Uploaded bya001
PDF, PPTX543 views

The Bazaar, the Maharaja’s Ultimatum, and the Shadow of the Future: Extortion and Cooperation in the Zero-day Market

The document discusses the complexities of the zero-day market, highlighting the challenges of trust, price fairness, and cooperation among participants. It outlines the dilemma faced by traders, where revealing vulnerabilities can lead to financial loss, and proposes solutions like trusted third parties and reputation systems. Additionally, it explores various trading scenarios and strategies, particularly focusing on the dynamics of cooperation and defection in this market.

Software◦
Related topics:
Game Theory•

Embed presentation

Download as PDF, PPTX
1 / 171
2 / 171
3 / 171
4 / 171
5 / 171
6 / 171
7 / 171
8 / 171
9 / 171
10 / 171
11 / 171
12 / 171
13 / 171
14 / 171
15 / 171
16 / 171
17 / 171
18 / 171
19 / 171
20 / 171
21 / 171
22 / 171
23 / 171
24 / 171
25 / 171
26 / 171
27 / 171
28 / 171
29 / 171
30 / 171
31 / 171
32 / 171
33 / 171
34 / 171
35 / 171
36 / 171
37 / 171
38 / 171
39 / 171
40 / 171
41 / 171
42 / 171
43 / 171
44 / 171
45 / 171
46 / 171
47 / 171
48 / 171
49 / 171
50 / 171
51 / 171
52 / 171
53 / 171
54 / 171
55 / 171
56 / 171
57 / 171
58 / 171
59 / 171
60 / 171
61 / 171
62 / 171
63 / 171
64 / 171
65 / 171
66 / 171
67 / 171
68 / 171
69 / 171
70 / 171
71 / 171
72 / 171
73 / 171
74 / 171
75 / 171
76 / 171
77 / 171
78 / 171
79 / 171
80 / 171
81 / 171
82 / 171
83 / 171
84 / 171
85 / 171
86 / 171
87 / 171
88 / 171
89 / 171
90 / 171
91 / 171
92 / 171
93 / 171
94 / 171
95 / 171
96 / 171
97 / 171
98 / 171
99 / 171
100 / 171
101 / 171
102 / 171
103 / 171
104 / 171
105 / 171
106 / 171
107 / 171
108 / 171
109 / 171
110 / 171
111 / 171
112 / 171
113 / 171
114 / 171
115 / 171
116 / 171
117 / 171
118 / 171
119 / 171
120 / 171
121 / 171
122 / 171
123 / 171
124 / 171
125 / 171
126 / 171
127 / 171
128 / 171
129 / 171
130 / 171
131 / 171
132 / 171
133 / 171
134 / 171
135 / 171
136 / 171
137 / 171
138 / 171
139 / 171
140 / 171
141 / 171
142 / 171
143 / 171
144 / 171
145 / 171
146 / 171
147 / 171
148 / 171
149 / 171
150 / 171
151 / 171
152 / 171
153 / 171
154 / 171
155 / 171
156 / 171
157 / 171
158 / 171
159 / 171
160 / 171
161 / 171
162 / 171
163 / 171
164 / 171
165 / 171
166 / 171
167 / 171
168 / 171
169 / 171
170 / 171
171 / 171
... The Bazaar, the Maharaja’s Ultimatum, and the Shadow of the Future: . Extortion and Cooperation in the Zero-day Market . Alfonso De Gregorio . Founder, BeeWise .. HITB GSEC, Singapore, October 12th-16th, 2015
.. Discuss . /me @secYOUre #0DayDilemma #HITBGSEC
.. Agenda . 1. The Zero-day Market A hairy business 2. Relevance Should I care? 3. The Zero-day Dilemma Extortion and Cooperation in the Zero-day Market 4. Recommendations to Zero-day traders How to maximize the payoff?
... The Zero-day Market . 1/119 TheZero-dayMarket
..
..
..
..
..
..
..
... Meet Ty
..
..
..
..
..
..
... Meanwhile...
..
..
..
..
..
..
..
..
..
..
..
.. Inherent obstacles . The Zero-day Market . 28/119 1. Time-sensitiveness of traded commodities 2. Trust 3. Price fairness 4. Possibility of defection
.. A hairy business . The Zero-day Market . 29/119 ..
.. The Legitimate Vulnerability Market . The Zero-day Market . 30/119 ..
.. Time-sensitive commodity . The Zero-day Market . 31/119 .. . Valuable only when they are not widely known . Value drops to zero, as soon as the vulnerability is disclosed or a mitigation is released . Transactions should complete in short times . Discretion required
... Every day can be the last day for a 0-day sale
.. Trust . The Zero-day Market . 33/119 .. . No centralized way to locate its players . Finding buyers and sellers is time-consuming . Unfamiliar business partners . Hard to verify intentions
... Oh, grandmother, what a horribly big mouth you have!
.. Lack of transparency and price fairness . The Zero-day Market . 35/119 .. . Adoption levels of the vulnerable component . Presence within a given attack surface . Level of authentication required to exploit it . Difficulty of independent rediscovery . Exploit reliability
... Difficult to measure
.. Tension . The Zero-day Market . 37/119 .. . Disclose and lose? . Proving without disclosing . Two approaches: reveal or demonstrate . Both undesirable
..
.. Reveal . The Zero-day Market . 39/119 .. . Whoever moves first and lose your asset . Buyer steals the vulnerability, if the seller reveals it before the sale . Seller runs away with the money, if the buyers pays in advance
.. Demonstrate . The Zero-day Market . 40/119 .. . Whoever controls the computing environment has an edge . Does the seller tampers with the computing environment? . Does the buyer records the working of the exploit and steal it?
... Any vulnerability claim can’t be ensured
..
... Enforce contracts
.. Exclusive rights to the buyer . The Zero-day Market . 44/119 .. . Grant exclusive rights, to receive the largest payoffs . What if the seller defects, selling the same zero-day to multiple parties? . This time are the buyers to lack a mean to protect themselves . Forcing to return the funds? . Difficulty to identify sellers, to attribute multiple transactions to the same supplier, and to enforce contracts helps the seller willing to betray
..
.. Proposed solutions . The Zero-day Market . 46/119 . Use punishment (i.e., public disclosure of vulnerabilities) to discourage a buyer from defecting;
.. Proposed solutions . The Zero-day Market . 46/119 . Use punishment (i.e., public disclosure of vulnerabilities) to discourage a buyer from defecting; . Resort to the use of trusted-third parties (e.g., escrow services), as crucial entities for enabling cooperation of market participants;
.. Proposed solutions . The Zero-day Market . 46/119 . Use punishment (i.e., public disclosure of vulnerabilities) to discourage a buyer from defecting; . Resort to the use of trusted-third parties (e.g., escrow services), as crucial entities for enabling cooperation of market participants; . Build a reputation system (e.g., reputation score) as an instrument to establish trust relationships between distrustful players.
..
... PHEW!
.. Motivating questions . The Zero-day Market . 49/119 1. Can the zero-day market achieve cooperation and efficiency even in absence of trusted-third parties?
.. Motivating questions . The Zero-day Market . 49/119 1. Can the zero-day market achieve cooperation and efficiency even in absence of trusted-third parties? 2. Can punishment discourage the buyer from defecting?
.. Motivating questions . The Zero-day Market . 49/119 1. Can the zero-day market achieve cooperation and efficiency even in absence of trusted-third parties? 2. Can punishment discourage the buyer from defecting? 3. Under which conditions a player can extort the opponent?
.. Motivating questions . The Zero-day Market . 49/119 1. Can the zero-day market achieve cooperation and efficiency even in absence of trusted-third parties? 2. Can punishment discourage the buyer from defecting? 3. Under which conditions a player can extort the opponent? 4. Can cooperation be sustained also in fully anonymous settings?
.. Motivating questions . The Zero-day Market . 49/119 1. Can the zero-day market achieve cooperation and efficiency even in absence of trusted-third parties? 2. Can punishment discourage the buyer from defecting? 3. Under which conditions a player can extort the opponent? 4. Can cooperation be sustained also in fully anonymous settings? 5. What about semi-anonymous settings?
... Which trading strategy to employ?
... Relevance . 51/119 Relevance
.. /me . Relevance . 52/119 At the intersection of so ware security and security so ware, exploring, and trying to contain, the space of unanticipated state.
.. Market failure . Relevance . 53/119 ...
.. Inability to self-correct . Relevance . 54/119 .. . So ware manufacturers will not forgo market shares . So ware users will not forgo features . Attackers will not forgo attacking tens of millions of vulnerable systems
.. Information Security Prediction Market . Relevance . 55/119 ..
.. Should I care? . Relevance . 56/119 1. More interconnected
.. Should I care? . Relevance . 56/119 1. More interconnected 2. More interdependent
.. Should I care? . Relevance . 56/119 1. More interconnected 2. More interdependent 3. Greater dynamic range of possible failure
.. Should I care? . Relevance . 56/119 1. More interconnected 2. More interdependent 3. Greater dynamic range of possible failure 4. Vulnerability information is key to both offensive and defensive purposes
.. Should I care? . Relevance . 56/119 1. More interconnected 2. More interdependent 3. Greater dynamic range of possible failure 4. Vulnerability information is key to both offensive and defensive purposes 5. Prominent role in modern-day intelligence, national security, and law enforcement operations
.. Nation-state actors . Relevance . 57/119 ..
.. LEAs . Relevance . 58/119 ..
.. Galileo . Relevance . 59/119 ..
.. Hack . Relevance . 60/119 ..
.. Vendors . Relevance . 61/119 ..
.. Where the results find application? . Relevance . 62/119 .. . Over-the-counter zero-day trading
.. Where the results find application? . Relevance . 62/119 .. . Over-the-counter zero-day trading . Boutique exploit providers offering zero-day vulnerabilities for a subscription fee
.. Where the results find application? . Relevance . 62/119 .. . Over-the-counter zero-day trading . Boutique exploit providers offering zero-day vulnerabilities for a subscription fee . Service models for vulnerability research
... The Zero-day Dilemma . 63/119 TheZero-dayDilemma
... The Bazaar
... The Maharaja’s Ultimatum
... The Shadow of the Future
.. Ultimatum Game . The Zero-day Dilemma . 67/119 .. . A game in economic experiments . Proposer: receives a sum of money and propose how to divide the sum between himself and another player . Responder: chooses to either accept or reject the proposal . If he accepts, the money is split according to the proposal . If he rejects, neither player receives any money
.. Prisoner’s Dilemma . The Zero-day Dilemma . 68/119 .. . Two purely “rational” individuals might not cooperate, even if it appears that it is in their best interest to do so . Two prisoners that commited a crime . If they both do not confess, they get a low punishment . If they both confess, they get a more severe punishment . If one confesses and the other does not, then the one that confesses gets a very low punishment and the other gets a very severe punishment
.. IPD . The Zero-day Dilemma . 69/119 The Iterated Prisoner’s Dilemma (IPD) is a repeated game, where the PD is the stage game. Agents play the PD game an indefinite number of times.
.. The 0-Day Dilemma . The Zero-day Dilemma . 70/119 ..
.. Submissive scenario . The Zero-day Dilemma . 71/119 .. . Traders are playing the standard PD . R > P implies that mutual cooperation is superior to mutual defection . T > R and P > S imply that defection is the dominant strategy for both agents . Or, defection is better than cooperation for one player, no matter how that player’s opponent may play
