Some notes on the RAND 0day report

The RAND Corporation has a research report on the 0day market [ * ]. It's pretty good. They talked to all the right people. It should be considered the seminal work on the issue. They've got the pricing about right ($1 million for full chain iPhone exploit, but closer to $100k for others). They've got the stats about right (5% chance somebody else will discover an exploit).

Yet, they've got some problems, namely phrasing the debate as activists want, rather than a neutral view of the debate.

The report frequently uses the word "stockpile". This is a biased term used by activists. According to the dictionary, it means:

a large accumulated stock of goods or materials, especially one held in reserve for use at a time of shortage or other emergency.

Activists paint the picture that the government (NSA, CIA, DoD, FBI) buys 0day to hold in reserve in case they later need them. If that's the case, then it seems reasonable that it's better to disclose/patch the vuln then let it grow moldy in a cyberwarehouse somewhere.

But that's not how things work. The government buys vulns it has immediate use for (primarily). Almost all vulns it buys are used within 6 months. Most vulns in its "stockpile" have been used in the previous year. These cyberweapons are not in a warehouse, but in active use on the front lines.

This is top secret, of course, so people assume it's not happening. They hear about no cyber operations (except Stuxnet), so they assume such operations aren't occurring. Thus, they build up the stockpiling assumption rather than the active use assumption.

If the RAND wanted to create an even more useful survey, they should figure out how many thousands of times per day our government (NSA, CIA, DoD, FBI) exploits 0days. They should characterize who they target (e.g. terrorists, child pornographers), success rate, and how many people they've killed based on 0days. It's this data, not patching, that is at the root of the policy debate.

That 0days are actively used determines pricing. If the government doesn't have immediate need for a vuln, it won't pay much for it, if anything at all. Conversely, if the government has urgent need for a vuln, it'll pay a lot.

Let's say you have a remote vuln for Samsung TVs. You go to the NSA and offer it to them. They tell you they aren't interested, because they see no near term need for it. Then a year later, spies reveal ISIS has stolen a truckload of Samsung TVs, put them in all the meeting rooms, and hooked them to Internet for video conferencing. The NSA then comes back to you and offers $500k for the vuln.

Likewise, the number of sellers affects the price. If you know they desperately need the Samsung TV 0day, but they are only offering $100k, then it likely means that there's another seller also offering such a vuln.

That's why iPhone vulns are worth $1 million for a full chain exploit, from browser to persistence. They use it a lot, it's a major part of ongoing cyber operations. Each time Apple upgrades iOS, the change breaks part of the existing chain, and the government is keen on getting a new exploit to fix it. They'll pay a lot to the first vuln seller who can give them a new exploit.

Thus, there are three prices the government is willing to pay for an 0day (the value it provides to the government):

• the price for an 0day they will actively use right now (high)
• the price for an 0day they'll stockpile for possible use in the future (low)
• the price for an 0day they'll disclose to the vendor to patch (very low)

That these are different prices is important to the policy debate. When activists claim the government should disclose the 0day they acquire, they are ignoring the price the 0day was acquired for. Since the government actively uses the 0day, they are acquired for a high-price, with their "use" value far higher than their "patch" value. It's an absurd argument to make that they government should then immediately discard that money, to pay "use value" prices for "patch" results.

If the policy becomes that the NSA/CIA should disclose/patch the 0day they buy, it doesn't mean business as usual acquiring vulns. It instead means they'll stop buying 0day.

In other words, "patching 0day" is not an outcome on either side of the debate. Either the government buys 0day to use, or it stops buying 0day. In neither case does patching happen.

The real argument is whether the government (NSA, CIA, DoD, FBI) should be acquiring, weaponizing, and using 0day in the first place. It demands that we unilaterally disarm our military, intelligence, and law enforcement, preventing them from using 0days against our adversaries while our adversaries continue to use 0days against us.

That's the gaping hole in both the RAND paper and most news reporting of this controversy. They characterize the debate the way activists want, as if the only question is the value of patching. They avoid talking about unilateral cyberdisarmament, even though that's the consequence of the policy they are advocating. They avoid comparing the value of 0days to our country for active use (high) compared to the value to to our country for patching (very low).

Conclusion

It's nice that the RAND paper studied the value of patching and confirmed it's low, that only around 5% of our cyber-arsenal is likely to be found by others. But it'd be nice if they also looked at the point of view of those actively using 0days on a daily basis, rather than phrasing the debate the way activists want.