Security Firm keeps an eye on the bottom line!

[gunug]

Apparently according to the Electronic Frontier Foundation and some research for Forbes magazine there are some computer security companies that aren't reporting open exploits to keep the money coming in:

QUOTE

France-based VUPEN is one of the highest-profile firms trafficking in zero-day exploits. Earlier this month at the CanSecWest information security conference, VUPEN declined to participate in the Google-sponsored Pwnium hacking competition, where security researchers were awarded up to $60,000 if they could defeat the Chrome browser’s security and then explain to Google how they did it. Instead, VUPEN—sitting feet away from Google engineers running the competition—successfully compromised Chrome, but then refused to disclose their method to Google to help fix the flaw and make the browser safer for users.

“We wouldn’t share this with Google for even $1 million,” said VUPEN founder Chaouki Bekrar. “We don’t want to give them any knowledge that can help them in fixing this exploit or other similar exploits. We want to keep this for our customers.” VUPEN, which also “pwned” Microsoft’s Internet Explorer, bragged it had an exploit for “every major browser,” as well as Microsoft Word, Adobe Reader, and the Google Android and Apple iOS operating systems.

https://www.eff.org/deeplinks/2012/03/zero-...security-debate

The Forbes article is here and will be in their April 9th issue:

http://www.forbes.com/sites/andygreenberg/...ix-figure-fees/

[Xairbusdriver]

So, who's the "Security Firm?" Certainly not VUPEN. It's firmly in the 'Security Avoidance and Destruction' category.

[krissel]

QUOTE

“Vupen is the Snooki of this industry,” says Soghoian. “They seek out publicity, and they don’t even realize that they lack all class. They’re the Jersey Shore of the exploit trade.”

[Paddy]

In a lot of other contexts, this would be blackmail.

I really don't know how some of these turkeys sleep at night.