Black market rewards could lure antivirus researchers
It’s air-points with a difference — the Zero Day Initiative (ZDI) is a 3Com TippingPoint programme that pays security researchers for finding unpublished vulnerabilities and reporting them to TippingPoint.
ZDI stacks up points for vulnerabilities reported by researchers — the more vulnerabilities reported the more points awarded. These points are then translated to a status system, where the higher the status the higher the annual bonus, as well as other rewards.
Currently, around 450 researchers are signed up to the ZDI programme, according to Bruce Cossill, 3Com’s New Zealand country manager. 3Com buys the information from the researcher and then provides its customers with a filter, or a vaccine, for the vulnerability through its intrusion prevention technology. The company also notifies the affected product vendor that there is a problem. Later, 3Com shares this vulnerability information with other security vendors, before making a public announcement.