.. Adaptive scenario . The Zero-day Dilemma . 72/119 .. . Neither the buyer nor the seller have a dominant strategy, if we assume Z > S and the U < R . If the betryed seller has the ability to close alternative deals for the same exploit (i.e., 1-Day FUD, 1-Day private exploits), then defection would not be a dominant strategy anymore . The market nature plays a role . Today not a monopsony and weakly regulated. Tomorrow rules and regulations may emerge in this area (e.g., Wassenaar Arrangement) and may impact the market liquidity
.. MAD scenario . The Zero-day Dilemma . 73/119 .. . A variant of the standard PD, where the seller has the ability to negate the buyer the temptation to defect . Just make sure T approaches P . Hence, defection is not a dominant strategy for the buyer . If factors such as market liquidity, export/trade regulations, mean-time to close a deal prevent the Adaptive retaliation approach from being undertaken, then the seller should consider disclosing publicly the exploit or the vulnerability.
.. MAD scenario . The Zero-day Dilemma . 74/119 .. . This would not make herself worse off . The seller would reduce the buyer incentives to defect in the first place
.. FD & Brinkmanship . The Zero-day Dilemma . 75/119 .. . To this end, it is important for the 0-Day sellers to have an efficient mean for doing full-disclosure
.. FD & Brinkmanship . The Zero-day Dilemma . 75/119 .. . To this end, it is important for the 0-Day sellers to have an efficient mean for doing full-disclosure . Not for the sake of bragging rights anymore, but for modern-day brinkmanship
.. FD & Brinkmanship . The Zero-day Dilemma . 75/119 .. . To this end, it is important for the 0-Day sellers to have an efficient mean for doing full-disclosure . Not for the sake of bragging rights anymore, but for modern-day brinkmanship . As faster the disclosure of the vulnerability, as shorter the window of opportunity to the exploiter and the smaller the Residual payoff (V)
.. Fair share of troubles . The Zero-day Dilemma . 76/119 .. . Since July 2002 the Full-Disclosure list experienced a “fair share of legal troubles along the way.” . Posting on a mailing list may transalte in an OPSEC failure, if the anonymity of the submitter is not protected
.. WhistleDay or ZeroLeaks . The Zero-day Dilemma . 77/119 . A 0-Day disclosure platform . Researchers could use it for full-disclosure . Players in the Zero-day market could use to retaliate against buyers who defect . Insiders would turn to it to expose the secretive trade in intrusion and surveillance technologies . Dub it WhistleDay or ZeroLeaks, if you like
.. Cooperation is possible . The Zero-day Dilemma . 78/119 . As long as the seller doesn’t play in the Submissive scenario, the buyer is not better off defecting
.. Cooperation is possible . The Zero-day Dilemma . 78/119 . As long as the seller doesn’t play in the Submissive scenario, the buyer is not better off defecting . In the one-shot sequential 0-Day Dilemma cooperation is possible
.. Cooperation is possible . The Zero-day Dilemma . 78/119 . As long as the seller doesn’t play in the Submissive scenario, the buyer is not better off defecting . In the one-shot sequential 0-Day Dilemma cooperation is possible . If this is not the case, the rational outcome is the action profile of mutual defection
.. Cooperation is possible . The Zero-day Dilemma . 78/119 . As long as the seller doesn’t play in the Submissive scenario, the buyer is not better off defecting . In the one-shot sequential 0-Day Dilemma cooperation is possible . If this is not the case, the rational outcome is the action profile of mutual defection . “We have to distrust each other. It’s our only defense against betrayal.” — Tennessee Williams
.. Cooperation is possible . The Zero-day Dilemma . 78/119 . As long as the seller doesn’t play in the Submissive scenario, the buyer is not better off defecting . In the one-shot sequential 0-Day Dilemma cooperation is possible . If this is not the case, the rational outcome is the action profile of mutual defection . “We have to distrust each other. It’s our only defense against betrayal.” — Tennessee Williams . “The dilemma then is that mutual cooperation yields a better outcome than mutual defection but it is not the rational outcome because the choice to cooperate, at the individual level, is not rational from a self-interested point of view.”
.. Cooperation as an Equilibrium . The Zero-day Dilemma . 79/119 If no form of punishment can be undertaken by the seller, can the cooperative outcome still be sustained as an equilibrium?
.. Iterated 0-Day Dilemma . The Zero-day Dilemma . 80/119 . The Iterated 0-Day Dilemma (I0DD) is a repeated game, where the 0-Day Dilemma is the stage game. Agents play the 0-Day Dilemma game an indefinite number of times
.. Iterated 0-Day Dilemma . The Zero-day Dilemma . 80/119 . . The Iterated 0-Day Dilemma (I0DD) is a repeated game, where the 0-Day Dilemma is the stage game. Agents play the 0-Day Dilemma game an indefinite number of times Remark: Whenever the Submissive scenario applies, the I0DD reduces to the Iterated Prisoner’s Dilemma
.. Three settings . The Zero-day Dilemma . 81/119 . .. . Onymous: The traders know the identity of the party they are dealing with
.. Three settings . The Zero-day Dilemma . 81/119 .. . Onymous: The traders know the identity of the party they are dealing with . Anonymous: Trades takes place among strangers
.. Three settings . The Zero-day Dilemma . 81/119 .. . Onymous: The traders know the identity of the party they are dealing with . Anonymous: Trades takes place among strangers . Semi-anonymous: Either the buyer or the seller is anonymous
.. Cooperation is possible in onymous economies . The Zero-day Dilemma . 82/119 .. Aumann, Robert (1959). “Acceptable points in general cooperative n-person games”. In Luce, R. D.; Tucker, A. W. Contributions to the Theory 23 of Games IV. Annals of Mathematics Study 40. Princeton NJ: Princeton University Press. pp. 287–324. MR 0104521.
.. William Press and Freeman Dyson . The Zero-day Dilemma . 83/119 ...
.. Sentient Player . The Zero-day Dilemma . 84/119 .. . Power granted to a sentient player . A player with a theory of mind . Who realize that her behavior can influence her opponents’ strategies
.. Zero Determinant (ZD) Strategies . The Zero-day Dilemma . 85/119 ...
.. Extortion . The Zero-day Dilemma . 86/119 .. If one trader is aware of ZD strategies, but the opponent is an evoutionary player then the former can choose to extort the latter
.. Evolutionary players . The Zero-day Dilemma . 87/119 .. A player is said to be evolutionary is she posses no theory of mind and instead simply seeks to adjust her strategy to maximize her own score in response to whatever the adversary is doing
.. Extortion strategies . The Zero-day Dilemma . 88/119 . Grant a disproportionate number of high payoffs to the extortionist . It is the victim’s best interest to cooperate with the extortionist, because she is able to increase her score by doing so . In so doing, she ends up increasing the extortionist’s score even more than her own . She will never catch up to the extortionist, and she will accede to her extortionist because it pays her to do so
.. An extortionist relation . The Zero-day Dilemma . 89/119 Sx − P = 3(Sy − P)
.. Extortionist strategy: Example . The Zero-day Dilemma . 90/119 .. . Let R = 3, T = 5, P = 1, S = 0 . Let the desired payoff relation be Sx − P = 3(Sy − P) . If we both cooperated last time, then I cooperate with probability 11/13 . If I cheated you last time (you cooperated and I defected), then I cooperate with probability 7/26 . If you cheated me last time (I cooperated and you defected), then I cooperate with probability 1/2 . If we both defected last time, I defect . On average over the long run, my score minus one will be thrice your score minus one
.. Press and Dyson . The Zero-day Dilemma . 91/119 ..
.. IPD == Ultimatum Game . The Zero-day Dilemma . 92/119 .. If both players are sentient, but only one is aware of ZD-Strategies, then the IPD reduces to the Ultimatum Game
.. IPD == Ultimatum Game . The Zero-day Dilemma . 93/119 .. . Let’s suppose both players are sentient . Let’s suppose the buyer only knows about ZD-strategies . The buyer tries to extort the seller . The seller eventually notice . The seller decide to sabotage the scores of both . This is an Ultimatum Game. The buyer proposes an unfair ultimatum. And the seller respond.
.. Generous ZD-Strategies . The Zero-day Dilemma . 94/119 .. . If both players are sentient and witting of ZD-Strategies, then they can agree on playing a Generous ZD-Strategy
.. Generous ZD-Strategies . The Zero-day Dilemma . 94/119 .. . If both players are sentient and witting of ZD-Strategies, then they can agree on playing a Generous ZD-Strategy . In fact any tentative to extort the opponent would result in a low payoff for both
.. Generous ZD-Strategies . The Zero-day Dilemma . 94/119 .. . If both players are sentient and witting of ZD-Strategies, then they can agree on playing a Generous ZD-Strategy . In fact any tentative to extort the opponent would result in a low payoff for both . It is rational to agree on a fair cooperation strategy
.. Generous ZD-Strategies . The Zero-day Dilemma . 94/119 .. . If both players are sentient and witting of ZD-Strategies, then they can agree on playing a Generous ZD-Strategy . In fact any tentative to extort the opponent would result in a low payoff for both . It is rational to agree on a fair cooperation strategy . They agree to unilaterally set the other’s score to an agreed value (presumably the maximum possible)
.. Generous ZD-Strategies . The Zero-day Dilemma . 94/119 .. . If both players are sentient and witting of ZD-Strategies, then they can agree on playing a Generous ZD-Strategy . In fact any tentative to extort the opponent would result in a low payoff for both . It is rational to agree on a fair cooperation strategy . They agree to unilaterally set the other’s score to an agreed value (presumably the maximum possible) . Neither player can then improve her score by violating the strategy
.. Generous ZD-Strategies . The Zero-day Dilemma . 94/119 .. . If both players are sentient and witting of ZD-Strategies, then they can agree on playing a Generous ZD-Strategy . In fact any tentative to extort the opponent would result in a low payoff for both . It is rational to agree on a fair cooperation strategy . They agree to unilaterally set the other’s score to an agreed value (presumably the maximum possible) . Neither player can then improve her score by violating the strategy . Each is punished for any purely malicious violation
.. A generous relation . The Zero-day Dilemma . 95/119 Sx − R = 2(Sy − R)
