Vulnerability Black Markets: Empirical evidence and scenario simulation

Proceedings of the 42nd Annual Hawaii International Conference on System Sciences, HICSS

Volumn , Issue , 2009, Pages

  Radianti, Jaziar ^a   Rich, Eliot ^b   Gonzalez, Jose J ^a  

^a UNIVERSITY OF AGDER   (Norway)

^b STATE UNIVERSITY OF NEW YORK   (United States)

Author keywords

Black markets; Masked observation; Simulation; Software vulnerability; System dynamics

Indexed keywords

BLACK MARKETS; MASKED OBSERVATION; SIMULATION; SOFTWARE VULNERABILITY; SYSTEM DYNAMICS;

DYNAMICS; INDUSTRIAL ECONOMICS; MARKETING;

COMPUTER SOFTWARE;

EID: 63349111065     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HICSS.2009.504     Document Type: Conference Paper

References (28)

1. Hoglund, G. and G. McGraw, Exploiting Software: How to Break Code. 2004, Boston: Addison-Wesley.
2. IBM. IBM Internet Security Systems X-Force 2006 Trend Statistics. 2007 January [cited; Available from: http://www.iss.net/documents/whitepapers/X- Force-Exec-Brief.pdf.
3. PandaLabs. Quarterly Report PandaLabs. 2007 July 15, 2007 [cited 2007 12 September]; April-June 2007:[Available from: http://www.pandasecurity. com/.
4. Symantec, Symantec Global Internet Threat Report: Trend for July - Dec 07. 2008.
5. Finjan Inc. Web Security Trends Report. 2006 [cited 2006 September 20]; Available from: http://www.finjan.com/Content.aspx?id=827.
6. Clinard, M.B., The Black Market: A Study of White Collar Crime. 1969, Montclair, New Jersey: Patterson Smith.
7. Radianti, J. and J.J. Gonzalez. a Preliminary Model of The Vulnerability Black Market. In the 25th International System Dynamics Conference 2007. Boston, USA.
8. Ozment, A. Bugs Auctions: Vulnerability Market Reconsidered. In Workshop of Economics and Information Security (WEIS). 2004. Mineapolis, MN.
9. Böhme, R. A Comparison of Market Approaches to Software Vulnerability Disclosure. In International Conference, ETRICS 2006, LNCS 3995 2006. Freiburg, Germany: Springer-Verlag Berlin Heidelberg.
10. Miller, C. The Legitimate Vulnerability Market: the Secretive World of 0-day Exploit Sales. In Workshop on Economics of Information Security. 2007. Pittsburgh, USA.
11. Sutton, M. and F. Nagle. Emerging Economic Models for Vulnerability Research. In The Fifth Workshop on the Economics of Information Security (WEIS). 2006. Robinson College, University of Cambridge, England.
12. Naraine, R. Researcher: WMF Exploit Sold Underground for $4,000 2006 [cited 2007 September 15]; Available from: http://www.eweek.com/article2/0,1895,1918198,00.asp.
13. Naraine, R. Hackers Selling Vista Zero-Day Exploit. 2006 [cited 2007 June 2]; Available from: http://www.eweek.com/ print-article2/0,1217,a= 196573,00.asp.
14. Naraine, R. Price War: iDefense Doubles Bounty for Security Flaws 2005 [cited 2007 April 28]; Available from: http://www.eweek.com/article2/0, 1895,1841268,00.asp.
15. Schechter, S. How to Buy Better Testing: Using Competition to Get The Most Security and Robustness for Your Dollar. In Infrastructures Security Conference. 2002. Bristol, UK.
16. Kaplan, D. Threats for $ale. SC Magazine 2006 [cited 2006 August 4]; Available from: www.scmagazine.com/us/news/ article/556843/threats- ale/.
17. Franklin, J., et al. An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants. In 14 th ACM Conference on Computer and Communications Security (CCS). 2007. Alexandria, VA, USA.
18. Zhuge, J., et al. Studying Malicious Websites and the Underground Economy on the Chinese Website. Honeyblog 2007 [cited 2008 February 25]; Available from: http://honeyblog.org/archives/2007/12/summary.html.
19. Akerlof, G.A., The Market for "Lemons": Quality Uncertainty and Market Mechanism. The Quarterly Journal of Economics, 1970. 84(3): p. 488-500.
20. Radianti, J., E. Rich, and J.J. Gonzalez. Using Mixed Data Collection to Uncover Vulnerability Black Markets. In Workshop of Information Security and Privacy. 2007. Quebec, Canada.
21. Luna-Reyes, L.F. and D.L. Andersen, Collecting and analyzing qualitative data for system dynamics: methods and models. System Dynamics Review, 2003. 19(4): p. 271-296.
22. Gross, G. Internet Currency Firm Pleads Guilty to Money Laundering. PCWorld 2008 [cited 2008 July 23]; Available from: http://www.pcworld.com/businesscenter/article/ 148720/internet-currency-firm- pleads-guilty-to-money-laundering.html.
23. Higgins, K.J. Bucks for Bugs. 2006 [cited 2007 July 20]; Available from: http://www.darkreading.com/document.asp?doc-id=99518.
24. Landesman, M. Malware Revolution: A Change in Target. 2007 [cited 2007 April 10]; Available from: http://www.microsoft.com/technet/community/ columns/secm gmt/sm0307.mspx.
25. Richardson, G.P. and D.F. Andersen, Teamwork in Group Model Building. System Dynamics Review, 1995. 11(2): p. 113-137.
26. Sterman, J.D., Business Dynamics: Systems Thinking and Modeling for a Complex World. 2000, Boston: Irwin/McGraw-Hill.
27. Kim, D.H., Introduction to Systems Thinking, in Innovations in Management Series. 1999, Pegasus Communications: Waltham, MA.
28. Senge, P.M., The fifth discipline : the art and practice of the learning organization. 1st ed. 1990, New York: Doubleday/Currency.