Search

Objectives: To determine the survival outcomes and to describe the epidemiological characteristics of patients with colorectal cancer (CRC) in western Saudi Arabia. Methods: Our study is a retrospective analysis of patients with CRC diagnosed between 2002 and 2014. We recruited 279 patients who were selected randomly and followed until the end of July 2017. A Kaplan-Meier curve was used to estimate the survival rate for CRC patients according to gender, histopathological pattern, tumor site, and mutation type, taking into consideration time factor, dropouts, and loss to follow-up. Results: The mean age of CRC patients was 57±13 years, and most of them were Saudi (87.5%). Regarding tumor epidemiology, 32.4% of the patients at Best American Joint Committee on Cancer (Best AJCC) stage 4; 28.9% were at stage 3; and 1.2% were at stage zero. The most frequent pathological variant was adenocarcinoma (77.4%); the most affected site was the rectum (40.5%). By Cox regression analysis, age at diagnosis, tumor stage, Kirsten Ras (KRAS) mutation, and lymphovascular invasion were significant prognostic factors for survival in CRC patients. Conclusion: Colorectal cancer patients presented to the hospital late in the disease course. This may call for lowering the screening age, increasing awareness programs, and establishing a national screening program.

Some of the key aspects of vulnerability—discovery, dissemination, and disclosure—have received some attention recently. However, the role of interaction among the vulnerability discoverers and vulnerability acquirers has not yet been adequately addressed. Our study suggests that a major percentage of discoverers, a majority in some cases, are unaffiliated with the software developers and thus are free to disseminate the vulnerabilities they discover in any way they like. As a result, multiple vulnerability markets have emerged. In some of these markets, the exchange is regulated, but in others, there is little or no regulation. In recent vulnerability discovery literature, the vulnerability discoverers have remained anonymous individuals. Although there has been an attempt to model the level of their efforts, information regarding their identities, modes of operation, and what they are doing with the discovered vulnerabilities has not been explored. Reports of buying and selling of the vulnerabilities are now appearing in the press; however, the existence of such markets requires validation, and the natures of the markets need to be analyzed. To address this need, we have attempted to collect detailed information. We have identified the most prolific vulnerability discoverers throughout the past decade and examined their motivation and methods. A large percentage of these discoverers are located in Eastern and Western Europe and in the Far East. We have contacted several of them in order to collect firsthand information regarding their techniques, motivations, and involvement in the vulnerability markets. We examine why many of the discoverers appear to retire after a highly successful vulnerability-finding career. The paper identifies the actual vulnerability markets, rather than the hypothetical ideal markets that are often examined. The emergence of worldwide government agencies as vulnerability buyers has significant implications. We discuss potential factors that can impact the risk to society and the need for detailed exploration., {"references":["C. P. Pfleeger and S. L Pfleeger. Security in Computing, 3rd ed. Prentice Hall PTR, 2003.","O. H. Alhazmi and Y. K. Malaiya, \"Application of Vulnerability Discovery Models to Major Operating Systems,\" IEEE Trans. Reliability, March 2008, pp. 14-22","S.-W. Woo, H. Joh, O. H. Alhazmi and Y. K. Malaiya, \"Modeling Vulnerability Discovery Process in Apache and IIS HTTP Servers\", Computers & Security, January 2011, Pages 50-62.","\"Teen Exploits Three Zero-Day Vulns for $60K Win in Google Chrome Hack Contest | Threat Level | Wired.com,\" Threat Level. (Online). Available: http://www.wired.com/threatlevel/2012/03/zero-days-for-chrome/. (Accessed: 06-Oct-2013).","\"Bug brokers offering higher bounties.\" (Online). Available: http://www.securityfocus.com/news/11437. (Accessed: 06-Oct-2013).","\"Be a Millionaire: The Market for Zero-Day Software Exploits | Critical Start.