Bot wars: the spammers strike back

✍ Scribed by Paul Wood

• Publisher: Elsevier Science
• Year: 2010
• Tongue: English
• Weight: 389 KB
• Volume: 2010
• Category: Article
• ISSN: 1353-4858
• DOI: 10.1016/s1353-4858(10)70044-1

✦ Synopsis

We have seen a dramatic shift in recent years in the way vendors are working with 'white hat' researchers. For the first time, every vendor represented on our Pwn2Own target list was in attendance. This shows that these vendors are committed to securing their products and co-operating with programs such as the ZDI.

"It would be a mistake to think that any browser is infallible"

This collaboration is mirrored within our Zero Day Initiative program on a daily basis. The vendors realise the value these very talented researchers can provide. By working with trusted programs such as the ZDI, the vendors are getting solid, vetted information on the vulnerabilities in their software so they can fix them quickly -often before they are independently discovered by individuals with nefarious intent.

Even after the contest, Apple and Microsoft issued out-of-band security patch updates. Mozilla has already patched the vulnerability discovered by Nils at Pwn2Own -within a week of the contest. Apple is scheduled to patch Charlie Miller's bug next week.

All of this shows commitment from the vendors to keep these things a priority, especially in the scrutinising public eye. It is a good thing for the industry as a whole.