If you're looking to reduce the pool of possible zero-day vulnerabilities that could potentially be used for criminal or state-sponsored breaches of computer and network security, throwing people and money at the problem isn't necessarily going to solve it. At least, that's the conclusion from a team of researchers at MIT, Harvard, and the security firm HackerOne (the organization that runs the Internet Bug Bounty program). At next week's RSA Conference, HackerOne Chief Policy Officer Katie Moussouris and Dr Michael Siegel of MIT's Sloan School will present a study on the economics of the marketplace for "zero-day" vulnerabilities in software and networks, showcasing a model for how that market behaves. Spoiler: their model isn't simply driven by supply and demand.

In a blog post today entitled "The Wolves of Vuln Street," Moussouris gave a summary of the team's findings of what it means for organizations and government agencies seeking to "dry up the offensive stockpile" of vulnerabilities available to would-be attackers. The crux is that bug bounty programs are valuable in uncovering vulnerabilities (especially in less mature software), but some vulnerabilities simply will never be for sale at a price that defenders can afford. The long-term solution, Moussouris suggested, is to pay for automated tools and techniques to help developers find the bugs themselves.

At last year's Black Hat conference in Las Vegas, Dan Geer—a computer security analyst and chief information security officer of the CIA-backed venture capital firm In-Q-Tel—suggested that the US government should simply corner the market on vulnerabilities, offering "six-figure prices" to compete with the black market for zero-days. Geer also said this approach would only work if vulnerabilities were scarce; if they are plentiful, there would be no amount of money that could possibly buy up all the potential attack vectors.

But in her post, Moussouris noted such an approach would also create an imbalance in the type of zero-day vulnerabilities turned in. If all the payoffs were the same, vulnerability hunters would focus on newer, less mature targets to find the easy fixes rather than targeting older, more stable platforms. And the easy money of bug bounties would pull developers away from where their talents were needed: fixing the bugs that got uncovered. "These potentially large payouts would create perverse incentives, especially for less mature software," she wrote. "After a short time, the only pool being drained would be the developer and tester talent pool, leaving their salaried jobs in order to live off their bounty earnings. Sell a couple bugs per year, and talented developers who can write fuzzers and determine which bugs are exploitable won’t need to work much harder to earn much higher paydays than any software maker could sustainably afford to pay them. Consequently, no one would be left to actually fix the bugs."

On top of that unintended consequence, some bugs would still never be put up for sale.

"Not all hackers are primarily motivated by money," Moussouris wrote. "Even those who sell to governments often do so selectively, intentionally choosing sides even if the 'other side' might pay them more money." Setting up a big payday system wouldn't create the incentives for them to change their behavior.

To understand what approach would work, Moussouris sought to find a way to maximize how many bugs could be caught that were already being discovered by zero-day researchers working for the offensive market. "The key to giving an edge to defense is not just to find and fix as many bugs as possible, but specifically to increase 'bug collisions' in finding the same vulnerabilities as the offense researchers have found and get them fixed," she wrote, citing Google's Project Zero initiative as an example. So Moussouris, Siegel, Dr. Ryan Ellis of Harvard's Kennedy School, and James Houghton at MIT created a system dynamics model of the zero-day market to find how different economic inputs affected the supply of offensive vulnerabilities.

In the end, the researchers found that bug bounties "are still effective to help find vulnerabilities faster, especially for less mature software," Moussouris said. But in the long term, the researchers believe that focusing on putting incentives on automated tools and approaches for discovering zero-day vulnerabilities was a more efficient approach "for defenders to drain the offense stockpile of 0day vulnerabilities."

It's no surprise that researchers in the penetration testing and "fuzzing" tool business would be pleased with these findings. In an e-mail to Ars, Rapid7 engineering manager Todd Beardsly wrote, "I'm glad to see the [Internet Bug Bounty] and HackerOne take a lead on guiding and focusing the exploit efforts of the 'good guys.' As a side effect of incentivizing researchers to teach each other how to fish, I feel like these efforts of the IBB will also help prioritize what kind of research is the most useful and fruitful, by making it easier to rediscover the secret vulnerabilities already being stockpiled today.”

Listing image by Alexandre Dulaunoy