\" (Online). Available: http://www.criticalstart.com/2012/04/be-a-millionaire-the-market-for-zero-day-software-exploits/. (Accessed: 06-Oct-2013).","R, Anderson, University of Cambridge, Home page. (Online). Available: http://www.cl.cam.ac.uk/~rja14/ (Accessed: 06-Oct-2013).","H.-C. Joh and Y. K. Malaiya, \"Seasonal variation in the vulnerability discovery process,\" in Software Testing Verification and Validation, 2009. ICST'09. International Conference on, 2009, pp. 191–200.","Karthik Kannan and Rahul Telang, Market for Software Vulnerabilities? Think Again, Management Science, Vol. 51, No. 5 (May, 2005), pp. 726-740.\n[10]\t\"White hat,\" Search security. (Online). Available: http://searchsecurity.techtarget.com/definition/white-hat (Accessed: 06-Oct-2013).\n[11]\t\"HacK, CouNterHaCk | New York Times Magazine,\" (Online). Available: http://www.nytimes.com/library/magazine/home/19991003mag-hackers.html. (Accessed: 06-Oct-2013).\n[12]\tC. Miller, \"The legitimate vulnerability market: the secretive world of 0-day exploit sales,\" in Workshop on the Economics of Information Security (WEIS), 2007, pp. 7–8.\n[13]\tD. McKinney, \"Vulnerability Bazaar,\" IEEE Security Privacy, vol. 5, no. 6, pp. 69–73, 2007.\n[14]\tAndy Greenberg, Meet The Hackers Who Sell Spies The Tools To Crack Your PC, Forbes, March 21, 2012, bit.ly/11cbLC6\n[15]\tM. Shahzad, M. Z. Shafiq, and A. X. Liu, \"A large scale exploratory analysis of software vulnerability life cycles,\" in 2012 34th International Conference on Software Engineering (ICSE), 2012, pp. 771–781.\n[16]\tThe Open Source Vulnerability Database. (Online). Available: http://www.osvdb.org. (Accessed: 06-Oct-2013).\n[17]\tArora, A.; Rahul Telang, \"Economics of software vulnerability disclosure,\" Security & Privacy, IEEE, vol.3, no.1, pp.20, 25, Jan.-Feb. 2005.\n[18]\tR. Böhme, \"Vulnerability markets,\" Proc. of 22C3, vol. 27, p. 30, 2005.\n[19]\tR. Anderson, C. Barton, R. Böhme, R. Clayton, M. J. van Eeten, M. Levi, T. Moore, and S. Savage, \"Measuring the cost of cybercrime,\" in 11th Workshop on the Economics of Information Security, 2012.\n[20]\t\"Shopping For Zero-Days: A Price List For Hackers' Secret Software Exploits - Forbes,\" Forbes. (Online). Available: http://www.forbes.com/ sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/. (Accessed: 06-Oct-2013).\n[21]\t\"Google throws stacks of cash at hackers to publicly crack its Chrome browser,\" VentureBeat. (Online). Available: http://venturebeat.com/ 2012/03/08/hackers-crack-chrome-in-publi/. (Accessed: 06-Oct-2013).\n[22]\t\"Cyber-security: The digital arms trade | The Economist.\" (Online). Available: http://www.economist.com/news/business/21574478-market-software-helps-hackers-penetrate-computer-systems-digital-arms-trade. (Accessed: 06-Oct-2013).\n[23]\tA. Ozment, \"Bug auctions: Vulnerability markets reconsidered,\" in Third Workshop on the Economics of Information Security, 2004.\n[24]\tVulnerability Reward Program for Google web properties. (Online). Available: http://www.google.com/about/appsecurity/reward-program/. (Accessed: 21-Jan-2014).\n[25]\tChrome Vulnerability Rewards Program. (Online). Available: http://www.chromium.org/Home/chromium-security/vulnerability-rewards-program. (Accessed: 21-Jan-2014).\n[26]\tThe Mozilla Security Bug Bounty Program. (Online). Available: http://www.mozilla.org/security/bug-bounty.html. (Accessed: 21-Jan-2014).\n[27]\tFacebook rewards program. (Online). Available: https://www.facebook.com/whitehat/bounty/. (Accessed: 21-Jan-2014).\n[28]\tWordpress rewards program. (Online). Available: http://www.whitefirdesign.com/about/wordpress-security-bug-bounty-program.html. (Accessed: 06-Oct-2013).\n[29]\tCCBill Vulnerability Reward Program. (Online). Available: http://www.ccbill.com/developers/security/vulnerability-reward-program.php. (Accessed: 21-Jan-2014].\n[30]\tMicrosoft Bounty Programs. (Online). Available: http://technet.microsoft.com/en-US/security/dn425036. (Accessed: 21-Jan-2014).\n[31]\t\"Microsoft Says No to Paying Bug Bounties,\" Threatpost. (Online). Available: http://threatpost.com/microsoft-says-no-paying-bug-bounties-072210/. (Accessed: 06-Oct-2013).