.. Generous ZD-strategy: Example . The Zero-day Dilemma . 96/119 .. . Let R = 3, T = 5, P = 1, S = 0 . Let the desired payoff relation be Sx − R = 2(Sy − R) . If we both cooperated last time, then I cooperate . If I cheated you last time (you cooperated and I defected), then I cooperate with probability 8/10 . If you cheated me last time (I cooperated and you defected), then I cooperate with probability 3/10 . If we both defected last time, I cooperate with probability 2/10 . On average over the long run, my score minus three will be twice your score minus three
.. Under the assumption... . The Zero-day Dilemma . 97/119 .. . Ascribe past actions to the same market participants . Choose strategies according to the outcome of past interactions
.. Anonymous Black Market . The Zero-day Dilemma . 98/119 .. . Is cooperation possible in anonymous zero-day markets?
.. Anonymous Black Market . The Zero-day Dilemma . 98/119 .. . Is cooperation possible in anonymous zero-day markets? . Do you believe it is?
.. Anonymous Black Market . The Zero-day Dilemma . 98/119 .. . Is cooperation possible in anonymous zero-day markets? . Do you believe it is? . If yes, which institutions for monitoring and enforcement promote cooperation in this setting?
.. Cooperation among Strangers . The Zero-day Dilemma . 99/119 ..
.. Anonymous Economies: Camera and Casari 1 . The Zero-day Dilemma . 100/119 .. . Cooperation is high and increases with experience
.. Anonymous Economies: Camera and Casari 1 . The Zero-day Dilemma . 100/119 .. . Cooperation is high and increases with experience . Low degree of cooperation when subject see aggregate outcomes without observing identities (e.g., as might result from discussing trading experiences in anonymous fora)
.. Anonymous Economies: Camera and Casari 1 . The Zero-day Dilemma . 100/119 .. . Cooperation is high and increases with experience . Low degree of cooperation when subject see aggregate outcomes without observing identities (e.g., as might result from discussing trading experiences in anonymous fora) . Costly personal punishment significantly promotes cooperation
.. Anonymous Economies: Camera and Casari 2 . The Zero-day Dilemma . 101/119 .. . Subject were given the possibility to observe actions and outcomes in their game and to inflict, at a cost, a loss in the earnings of the defecting opponent
.. Anonymous Economies: Camera and Casari 2 . The Zero-day Dilemma . 101/119 .. . Subject were given the possibility to observe actions and outcomes in their game and to inflict, at a cost, a loss in the earnings of the defecting opponent . Camera and Casari added a second stage in the one-shot game
.. Anonymous Economies: Camera and Casari 2 . The Zero-day Dilemma . 101/119 .. . Subject were given the possibility to observe actions and outcomes in their game and to inflict, at a cost, a loss in the earnings of the defecting opponent . Camera and Casari added a second stage in the one-shot game . The retaliation stage resembles in full the Adaptive and MAD scenarios in the 0-Day Dilemma
.. Anonymous Economies: Camera and Casari 3 . The Zero-day Dilemma . 102/119 .. . The player who obseverd the opponent defect sometimes employed personal punishment (i.e., in-match retaliation), while staying in cooperative mode in the following periods
.. Anonymous Economies: Camera and Casari 3 . The Zero-day Dilemma . 102/119 .. . The player who obseverd the opponent defect sometimes employed personal punishment (i.e., in-match retaliation), while staying in cooperative mode in the following periods . Players show preference for in-match retaliation over the (equilibrium) informal retaliation
.. Anonymous Economies: Camera and Casari 3 . The Zero-day Dilemma . 102/119 .. . The player who obseverd the opponent defect sometimes employed personal punishment (i.e., in-match retaliation), while staying in cooperative mode in the following periods . Players show preference for in-match retaliation over the (equilibrium) informal retaliation . Efficiency: defectors who had been punished by a cooperator were more likely to cooperate in the following periods (34.5% vs 24.1%)
.. Punishment as a Public Good . The Zero-day Dilemma . 103/119 .. . It significantly increases cooperation
.. Punishment as a Public Good . The Zero-day Dilemma . 103/119 .. . It significantly increases cooperation . The subject that benefit the most are cooperator who punish little or not at all
.. Hacking Team . The Zero-day Dilemma . 104/119 ..
.. Hacking Team leaked correspondence . The Zero-day Dilemma . 105/119 ..
.. Poll . The Zero-day Dilemma . 106/119 Was the COO’s intuition correct?
.. Poll . The Zero-day Dilemma . 107/119 Can Hacking Team trust anonymous 0-day sellers?
.. Poll . The Zero-day Dilemma . 108/119 If you were in their place, would you have trusted an anonymous seller with supplying an 0-day?
.. Semi-anonymous Zero-day markets . The Zero-day Dilemma . 109/119 .. . If only one party is anonymous, the onymous counterpart has not ability to know if she already had any deals with the same participant
.. Semi-anonymous Zero-day markets . The Zero-day Dilemma . 109/119 .. . If only one party is anonymous, the onymous counterpart has not ability to know if she already had any deals with the same participant . The latter can’t benefit from being sentient and is forced to choose her strategies as an evolutionary player would do
.. Semi-anonymous Zero-day markets . The Zero-day Dilemma . 109/119 .. . If only one party is anonymous, the onymous counterpart has not ability to know if she already had any deals with the same participant . The latter can’t benefit from being sentient and is forced to choose her strategies as an evolutionary player would do . If the anonymous party knows about the ZD-strategies, she can choose to extort the opponent
.. Semi-anonymous Zero-day markets . The Zero-day Dilemma . 109/119 .. . If only one party is anonymous, the onymous counterpart has not ability to know if she already had any deals with the same participant . The latter can’t benefit from being sentient and is forced to choose her strategies as an evolutionary player would do . If the anonymous party knows about the ZD-strategies, she can choose to extort the opponent . Hence, while cooperation can emerge in fully-anonymous markets, extortion can profilate in the semi-anonymous economies
.. To sum up . The Zero-day Dilemma . 110/119 . Zero-day markets can achieve cooperation even in absence of trusted-third parties
.. To sum up . The Zero-day Dilemma . 110/119 . Zero-day markets can achieve cooperation even in absence of trusted-third parties . Cooperation can be sustained even when traders are anonymous
.. To sum up . The Zero-day Dilemma . 110/119 . Zero-day markets can achieve cooperation even in absence of trusted-third parties . Cooperation can be sustained even when traders are anonymous . Punishment is an effective instrument to discourage traders from defecting
.. To sum up . The Zero-day Dilemma . 110/119 . Zero-day markets can achieve cooperation even in absence of trusted-third parties . Cooperation can be sustained even when traders are anonymous . Punishment is an effective instrument to discourage traders from defecting . It is possible to get extorted, if the adversary knows about ZD-Strategies and we simply seek to adjust our strategy to maximize our own profit
... Recommendations . 111/119 Recommendations
.. Recommendations . Recommendations . 112/119 1. Do not deal with anonymous traders, if you cannot ensure your own anonymity
.. Recommendations . Recommendations . 112/119 1. Do not deal with anonymous traders, if you cannot ensure your own anonymity 2. Discourage defection by practicing brinkmanship or casting the shadow of the future in every decision of your counterpart
.. Recommendations . Recommendations . 112/119 1. Do not deal with anonymous traders, if you cannot ensure your own anonymity 2. Discourage defection by practicing brinkmanship or casting the shadow of the future in every decision of your counterpart 3. Respond: Consider punishing defection to promote cooperation
.. Recommendations . Recommendations . 112/119 1. Do not deal with anonymous traders, if you cannot ensure your own anonymity 2. Discourage defection by practicing brinkmanship or casting the shadow of the future in every decision of your counterpart 3. Respond: Consider punishing defection to promote cooperation 4. Let the seller supply the vulnerability first, if interested in a one-time deal
.. Recommendations . Recommendations . 112/119 1. Do not deal with anonymous traders, if you cannot ensure your own anonymity 2. Discourage defection by practicing brinkmanship or casting the shadow of the future in every decision of your counterpart 3. Respond: Consider punishing defection to promote cooperation 4. Let the seller supply the vulnerability first, if interested in a one-time deal 5. Learn about Zero Determinant strategies, if playing in an onymous market
.. Recommendations . Recommendations . 112/119 1. Do not deal with anonymous traders, if you cannot ensure your own anonymity 2. Discourage defection by practicing brinkmanship or casting the shadow of the future in every decision of your counterpart 3. Respond: Consider punishing defection to promote cooperation 4. Let the seller supply the vulnerability first, if interested in a one-time deal 5. Learn about Zero Determinant strategies, if playing in an onymous market 6. Grim trigger: forever defect, if you see defection while playing in an anonymous market and have no ability to punish the opponent
.. Experimental verification . Recommendations . 113/119 If interested, please be in touch
..
..
.. “ Though I am o en in the depths of misery, there is still calmness, pure harmony and music inside me. Vincent van Gogh.. ”
.. “ Though we are o en in the depths of insecurity, there is still calmness, pure harmony and music inside us. .. ”
.. THANK YOU
Q ?
... Backup . 120/119 Backup
.. BeeWise . Backup . 121/119 .. . BeeWise is the first prediction market for forecasting security events and trends . More specifically, it is a security-event futures exchange where participants trade contracts whose payoffs are tied to future events in information security, such as the discovery of a given so ware vulnerability, a security incident, or the diffusion of new malware
.. BeeWise . Backup . 121/119 .. . With a large enough number of people betting on the outcome of selected events, the prices of the contracts will be an approximate measure of the probability of the underlying events at any time. The ability to use market prices as forward-looking indicators of security properties will help in establishing information symmetry between buyers and sellers (ie., build a quality signal), and help security stakeholders to make better and more informed decisions, by telling mediocre security products from good ones

