Last year, WabiSabiLabi opened an online auction site for unpatched security vulnerabilities, also called 0days. The company's stated aim was to provide a market that would allow independent security researchers to earn a living from the vulnerabilities they discover. To prevent vulnerabilities from ending up in the hands of criminals, only qualified buyers are permitted to use the WabiSabiLabi auction site.
While security companies routinely pay researchers for vulnerabilities and then keep this information under wraps, some believe researchers should first disclose such vulnerabilities to vendors free and, when a patch is released, make details of the vulnerability publicly available, a practice known in the security community as ethical disclosure.
In the end, security researchers recognized the value of having an auction site like WabiSabiLabi, but very few buyers proved willing to use the site, said Roberto Preatoni, an Italian security consultant and WabiSabiLabi's director of strategy, in an interview at the security conference in Kuala Lumpur, Malaysia.
"It didn't work very well. The marketplace was too far ahead of its time," he said, adding that a final decision on the fate of the marketplace has yet to be reached.
Preatoni believes the UTM appliances, designed to defend networks from attack, can provide an alternative way for independent researchers to earn a living from their work. Customers who purchase a OneShield device will pay a monthly subscription fee for access to WabiSabiLabi's existing library of 0day signatures, and new signatures will be continually added as they are discovered.