\n[32]\t\"The Shadowy World Of Selling Software Bugs - And How It Makes Us All Less Safe,\" ReadWrite. (Online). Available: http://readwrite.com/ 2012/10/04/the-shadowy-world-of-selling-software-bugs-and-how-it-makes-us-all-less-safe. (Accessed: 06-Oct-2013).\n[33]\tSecunia Vulnerability Coordination Reward Program (SVCRP). (Online). Available: http://secunia.com/community/research/svcrp/. (Accessed: 21-Jan-2014).\n[34]\tZDI Rewards Program. (Online). Available: http://www.zerodayinitiative.com/about/benefits/. (Accessed: 21-Jan-2014).\n[35]\tRyan Gallagher, \"Cyberwar's Gray Market- Should the secretive hacker zero-day exploit market be regulated?\" Slate, Jan. 16, 2013. \n[36]\tMichael Riley and Ashlee Vance \"Cyber Weapons: The New Arms Race\" BloomsbergBusinessWeek, July 20, 2011. \n[37]\t\"Schneier on Security: The Vulnerabilities Market and the Future of Security.\" (Online). Available: https://www.schneier.com/blog/archives/ 2012/06/the_vulnerabili.html. (Accessed: 06-Oct-2013).\n[38]\t\"Stuxnet was work of U.S. and Israeli experts, officials say - The Washington Post.\" (Online). Available: http://www.washingtonpost.com/world/national-security/stuxnet-was-work-of-us-and-israeli-experts-officials-say/2012/06/01/gJQAlnEy6U_story.html. (Accessed: 06-Oct-2013).\n[39]\t\"Black hat greed reducing software vulnerability report rate • The Register.\" (Online). Available: http://www.theregister.co.uk/2013/02/ 26/grey_market_cuts_vulnerability_reporting/. (Accessed: 06-Oct-2013).\n[40]\t\"WabiSabiLabi may close 0day auction site.\" (Online). Available: http://www.networkworld.com/news/2008/103008-wabisabilabi-may-close-0day-auction.html. (Accessed: 06-Oct-2013).\n[41]\tS. Ransbotham, S. Mitra, and J. Ramsey, \"Are markets for vulnerabilities effective?,\" MIS Quarterly-Management Information Systems, vol. 36, no. 1, p. 43, 2012.\n[42]\t\"Cyber Weapons: The New Arms Race - Businessweek.\" (Online). Available: http://www.businessweek.com/magazine/cyber-weapons-the-new-arms-race-07212011.html. (Accessed: 06-Oct-2013).\n[43]\t\"Welcome to the Malware-Industrial Complex | MIT Technology Review.\" (Online). Available: http://www.technologyreview.com/news/ 507971/welcome-to-the-malware-industrial-complex/. (Accessed: 06-Oct-2013).\n[44]\tAlhazmi, O.H.; Malaiya, Y.K., \"Quantitative vulnerability assessment of systems software,\" Reliability and Maintainability Symposium, 2005. Proceedings. Annual, vol., no., pp.615, 620, Jan. 24-27, 2005.\n[45]\tRoss Anderson and Tyler Moore, The Economics of Information Security, Science, 27 October 2006: 314 (5799), 610-613. \n[46]\tBlog of r0t. (Online). Available: http://pridels-team.blogspot.com. (Accessed: 06-Oct-2013).\n[47]\tmain website of Janek Vind \"waraxe\". (Online). Available: http://www.waraxe.us. (Accessed: 06-Oct-2013).\n[48]\tFacebook's account of Lostmon. (Online). Available: https://www.facebook.com/lostmon. (Accessed: 06-Oct-2013).\n[49]\tBlog of Lostmon Lords. (Online). Available: http://lostmon.blogspot.com. (Accessed: 06-Oct-2013).\n[50]\tPersonal website of rgod. (Online). Available: http://retrogod.altervista.org. (Accessed: 06-Oct-2013).\n[51]\tPersonal website of Luigi Auriemma. (Online). Available: http://aluigi.altervista.org. (Accessed: 06-Oct-2013).\n[52]\tFinifter, Matthew,Devdatta Akhawe, and David Wagner.\" An empirical study of vulnerability rewards programs.\"In USENIX Security.2013, 273-288\n[53]\tH. Joh and Y. K. Malaiya, \"Defining and Assessing Quantitative Security Risk Measures Using Vulnerability Lifecycle and CVSS Metrics,'' SAM'11, The 2011 International Conference on Security and Management, pp.10-16, 2011.\n[54]\tReport: Eastern European Hackers More Sophisticated Than Asian Counterparts. (Online). Available: http://blogs.wsj.com/digits/2012/ 09/18/report-eastern-european-hackers-more-sophisticated-than-asian-counterparts/. (Accessed: 06-Oct-2013).\n[55]\t\"GCHQ Establishes Cyber Unit to Detect Software Vulnerabilities - IBTimes UK.\" (Online). Available: http://www.ibtimes.co.uk/articles/ 448951/20130321/gchq-establishes-cyber-research-unit-search-software.htm. (Accessed: 06-Oct-2013).\n[56]\tL. Allodi, W. Shim, and F. Massacci, \"Quantitative assessment of risk reduction with cybercrime black market monitoring\". The 2013 IEEE Security and Privacy Workshops, pp. 165-172, 2013."]}