More Related Content

PDF
The Bazaar, the Maharaja’s Ultimatum, and the Shadow of the Future: Extortion...
bya001
 
PDF
0daysmarketThe Bazaar, the Maharaja's Ultimatum, and the Shadow of the Future...
byPositive Hack Days
 
PDF
Auscert20150daymarket
byDarren Pauli
 
PDF
Don’t Get Beaten‐Up By Buyers!
byGrowth Pitstop
 
PDF
The 25 smartest things warren buffett ever said
byChessy Cherian
 
PPT
Did you know - Now You Know
byLearning and Teaching Scotland
 
PPT
Employer Engagement
byLearning and Teaching Scotland
 
PDF
Special Event Recycling
byManny Manatakis
 
The Bazaar, the Maharaja’s Ultimatum, and the Shadow of the Future: Extortion...
bya001
 
0daysmarketThe Bazaar, the Maharaja's Ultimatum, and the Shadow of the Future...
byPositive Hack Days
 
Auscert20150daymarket
byDarren Pauli
 
Don’t Get Beaten‐Up By Buyers!
byGrowth Pitstop
 
The 25 smartest things warren buffett ever said
byChessy Cherian
 
Did you know - Now You Know
byLearning and Teaching Scotland
 
Employer Engagement
byLearning and Teaching Scotland
 
Special Event Recycling
byManny Manatakis
 

Similar to The Bazaar, the Maharaja’s Ultimatum, and the Shadow of the Future: Extortion and Cooperation in the Zero-day Market

PDF
Auscert20150daymarket
bya001
 
PDF
The Bazaar, the Maharaja's Ultimatum, and the Shadow of the Future: Extortion...
bya001
 
PDF
Hacking Cracking 2008
byJim Geovedi
 
PDF
Market Design for HCI: Successes and Failures of Peer-to-Peer Exchange Platfo...
byairilmpnn
 
PDF
Lect 8-auctions
byAntonio Moreno
 
PDF
What Role Do Zero-Day Vulnerabilities Play In Modern Security Solutions?
byRion Technologies
 
PPT
Aggression And Blackmail As Normal
bybhamori
 
PPT
Information Markets for Human Resource Planning & Management
byPenn State University
 
PPT
Trust And Social Capital Final
bybhamori
 
PDF
Rand rr1751
byAndrey Apuhtin
 
PDF
SIFMA Tech Conference: Trade Ideas presentation
byDavid Aferiat
 
PDF
Solving the Market Formation Problem: Market Makers and Liquidity on Transit ...
byTexxi Global
 
PPT
Prediction Markets
byMelanie Swan
 
PDF
Defense In Depth Using NIST 800-30
byKevin M. Moker, CFE, CISSP, ISSMP, CISM
 
PDF
What is a Zero-Day Exploit Understanding the Threat of Unknown Vulnerabilitie...
byuzair
 
PDF
Cyber Security for Critical Infrastructure
byMohit Rampal
 
PPTX
Oligopoly and Game Theory
bytutor2u
 
PDF
The Sharing Economy Its Pitfalls and Promises 1st Edition Michael C Munger
bymidocmathai
 
PPT
Market Makers & Liquidity on a Transit Exchange
byTexxi Global
 
PPT
Aggression Unfairness
bybhamori
 
Auscert20150daymarket
bya001
 
The Bazaar, the Maharaja's Ultimatum, and the Shadow of the Future: Extortion...
bya001
 
Hacking Cracking 2008
byJim Geovedi
 
Market Design for HCI: Successes and Failures of Peer-to-Peer Exchange Platfo...
byairilmpnn
 
Lect 8-auctions
byAntonio Moreno
 
What Role Do Zero-Day Vulnerabilities Play In Modern Security Solutions?
byRion Technologies
 
Aggression And Blackmail As Normal
bybhamori
 
Information Markets for Human Resource Planning & Management
byPenn State University
 
Trust And Social Capital Final
bybhamori
 
Rand rr1751
byAndrey Apuhtin
 
SIFMA Tech Conference: Trade Ideas presentation
byDavid Aferiat
 
Solving the Market Formation Problem: Market Makers and Liquidity on Transit ...
byTexxi Global
 
Prediction Markets
byMelanie Swan
 
Defense In Depth Using NIST 800-30
byKevin M. Moker, CFE, CISSP, ISSMP, CISM
 
What is a Zero-Day Exploit Understanding the Threat of Unknown Vulnerabilitie...
byuzair
 
Cyber Security for Critical Infrastructure
byMohit Rampal
 
Oligopoly and Game Theory
bytutor2u
 
The Sharing Economy Its Pitfalls and Promises 1st Edition Michael C Munger
bymidocmathai
 
Market Makers & Liquidity on a Transit Exchange
byTexxi Global
 
Aggression Unfairness
bybhamori
 

More from a001

PDF
Deliberately Un-Dependable Applications: the Role of Dependability Metrics in...
bya001
 
PDF
The Vulnerability Supply Chain - HackIT Ukraine 2016, Kharkiv
bya001
 
PDF
Andy, the Polluters, Rick Deckard, and Other Bounty Hunters
Vulnerabilities a...
bya001
 
PDF
Vulnerabilities and their Surrounding Ethical Questions: A Code of Ethics for...
bya001
 
PDF
illusoryTLS: Nobody But Us Impersonate, Tamper, Exploit (DeepSEC 2015)
bya001
 
PDF
illusoryTLS: Nobody But Us Impersonate, Tamper, Exploit
bya001
 
PDF
illusoryTLS: Impersonate, Tamper, and Exploit
bya001
 
PDF
Cryptographic Key Reliable Lifetimes - Bounding the Risk of Key Exposure in t...
bya001
 
Deliberately Un-Dependable Applications: the Role of Dependability Metrics in...
bya001
 
The Vulnerability Supply Chain - HackIT Ukraine 2016, Kharkiv
bya001
 
Andy, the Polluters, Rick Deckard, and Other Bounty Hunters
Vulnerabilities a...
bya001
 
Vulnerabilities and their Surrounding Ethical Questions: A Code of Ethics for...
bya001
 
illusoryTLS: Nobody But Us Impersonate, Tamper, Exploit (DeepSEC 2015)
bya001
 
illusoryTLS: Nobody But Us Impersonate, Tamper, Exploit
bya001
 
illusoryTLS: Impersonate, Tamper, and Exploit
bya001
 
Cryptographic Key Reliable Lifetimes - Bounding the Risk of Key Exposure in t...
bya001
 

Recently uploaded

PDF
erp software for trading business in india.pdf
byZipERP
 
PDF
Dues Collection Software Intelligent Revenue Management.pdf
byCollege Pro
 
PPTX
Object Oriented Programming - Lecture 02
byAbdul Baqi Malik
 
PPTX
Why Airline Platforms Fail at Change and How Etihad Fixed It
byIT IDOL Technologies
 
PPTX
Computing Adnans presentation OTHM level 3
bymashikhossain23
 
PPTX
Publix Data Scraping for Grocery Prices & Store Analysis.pptx
byMobile App Scraping
 
PPTX
Cloud_Computing_Presentation FOR BCA.pptx
bysharma79822
 
PDF
AI Development Services: MVP to Production Guide
byShiv Technolabs Pvt. Ltd.
 
PDF
Wormhole Token – Smart Contract Security Audit Report by EtherAuthority
byEtherAuthority
 
PDF
Efficient UrbanClap Clone Script from Zipprr
byZipprr Official
 
PDF
Best SaaS Growth Strategy for 2026: Referral Programs That Retain Better
byReferral Factory
 
PDF
Mastering ROS 2 for Robotics Programming.pdf
byssuser4e6c051
 
PDF
Common CRM Implementation Mistakes & How to Avoid Them.pdf
byCRMLeaf
 
PDF
What Web Teams Need to Know About Building API-Powered Websites
byAlex Halsey
 
PPTX
Managing Multiple Projects from One ERP Dashboard - by biCanvas ERP
bybiCanvasERP
 
PDF
ment.tech-What Infrastructure as Code Means for Businesses.pdf
bysj2643598
 
PDF
apidays Paris 2025 | AI and APIs - Ensuring Platform Migration Reliability wi...
byapidays
 
PDF
The Hidden Cost of “Quick” Web App Development
byiProgrammer Solutions Private Limited
 
PDF
End-to-End Web & Mobile App Development Roadmap for Modern Businesses.pdf
byNaestinn
 
PDF
Ready to go Zillow Clone Script from Zipprr
byZipprr Official
 
erp software for trading business in india.pdf
byZipERP
 
Dues Collection Software Intelligent Revenue Management.pdf
byCollege Pro
 
Object Oriented Programming - Lecture 02
byAbdul Baqi Malik
 
Why Airline Platforms Fail at Change and How Etihad Fixed It
byIT IDOL Technologies
 
Computing Adnans presentation OTHM level 3
bymashikhossain23
 
Publix Data Scraping for Grocery Prices & Store Analysis.pptx
byMobile App Scraping
 
Cloud_Computing_Presentation FOR BCA.pptx
bysharma79822
 
AI Development Services: MVP to Production Guide
byShiv Technolabs Pvt. Ltd.
 
Wormhole Token – Smart Contract Security Audit Report by EtherAuthority
byEtherAuthority
 
Efficient UrbanClap Clone Script from Zipprr
byZipprr Official
 
Best SaaS Growth Strategy for 2026: Referral Programs That Retain Better
byReferral Factory
 
Mastering ROS 2 for Robotics Programming.pdf
byssuser4e6c051
 
Common CRM Implementation Mistakes & How to Avoid Them.pdf
byCRMLeaf
 
What Web Teams Need to Know About Building API-Powered Websites
byAlex Halsey
 
Managing Multiple Projects from One ERP Dashboard - by biCanvas ERP
bybiCanvasERP
 
ment.tech-What Infrastructure as Code Means for Businesses.pdf
bysj2643598
 
apidays Paris 2025 | AI and APIs - Ensuring Platform Migration Reliability wi...
byapidays
 
The Hidden Cost of “Quick” Web App Development
byiProgrammer Solutions Private Limited
 
End-to-End Web & Mobile App Development Roadmap for Modern Businesses.pdf
byNaestinn
 
Ready to go Zillow Clone Script from Zipprr
byZipprr Official
 

The Bazaar, the Maharaja’s Ultimatum, and the Shadow of the Future: Extortion and Cooperation in the Zero-day Market

  • 1.
    ... The Bazaar, theMaharaja’s Ultimatum, and the Shadow of the Future: . Extortion and Cooperation in the Zero-day Market . Alfonso De Gregorio . Founder, BeeWise .. HITB GSEC, Singapore, October 12th-16th, 2015
  • 2.
  • 3.
    .. Agenda . 1. The Zero-dayMarket A hairy business 2. Relevance Should I care? 3. The Zero-day Dilemma Extortion and Cooperation in the Zero-day Market 4. Recommendations to Zero-day traders How to maximize the payoff?
  • 4.
  • 5.
  • 6.
  • 7.
  • 8.
  • 9.
  • 10.
  • 11.
  • 12.
  • 13.
  • 14.
  • 15.
  • 16.
  • 17.
  • 18.
  • 19.
  • 20.
  • 21.
  • 22.
  • 23.
  • 24.
  • 25.
  • 26.
  • 27.
  • 28.
  • 29.
  • 30.
  • 31.
    .. Inherent obstacles . The Zero-dayMarket . 28/119 1. Time-sensitiveness of traded commodities 2. Trust 3. Price fairness 4. Possibility of defection
  • 32.
    .. A hairy business . TheZero-day Market . 29/119 ..
  • 33.
    .. The Legitimate VulnerabilityMarket . The Zero-day Market . 30/119 ..
  • 34.
    .. Time-sensitive commodity . The Zero-dayMarket . 31/119 .. . Valuable only when they are not widely known . Value drops to zero, as soon as the vulnerability is disclosed or a mitigation is released . Transactions should complete in short times . Discretion required
  • 35.
    ... Every day canbe the last day for a 0-day sale
  • 36.
    .. Trust . The Zero-day Market . 33/119 .. .No centralized way to locate its players . Finding buyers and sellers is time-consuming . Unfamiliar business partners . Hard to verify intentions
  • 37.
    ... Oh, grandmother, whata horribly big mouth you have!
  • 38.
    .. Lack of transparencyand price fairness . The Zero-day Market . 35/119 .. . Adoption levels of the vulnerable component . Presence within a given attack surface . Level of authentication required to exploit it . Difficulty of independent rediscovery . Exploit reliability
  • 39.
  • 40.
    .. Tension . The Zero-day Market . 37/119 .. .Disclose and lose? . Proving without disclosing . Two approaches: reveal or demonstrate . Both undesirable
  • 41.
  • 42.
    .. Reveal . The Zero-day Market . 39/119 .. .Whoever moves first and lose your asset . Buyer steals the vulnerability, if the seller reveals it before the sale . Seller runs away with the money, if the buyers pays in advance
  • 43.
    .. Demonstrate . The Zero-day Market . 40/119 .. .Whoever controls the computing environment has an edge . Does the seller tampers with the computing environment? . Does the buyer records the working of the exploit and steal it?
  • 44.
    ... Any vulnerability claimcan’t be ensured
  • 45.
  • 46.
  • 47.
    .. Exclusive rights tothe buyer . The Zero-day Market . 44/119 .. . Grant exclusive rights, to receive the largest payoffs . What if the seller defects, selling the same zero-day to multiple parties? . This time are the buyers to lack a mean to protect themselves . Forcing to return the funds? . Difficulty to identify sellers, to attribute multiple transactions to the same supplier, and to enforce contracts helps the seller willing to betray
  • 48.
  • 49.
    .. Proposed solutions . The Zero-dayMarket . 46/119 . Use punishment (i.e., public disclosure of vulnerabilities) to discourage a buyer from defecting;
  • 50.
    .. Proposed solutions . The Zero-dayMarket . 46/119 . Use punishment (i.e., public disclosure of vulnerabilities) to discourage a buyer from defecting; . Resort to the use of trusted-third parties (e.g., escrow services), as crucial entities for enabling cooperation of market participants;
  • 51.
    .. Proposed solutions . The Zero-dayMarket . 46/119 . Use punishment (i.e., public disclosure of vulnerabilities) to discourage a buyer from defecting; . Resort to the use of trusted-third parties (e.g., escrow services), as crucial entities for enabling cooperation of market participants; . Build a reputation system (e.g., reputation score) as an instrument to establish trust relationships between distrustful players.
  • 52.
  • 53.
  • 54.
    .. Motivating questions . The Zero-dayMarket . 49/119 1. Can the zero-day market achieve cooperation and efficiency even in absence of trusted-third parties?
  • 55.
    .. Motivating questions . The Zero-dayMarket . 49/119 1. Can the zero-day market achieve cooperation and efficiency even in absence of trusted-third parties? 2. Can punishment discourage the buyer from defecting?
  • 56.
    .. Motivating questions . The Zero-dayMarket . 49/119 1. Can the zero-day market achieve cooperation and efficiency even in absence of trusted-third parties? 2. Can punishment discourage the buyer from defecting? 3. Under which conditions a player can extort the opponent?
  • 57.
    .. Motivating questions . The Zero-dayMarket . 49/119 1. Can the zero-day market achieve cooperation and efficiency even in absence of trusted-third parties? 2. Can punishment discourage the buyer from defecting? 3. Under which conditions a player can extort the opponent? 4. Can cooperation be sustained also in fully anonymous settings?
  • 58.
    .. Motivating questions . The Zero-dayMarket . 49/119 1. Can the zero-day market achieve cooperation and efficiency even in absence of trusted-third parties? 2. Can punishment discourage the buyer from defecting? 3. Under which conditions a player can extort the opponent? 4. Can cooperation be sustained also in fully anonymous settings? 5. What about semi-anonymous settings?
  • 59.
  • 60.
  • 61.
    .. /me . Relevance . 52/119 At the intersectionof so ware security and security so ware, exploring, and trying to contain, the space of unanticipated state.
  • 62.
  • 63.
    .. Inability to self-correct . Relevance . 54/119 .. .So ware manufacturers will not forgo market shares . So ware users will not forgo features . Attackers will not forgo attacking tens of millions of vulnerable systems
  • 64.
    .. Information Security PredictionMarket . Relevance . 55/119 ..
  • 65.
  • 66.
    .. Should I care? . Relevance . 56/119 1.More interconnected 2. More interdependent
  • 67.
    .. Should I care? . Relevance . 56/119 1.More interconnected 2. More interdependent 3. Greater dynamic range of possible failure
  • 68.
    .. Should I care? . Relevance . 56/119 1.More interconnected 2. More interdependent 3. Greater dynamic range of possible failure 4. Vulnerability information is key to both offensive and defensive purposes
  • 69.
    .. Should I care? . Relevance . 56/119 1.More interconnected 2. More interdependent 3. Greater dynamic range of possible failure 4. Vulnerability information is key to both offensive and defensive purposes 5. Prominent role in modern-day intelligence, national security, and law enforcement operations
  • 70.
  • 71.
  • 72.
  • 73.
  • 74.
  • 75.
    .. Where the resultsfind application? . Relevance . 62/119 .. . Over-the-counter zero-day trading
  • 76.
    .. Where the resultsfind application? . Relevance . 62/119 .. . Over-the-counter zero-day trading . Boutique exploit providers offering zero-day vulnerabilities for a subscription fee
  • 77.
    .. Where the resultsfind application? . Relevance . 62/119 .. . Over-the-counter zero-day trading . Boutique exploit providers offering zero-day vulnerabilities for a subscription fee . Service models for vulnerability research
  • 78.
  • 79.
  • 80.
  • 81.
  • 82.
    .. Ultimatum Game . The Zero-dayDilemma . 67/119 .. . A game in economic experiments . Proposer: receives a sum of money and propose how to divide the sum between himself and another player . Responder: chooses to either accept or reject the proposal . If he accepts, the money is split according to the proposal . If he rejects, neither player receives any money
  • 83.
    .. Prisoner’s Dilemma . The Zero-dayDilemma . 68/119 .. . Two purely “rational” individuals might not cooperate, even if it appears that it is in their best interest to do so . Two prisoners that commited a crime . If they both do not confess, they get a low punishment . If they both confess, they get a more severe punishment . If one confesses and the other does not, then the one that confesses gets a very low punishment and the other gets a very severe punishment
  • 84.
    .. IPD . The Zero-day Dilemma . 69/119 TheIterated Prisoner’s Dilemma (IPD) is a repeated game, where the PD is the stage game. Agents play the PD game an indefinite number of times.
  • 85.
    .. The 0-Day Dilemma . TheZero-day Dilemma . 70/119 ..
  • 86.
    .. Submissive scenario . The Zero-dayDilemma . 71/119 .. . Traders are playing the standard PD . R > P implies that mutual cooperation is superior to mutual defection . T > R and P > S imply that defection is the dominant strategy for both agents . Or, defection is better than cooperation for one player, no matter how that player’s opponent may play
  • 87.
    .. Adaptive scenario . The Zero-dayDilemma . 72/119 .. . Neither the buyer nor the seller have a dominant strategy, if we assume Z > S and the U < R . If the betryed seller has the ability to close alternative deals for the same exploit (i.e., 1-Day FUD, 1-Day private exploits), then defection would not be a dominant strategy anymore . The market nature plays a role . Today not a monopsony and weakly regulated. Tomorrow rules and regulations may emerge in this area (e.g., Wassenaar Arrangement) and may impact the market liquidity
  • 88.
    .. MAD scenario . The Zero-dayDilemma . 73/119 .. . A variant of the standard PD, where the seller has the ability to negate the buyer the temptation to defect . Just make sure T approaches P . Hence, defection is not a dominant strategy for the buyer . If factors such as market liquidity, export/trade regulations, mean-time to close a deal prevent the Adaptive retaliation approach from being undertaken, then the seller should consider disclosing publicly the exploit or the vulnerability.
  • 89.
    .. MAD scenario . The Zero-dayDilemma . 74/119 .. . This would not make herself worse off . The seller would reduce the buyer incentives to defect in the first place
  • 90.
    .. FD & Brinkmanship . TheZero-day Dilemma . 75/119 .. . To this end, it is important for the 0-Day sellers to have an efficient mean for doing full-disclosure
  • 91.
    .. FD & Brinkmanship . TheZero-day Dilemma . 75/119 .. . To this end, it is important for the 0-Day sellers to have an efficient mean for doing full-disclosure . Not for the sake of bragging rights anymore, but for modern-day brinkmanship
  • 92.
    .. FD & Brinkmanship . TheZero-day Dilemma . 75/119 .. . To this end, it is important for the 0-Day sellers to have an efficient mean for doing full-disclosure . Not for the sake of bragging rights anymore, but for modern-day brinkmanship . As faster the disclosure of the vulnerability, as shorter the window of opportunity to the exploiter and the smaller the Residual payoff (V)
  • 93.
    .. Fair share oftroubles . The Zero-day Dilemma . 76/119 .. . Since July 2002 the Full-Disclosure list experienced a “fair share of legal troubles along the way.” . Posting on a mailing list may transalte in an OPSEC failure, if the anonymity of the submitter is not protected
  • 94.
    .. WhistleDay or ZeroLeaks . TheZero-day Dilemma . 77/119 . A 0-Day disclosure platform . Researchers could use it for full-disclosure . Players in the Zero-day market could use to retaliate against buyers who defect . Insiders would turn to it to expose the secretive trade in intrusion and surveillance technologies . Dub it WhistleDay or ZeroLeaks, if you like
  • 95.
    .. Cooperation is possible . TheZero-day Dilemma . 78/119 . As long as the seller doesn’t play in the Submissive scenario, the buyer is not better off defecting
  • 96.
    .. Cooperation is possible . TheZero-day Dilemma . 78/119 . As long as the seller doesn’t play in the Submissive scenario, the buyer is not better off defecting . In the one-shot sequential 0-Day Dilemma cooperation is possible
  • 97.
    .. Cooperation is possible . TheZero-day Dilemma . 78/119 . As long as the seller doesn’t play in the Submissive scenario, the buyer is not better off defecting . In the one-shot sequential 0-Day Dilemma cooperation is possible . If this is not the case, the rational outcome is the action profile of mutual defection
  • 98.
    .. Cooperation is possible . TheZero-day Dilemma . 78/119 . As long as the seller doesn’t play in the Submissive scenario, the buyer is not better off defecting . In the one-shot sequential 0-Day Dilemma cooperation is possible . If this is not the case, the rational outcome is the action profile of mutual defection . “We have to distrust each other. It’s our only defense against betrayal.” — Tennessee Williams
  • 99.
    .. Cooperation is possible . TheZero-day Dilemma . 78/119 . As long as the seller doesn’t play in the Submissive scenario, the buyer is not better off defecting . In the one-shot sequential 0-Day Dilemma cooperation is possible . If this is not the case, the rational outcome is the action profile of mutual defection . “We have to distrust each other. It’s our only defense against betrayal.” — Tennessee Williams . “The dilemma then is that mutual cooperation yields a better outcome than mutual defection but it is not the rational outcome because the choice to cooperate, at the individual level, is not rational from a self-interested point of view.”
  • 100.
    .. Cooperation as anEquilibrium . The Zero-day Dilemma . 79/119 If no form of punishment can be undertaken by the seller, can the cooperative outcome still be sustained as an equilibrium?
  • 101.
    .. Iterated 0-Day Dilemma . TheZero-day Dilemma . 80/119 . The Iterated 0-Day Dilemma (I0DD) is a repeated game, where the 0-Day Dilemma is the stage game. Agents play the 0-Day Dilemma game an indefinite number of times
  • 102.
    .. Iterated 0-Day Dilemma . TheZero-day Dilemma . 80/119 . . The Iterated 0-Day Dilemma (I0DD) is a repeated game, where the 0-Day Dilemma is the stage game. Agents play the 0-Day Dilemma game an indefinite number of times Remark: Whenever the Submissive scenario applies, the I0DD reduces to the Iterated Prisoner’s Dilemma
  • 103.
    .. Three settings . The Zero-dayDilemma . 81/119 . .. . Onymous: The traders know the identity of the party they are dealing with
  • 104.
    .. Three settings . The Zero-dayDilemma . 81/119 .. . Onymous: The traders know the identity of the party they are dealing with . Anonymous: Trades takes place among strangers
  • 105.
    .. Three settings . The Zero-dayDilemma . 81/119 .. . Onymous: The traders know the identity of the party they are dealing with . Anonymous: Trades takes place among strangers . Semi-anonymous: Either the buyer or the seller is anonymous
  • 106.
    .. Cooperation is possiblein onymous economies . The Zero-day Dilemma . 82/119 .. Aumann, Robert (1959). “Acceptable points in general cooperative n-person games”. In Luce, R. D.; Tucker, A. W. Contributions to the Theory 23 of Games IV. Annals of Mathematics Study 40. Princeton NJ: Princeton University Press. pp. 287–324. MR 0104521.
  • 107.
    .. William Press andFreeman Dyson . The Zero-day Dilemma . 83/119 ...
  • 108.
    .. Sentient Player . The Zero-dayDilemma . 84/119 .. . Power granted to a sentient player . A player with a theory of mind . Who realize that her behavior can influence her opponents’ strategies
  • 109.
    .. Zero Determinant (ZD)Strategies . The Zero-day Dilemma . 85/119 ...
  • 110.
    .. Extortion . The Zero-day Dilemma . 86/119 .. Ifone trader is aware of ZD strategies, but the opponent is an evoutionary player then the former can choose to extort the latter
  • 111.
    .. Evolutionary players . The Zero-dayDilemma . 87/119 .. A player is said to be evolutionary is she posses no theory of mind and instead simply seeks to adjust her strategy to maximize her own score in response to whatever the adversary is doing
  • 112.
    .. Extortion strategies . The Zero-dayDilemma . 88/119 . Grant a disproportionate number of high payoffs to the extortionist . It is the victim’s best interest to cooperate with the extortionist, because she is able to increase her score by doing so . In so doing, she ends up increasing the extortionist’s score even more than her own . She will never catch up to the extortionist, and she will accede to her extortionist because it pays her to do so
  • 113.
    .. An extortionist relation . TheZero-day Dilemma . 89/119 Sx − P = 3(Sy − P)
  • 114.
    .. Extortionist strategy: Example . TheZero-day Dilemma . 90/119 .. . Let R = 3, T = 5, P = 1, S = 0 . Let the desired payoff relation be Sx − P = 3(Sy − P) . If we both cooperated last time, then I cooperate with probability 11/13 . If I cheated you last time (you cooperated and I defected), then I cooperate with probability 7/26 . If you cheated me last time (I cooperated and you defected), then I cooperate with probability 1/2 . If we both defected last time, I defect . On average over the long run, my score minus one will be thrice your score minus one
  • 115.
    .. Press and Dyson . TheZero-day Dilemma . 91/119 ..
  • 116.
    .. IPD == UltimatumGame . The Zero-day Dilemma . 92/119 .. If both players are sentient, but only one is aware of ZD-Strategies, then the IPD reduces to the Ultimatum Game
  • 117.
    .. IPD == UltimatumGame . The Zero-day Dilemma . 93/119 .. . Let’s suppose both players are sentient . Let’s suppose the buyer only knows about ZD-strategies . The buyer tries to extort the seller . The seller eventually notice . The seller decide to sabotage the scores of both . This is an Ultimatum Game. The buyer proposes an unfair ultimatum. And the seller respond.
  • 118.
    .. Generous ZD-Strategies . The Zero-dayDilemma . 94/119 .. . If both players are sentient and witting of ZD-Strategies, then they can agree on playing a Generous ZD-Strategy
  • 119.
    .. Generous ZD-Strategies . The Zero-dayDilemma . 94/119 .. . If both players are sentient and witting of ZD-Strategies, then they can agree on playing a Generous ZD-Strategy . In fact any tentative to extort the opponent would result in a low payoff for both
  • 120.
    .. Generous ZD-Strategies . The Zero-dayDilemma . 94/119 .. . If both players are sentient and witting of ZD-Strategies, then they can agree on playing a Generous ZD-Strategy . In fact any tentative to extort the opponent would result in a low payoff for both . It is rational to agree on a fair cooperation strategy
  • 121.
    .. Generous ZD-Strategies . The Zero-dayDilemma . 94/119 .. . If both players are sentient and witting of ZD-Strategies, then they can agree on playing a Generous ZD-Strategy . In fact any tentative to extort the opponent would result in a low payoff for both . It is rational to agree on a fair cooperation strategy . They agree to unilaterally set the other’s score to an agreed value (presumably the maximum possible)
  • 122.
    .. Generous ZD-Strategies . The Zero-dayDilemma . 94/119 .. . If both players are sentient and witting of ZD-Strategies, then they can agree on playing a Generous ZD-Strategy . In fact any tentative to extort the opponent would result in a low payoff for both . It is rational to agree on a fair cooperation strategy . They agree to unilaterally set the other’s score to an agreed value (presumably the maximum possible) . Neither player can then improve her score by violating the strategy
  • 123.
    .. Generous ZD-Strategies . The Zero-dayDilemma . 94/119 .. . If both players are sentient and witting of ZD-Strategies, then they can agree on playing a Generous ZD-Strategy . In fact any tentative to extort the opponent would result in a low payoff for both . It is rational to agree on a fair cooperation strategy . They agree to unilaterally set the other’s score to an agreed value (presumably the maximum possible) . Neither player can then improve her score by violating the strategy . Each is punished for any purely malicious violation
  • 124.
    .. A generous relation . TheZero-day Dilemma . 95/119 Sx − R = 2(Sy − R)
  • 125.
    .. Generous ZD-strategy: Example . TheZero-day Dilemma . 96/119 .. . Let R = 3, T = 5, P = 1, S = 0 . Let the desired payoff relation be Sx − R = 2(Sy − R) . If we both cooperated last time, then I cooperate . If I cheated you last time (you cooperated and I defected), then I cooperate with probability 8/10 . If you cheated me last time (I cooperated and you defected), then I cooperate with probability 3/10 . If we both defected last time, I cooperate with probability 2/10 . On average over the long run, my score minus three will be twice your score minus three
  • 126.
    .. Under the assumption... . TheZero-day Dilemma . 97/119 .. . Ascribe past actions to the same market participants . Choose strategies according to the outcome of past interactions
  • 127.
    .. Anonymous Black Market . TheZero-day Dilemma . 98/119 .. . Is cooperation possible in anonymous zero-day markets?
  • 128.
    .. Anonymous Black Market . TheZero-day Dilemma . 98/119 .. . Is cooperation possible in anonymous zero-day markets? . Do you believe it is?
  • 129.
    .. Anonymous Black Market . TheZero-day Dilemma . 98/119 .. . Is cooperation possible in anonymous zero-day markets? . Do you believe it is? . If yes, which institutions for monitoring and enforcement promote cooperation in this setting?
  • 130.
    .. Cooperation among Strangers . TheZero-day Dilemma . 99/119 ..
  • 131.
    .. Anonymous Economies: Cameraand Casari 1 . The Zero-day Dilemma . 100/119 .. . Cooperation is high and increases with experience
  • 132.
    .. Anonymous Economies: Cameraand Casari 1 . The Zero-day Dilemma . 100/119 .. . Cooperation is high and increases with experience . Low degree of cooperation when subject see aggregate outcomes without observing identities (e.g., as might result from discussing trading experiences in anonymous fora)
  • 133.
    .. Anonymous Economies: Cameraand Casari 1 . The Zero-day Dilemma . 100/119 .. . Cooperation is high and increases with experience . Low degree of cooperation when subject see aggregate outcomes without observing identities (e.g., as might result from discussing trading experiences in anonymous fora) . Costly personal punishment significantly promotes cooperation
  • 134.
    .. Anonymous Economies: Cameraand Casari 2 . The Zero-day Dilemma . 101/119 .. . Subject were given the possibility to observe actions and outcomes in their game and to inflict, at a cost, a loss in the earnings of the defecting opponent
  • 135.
    .. Anonymous Economies: Cameraand Casari 2 . The Zero-day Dilemma . 101/119 .. . Subject were given the possibility to observe actions and outcomes in their game and to inflict, at a cost, a loss in the earnings of the defecting opponent . Camera and Casari added a second stage in the one-shot game
  • 136.
    .. Anonymous Economies: Cameraand Casari 2 . The Zero-day Dilemma . 101/119 .. . Subject were given the possibility to observe actions and outcomes in their game and to inflict, at a cost, a loss in the earnings of the defecting opponent . Camera and Casari added a second stage in the one-shot game . The retaliation stage resembles in full the Adaptive and MAD scenarios in the 0-Day Dilemma
  • 137.
    .. Anonymous Economies: Cameraand Casari 3 . The Zero-day Dilemma . 102/119 .. . The player who obseverd the opponent defect sometimes employed personal punishment (i.e., in-match retaliation), while staying in cooperative mode in the following periods
  • 138.
    .. Anonymous Economies: Cameraand Casari 3 . The Zero-day Dilemma . 102/119 .. . The player who obseverd the opponent defect sometimes employed personal punishment (i.e., in-match retaliation), while staying in cooperative mode in the following periods . Players show preference for in-match retaliation over the (equilibrium) informal retaliation
  • 139.
    .. Anonymous Economies: Cameraand Casari 3 . The Zero-day Dilemma . 102/119 .. . The player who obseverd the opponent defect sometimes employed personal punishment (i.e., in-match retaliation), while staying in cooperative mode in the following periods . Players show preference for in-match retaliation over the (equilibrium) informal retaliation . Efficiency: defectors who had been punished by a cooperator were more likely to cooperate in the following periods (34.5% vs 24.1%)
  • 140.
    .. Punishment as aPublic Good . The Zero-day Dilemma . 103/119 .. . It significantly increases cooperation
  • 141.
    .. Punishment as aPublic Good . The Zero-day Dilemma . 103/119 .. . It significantly increases cooperation . The subject that benefit the most are cooperator who punish little or not at all
  • 142.
    .. Hacking Team . The Zero-dayDilemma . 104/119 ..
  • 143.
    .. Hacking Team leakedcorrespondence . The Zero-day Dilemma . 105/119 ..
  • 144.
    .. Poll . The Zero-day Dilemma . 106/119 Wasthe COO’s intuition correct?
  • 145.
    .. Poll . The Zero-day Dilemma . 107/119 CanHacking Team trust anonymous 0-day sellers?
  • 146.
    .. Poll . The Zero-day Dilemma . 108/119 Ifyou were in their place, would you have trusted an anonymous seller with supplying an 0-day?
  • 147.
    .. Semi-anonymous Zero-day markets . TheZero-day Dilemma . 109/119 .. . If only one party is anonymous, the onymous counterpart has not ability to know if she already had any deals with the same participant
  • 148.
    .. Semi-anonymous Zero-day markets . TheZero-day Dilemma . 109/119 .. . If only one party is anonymous, the onymous counterpart has not ability to know if she already had any deals with the same participant . The latter can’t benefit from being sentient and is forced to choose her strategies as an evolutionary player would do
  • 149.
    .. Semi-anonymous Zero-day markets . TheZero-day Dilemma . 109/119 .. . If only one party is anonymous, the onymous counterpart has not ability to know if she already had any deals with the same participant . The latter can’t benefit from being sentient and is forced to choose her strategies as an evolutionary player would do . If the anonymous party knows about the ZD-strategies, she can choose to extort the opponent
  • 150.
    .. Semi-anonymous Zero-day markets . TheZero-day Dilemma . 109/119 .. . If only one party is anonymous, the onymous counterpart has not ability to know if she already had any deals with the same participant . The latter can’t benefit from being sentient and is forced to choose her strategies as an evolutionary player would do . If the anonymous party knows about the ZD-strategies, she can choose to extort the opponent . Hence, while cooperation can emerge in fully-anonymous markets, extortion can profilate in the semi-anonymous economies
  • 151.
    .. To sum up . TheZero-day Dilemma . 110/119 . Zero-day markets can achieve cooperation even in absence of trusted-third parties
  • 152.
    .. To sum up . TheZero-day Dilemma . 110/119 . Zero-day markets can achieve cooperation even in absence of trusted-third parties . Cooperation can be sustained even when traders are anonymous
  • 153.
    .. To sum up . TheZero-day Dilemma . 110/119 . Zero-day markets can achieve cooperation even in absence of trusted-third parties . Cooperation can be sustained even when traders are anonymous . Punishment is an effective instrument to discourage traders from defecting
  • 154.
    .. To sum up . TheZero-day Dilemma . 110/119 . Zero-day markets can achieve cooperation even in absence of trusted-third parties . Cooperation can be sustained even when traders are anonymous . Punishment is an effective instrument to discourage traders from defecting . It is possible to get extorted, if the adversary knows about ZD-Strategies and we simply seek to adjust our strategy to maximize our own profit
  • 155.
  • 156.
    .. Recommendations . Recommendations . 112/119 1. Do notdeal with anonymous traders, if you cannot ensure your own anonymity
  • 157.
    .. Recommendations . Recommendations . 112/119 1. Do notdeal with anonymous traders, if you cannot ensure your own anonymity 2. Discourage defection by practicing brinkmanship or casting the shadow of the future in every decision of your counterpart
  • 158.
    .. Recommendations . Recommendations . 112/119 1. Do notdeal with anonymous traders, if you cannot ensure your own anonymity 2. Discourage defection by practicing brinkmanship or casting the shadow of the future in every decision of your counterpart 3. Respond: Consider punishing defection to promote cooperation
  • 159.
    .. Recommendations . Recommendations . 112/119 1. Do notdeal with anonymous traders, if you cannot ensure your own anonymity 2. Discourage defection by practicing brinkmanship or casting the shadow of the future in every decision of your counterpart 3. Respond: Consider punishing defection to promote cooperation 4. Let the seller supply the vulnerability first, if interested in a one-time deal
  • 160.
    .. Recommendations . Recommendations . 112/119 1. Do notdeal with anonymous traders, if you cannot ensure your own anonymity 2. Discourage defection by practicing brinkmanship or casting the shadow of the future in every decision of your counterpart 3. Respond: Consider punishing defection to promote cooperation 4. Let the seller supply the vulnerability first, if interested in a one-time deal 5. Learn about Zero Determinant strategies, if playing in an onymous market
  • 161.
    .. Recommendations . Recommendations . 112/119 1. Do notdeal with anonymous traders, if you cannot ensure your own anonymity 2. Discourage defection by practicing brinkmanship or casting the shadow of the future in every decision of your counterpart 3. Respond: Consider punishing defection to promote cooperation 4. Let the seller supply the vulnerability first, if interested in a one-time deal 5. Learn about Zero Determinant strategies, if playing in an onymous market 6. Grim trigger: forever defect, if you see defection while playing in an anonymous market and have no ability to punish the opponent
  • 162.
  • 163.
  • 164.
  • 165.
    .. “ Though I amo en in the depths of misery, there is still calmness, pure harmony and music inside me. Vincent van Gogh.. ”
  • 166.
    .. “ Though we areo en in the depths of insecurity, there is still calmness, pure harmony and music inside us. .. ”
  • 167.
  • 168.
  • 169.
  • 170.
    .. BeeWise . Backup . 121/119 .. . BeeWise isthe first prediction market for forecasting security events and trends . More specifically, it is a security-event futures exchange where participants trade contracts whose payoffs are tied to future events in information security, such as the discovery of a given so ware vulnerability, a security incident, or the diffusion of new malware
  • 171.
    .. BeeWise . Backup . 121/119 .. . With alarge enough number of people betting on the outcome of selected events, the prices of the contracts will be an approximate measure of the probability of the underlying events at any time. The ability to use market prices as forward-looking indicators of security properties will help in establishing information symmetry between buyers and sellers (ie., build a quality signal), and help security stakeholders to make better and more informed decisions, by telling mediocre security products from good ones