni put it in the harshest terms he could find: being told that ethical behavior means working for nothing is, he said, blackmail.

Visitors came fast. The site drew 34,000 unique visitors inside its first days, and Preatoni later named the most frequent ones in order, a list that opened with Cisco and Microsoft and included the United States Army. Buyers, as opposed to visitors, were another matter.

~ the record ~

~ how the auction worked ~

A registered researcher submitted a finding. The company verified it in its own lab and wrote up proof-of-concept code. The listing then carried only enough description to convey what kind of problem it was. A seller could pick a timed auction with a starting price or an exclusive sale to one buyer. There was also a fixed price open to as many buyers as wanted to pay it, along with Dutch auctions and a Buy Now button, which is a sentence about zero-day exploits that still looks wrong.

Both sides had to identify themselves to the company even though they could trade under pseudonyms. Buyers were screened for computer-crime convictions with their identity documents matched against bank details, and Dark Reading looked at how that worked in practice and found it amounted to a phone number and a faxed copy of an ID card. Material from an illegal source was refused, though The Register noted nobody had explained how that rule would be enforced, or whose law decided what illegal meant.

~ the numbers from the inside ~

By the end of September 2007 the company reported more than a thousand subscriptions and 128 vulnerabilities received, of which eight had been traded. Fifteen were listed at that moment and not one had attracted a bid. Completed sales ran from a few hundred euros to five thousand. In mid-October the submission count passed 150 and the seller count hit about a thousand, with asking prices between 100 and 15,000 euros, and the breakdown by platform had 51 Windows flaws against two for the Mac.

The shape was legible in those figures long before anyone at the company said so. Sellers arrived by the thousand while the bid column stayed empty. Eight completed sales in three months demonstrates that a mechanism works; it says nothing about whether anyone wants to use it.

This market had a few hundred real participants worldwide at most, split between vendors and professional researchers with budgets. The disclosure fight was something I read arguments about in 2007 without ever having standing in it, which was true of nearly everyone who held an opinion about it.

~ the arrest ~

On 5 November 2007, a few weeks after Microsoft had invited the company to its closed Blue Hat meeting in Redmond, Preatoni was arrested in Milan. The investigation was the long-running one into spying at Telecom Italia, and the charges were unauthorized access to computer systems and wiretapping. It concerned earlier work he had done as a penetration tester and had nothing to do with the marketplace, which kept running while he was held. He was questioned for several days and released after a detention review, and in April 2008 he wrote publicly that he had spent the months since weighing whether staying was good for the company, and had decided to stay.

~ what the site said when it was over ~

By October 2008 Preatoni was telling reporters the marketplace had not worked and had come too early, with no final decision taken. The company moved to a hardware line instead, a unified threat management appliance called OneShield built with the Italian firm Eurotech, sold on a subscription to the zero-day signature library the auction had accumulated, with monthly royalties going back to the researchers.

The archive dates the actual ending better than any press release. The marketplace application at wslabi.com was still returning pages on 22 January 2009, and by 12 October 2009 the same URLs were 404. In its place went one page of text, up by November 2009 and still sitting there in 2011, telling the story the way the company preferred to tell it. A perfect marketplace of software vulnerabilities, it said, was too forward looking for the imperfect world we live in, and the group had to stop trading its knowledge once controversy and legal threats arrived from competitors and other outside parties. Neither wslabi.com nor wabisabilabi.com resolves today.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »