May 10, 2012: Internet security efforts are increasingly relying on lots of cash with which to buy information that can protect networks. That's because Cyber War (attacks on computer networks, usually via the Internet) requires ammunition, and the most common form of ammo is "Zero Day Exploits" (ZDEs). These are freshly discovered and exploitable defects in software that runs on the Internet. These flaws enable a hacker to get into other people's networks and PCs. In the right hands these flaws enable criminals to pull off a large online heist or simply maintain secret control over someone's computer.

An increasing number of large sites, like Facebook, are offering rewards for ZDEs that enable hackers to harm Facebook and its users. Since a lot of Internet experts and hackers are Facebook users, there are a lot of qualified ZDE finders out there with multiple incentives to find and report Facebook vulnerabilities. But even Facebook security people realize that ZDEs are valuable commodities and you have to pay the going rate if you want to be a competitive buyer. Thus the "auction of doom" angle. If the potential payday is big enough even the biggest Facebook fan will be tempted to sell a very valuable ZDE that could do great damage to Facebook.

ZDEs are rare. They are in great demand and are increasingly expensive to find, or buy, from legitimate researchers or on the hacker black market. The price of ZDEs varies a lot. That's because not all vulnerabilities are equal. Some are much more valuable than others because they are more effective or allow attacks on a larger number of targets. Commercial Internet security firms offer rewards to people (usually software engineers who spend too much time on the Internet) who first discover a "zero day vulnerability", as do governments and many other firms with a big interest in Internet security. The rewards for really good ZDEs can sometimes exceed a million dollars. The commercial security firms, which provide services for corporate and government clients, offer the rewards openly. There is a more lucrative underground market, financed by criminals and some governments that offer even larger rewards.

Many ZDEs are specific to a particular website. That's because each website has some unique characteristics that creates ZDEs that are rare or only show up on that particular site. This is particularly true of heavily defended sites, like those of financial institutions or mega sites like Facebook.

The users, especially large companies, get after the software publishers to find and fix the bugs quickly. This rarely happens, and discovering and fixing these vulnerabilities usually takes several months and sometimes as long as a year or more. This is largely because fixing these bugs is expensive and publishers don't want to risk creating new ones. The publishers know that every time they open their source code to repair something there is high risk of creating more bugs. Moreover, it's expensive to fix the bug, test the patched software, and then distribute it to their customers. Thus, unless the bug is highly likely to be exploited, it is not attended to right away. The problem with this approach is that the software publisher may not be aware of how exploitable the bug is. Criminals and Cyber Warriors have an interest in finding ways to exploit bugs that appear relatively harmless. That turns the bug into ammunition, for the Cyber War, and a way to make money, for the criminals. Those protecting large or critical (banks, intelligence agencies) websites will usually fix problems very quickly. It's the software companies that don't have a similar incentive to move fast.

For over a decade now Cyber War and criminal hackers have secretly placed programs ("malware") in computers belonging to corporations or government agencies. These programs ("Trojan horses") turn the infected PCs into "zombies" (or "bots") which are under the control of the people who plant them (the "botmasters"). Such control allows the botmaster to steal, modify, or destroy data or shut down the computer systems the zombies are on. You infect new PCs and turn them into zombies by using ZDEs. This is a big business, although a lot of that business is delivering spam. But mixed in with all the garden variety criminality is a lot of corporate and military espionage.

Cyber War commanders are resigned to the fact that they will have to use mercenaries if they want to survive any future Internet based conflict. Much use is being made of mercenaries right now in the race to build up stockpiles of munitions. In Cyber War the ammo is information. That is, knowledge of vulnerabilities in software connected to the Internet or major networks not connected to the Internet. It's feared that China actually has a lead in this area, a lead they will not discuss but that the victims know exists.