5 ms·

A set of exploits like the 3 described could be worth quite a bit on the open market. I'm surprised how low the bounty was for a full vmware escape starting fro

by jtchang 10y ago

A set of exploits like the 3 described could be worth quite a bit on the open market. I'm surprised how low the bounty was for a full vmware escape starting from a browser. Surely there are other exploits like this out in the wild under government lock and key.

hrrsn 10y ago
That's what I was thinking. $100k for this sounds low.
- Royalaid 10y ago
  While crafting the exploit may seem like the hard part I can imagine trying to market it and get paid can be very difficult too.
- roel_v 10y ago
  Say you have such an exploit. How do you propose making money from it? Exactly what steps would you take?
  - sillysaurus3 10y ago
    There are various security broker companies that governments work with. An unscrupulous pentester could find one, email them, and ask them if they're interested. The trouble would be how to prove the exploit works without also revealing how it's done. The best bet would be to demo one or two out of the three exploits required to work, then talk business in exchange for the third.
    - jacquesm 10y ago
      Business transactions between parties that don't trust each other is a solved problem: escrow.
      - alexkon 10y ago
        Does escrow really work with secrets like this? The buyer receives the exploit and claims it doesn’t work. The seller claims it does. The money is still in escrow. How do you proceed? The escrow agent is getting a commission, they should not have access to the full secret. It’s really hard to find an escrow agent who has the skills to assess an exploit and whom both the buyer and the seller would trust not to leak it or use it for their own benefit.
        jacquesm 10y ago
        You could have the inspection done by an independent. Anyway, it's been done before by guess-who: https://www.mitnicksecurity.com/shopping/absolute-zero-day-exploit-exchange https://www.mitnicksecurity.com/shopping/absolute-zero-day-e...
      - andrepd 10y ago
        Does escrow really work with shady black hat deals like these?
        jacquesm 10y ago
        Depends on who the buyer is and yes, it does work, there are even specialized marketplaces. You'd still be dealing with the devil but you very likely will get paid.
  - fragmede 10y ago
    Find the sketchiest ad networks (http://krebsonsecurity.com/ http://krebsonsecurity.com/ has lots of reading and links). You'll need to front some cash to buy bitcoin to buy time on those ad networks. Put your "ad" consisting of this exploit on the network, which then manages to root both the machine visiting the web page, and the VMWare host machine. Use this to build a botnet. Given how juicy the VMWare escape is, I'd also just start dumping ~/Documents/ on any machine that you escape out from the guest OS on. Who knows what they'll have? It's mostly going to be boring, so you'll want to automate this, but infect enough machines and you'll hit easy scammer pay dirt- PII on millions of people, despite regulations that prohibit doing this. Credit cards, social security numbers, phone numbers, addresses. From there, it's just a felony or two away from either stealing people's identities yourself, or selling the list in a scam forum (for way more than $100k). There are all sorts of juicy data that you might find; VMWare isn't something that most people run, and maybe there are other monetizable bits of data. Assuming you don't find the scammers' wet dream in stolen data though, you're reduced to trying to monetize from other ways. Desktop popups, DDoS for hire, cryptolocker-style data-ransom, using the machine as a host for sending spam. It's 2017 and it really sucks that spam is still such a huge problem (Gmail's spam filter is only so effective because Google's team works hard, and is good at their job, not because the problem has gone away). As a spammer though, this means it's still lucrative enough that there's some non-zero amount of money to be made. Due to the VMWare escape involved, you'll have fewer problems with machines in your botnet going offline (how often do you reimage a VMWare host compared to the guests on it?) and can charge more money to use it too. There are established scammer networks that can already monetize a botnet and selling your botnet and its capabilities to them might be easier than monetizing yourself, but at some level in order to make money you start getting some serious exposure that will land you in prison for years if you get caught, plus you'll eventually start working with scary people that will kill you if it suits them.
    - MichaelGG 10y ago
      I think you're vastly overestimating the number of VMware backed browsers as well as the money to be made in a botnet. As well as the effort in actually setting all this up and maintaining opsec. I'm also not convinced a VMware escape is something people get killed over. The leaked "Hacking Team" data shows exploits aren't worth that much more on the market (iOS being a big exception).
- joeyspn 10y ago
  For me $100k sounds almost like a joke... specially when it puts billion-dollar companies to shame.
- dageshi 10y ago
  Perhaps they think the exposure they'll get from this is worth it.
ctz 10y ago
Do you really believe that this team has the skills and knowledge to find these bugs and construct working exploits for them, but then don't understand the exploit market? Or, that they act against their own best economic interests?
- nickik 10y ago
  It can be in your long run interest not to sell attacks on companies on the open market. That is shady stuff and not worth it for many people.
- jacquesm 10y ago
  > but then don't understand the exploit market? Or, that they act against their own best economic interests? Maybe they're just ethical by nature. If I could make lots of money by breaking the law or doing something un-ethical I (and in fact the vast majority of people) still wouldn't do it. Money isn't the only motivating factor. So it is very well possible these exploits would have been worth more on the open market and still the team decided to work on this in a white-hat setting because they are simply good people.
  - chrischen 10y ago
    They could sell it to the US Government.
    - jacquesm 10y ago
      That would not be ethical either.
      - notgood 10y ago
        Given the current administration and political climate giving it to the government would be even more unethical. Specially because criminals don't have the funds the NSA does, and they are 100% guaranteed to get away with any wrongdoing
mobiplayer 10y ago
It's not high because it is VMware Workstation, not ESXi.

by jtchang 10y ago

hrrsn 10y ago

That's what I was thinking. $100k for this sounds low.

Royalaid 10y ago
While crafting the exploit may seem like the hard part I can imagine trying to market it and get paid can be very difficult too.
roel_v 10y ago
Say you have such an exploit. How do you propose making money from it? Exactly what steps would you take?
- sillysaurus3 10y ago
  There are various security broker companies that governments work with. An unscrupulous pentester could find one, email them, and ask them if they're interested. The trouble would be how to prove the exploit works without also revealing how it's done. The best bet would be to demo one or two out of the three exploits required to work, then talk business in exchange for the third.
  - jacquesm 10y ago
    Business transactions between parties that don't trust each other is a solved problem: escrow.
    - alexkon 10y ago
      Does escrow really work with secrets like this? The buyer receives the exploit and claims it doesn’t work. The seller claims it does. The money is still in escrow. How do you proceed? The escrow agent is getting a commission, they should not have access to the full secret. It’s really hard to find an escrow agent who has the skills to assess an exploit and whom both the buyer and the seller would trust not to leak it or use it for their own benefit.
      - jacquesm 10y ago
        You could have the inspection done by an independent. Anyway, it's been done before by guess-who: https://www.mitnicksecurity.com/shopping/absolute-zero-day-exploit-exchange https://www.mitnicksecurity.com/shopping/absolute-zero-day-e...
    - andrepd 10y ago
      Does escrow really work with shady black hat deals like these?
      - jacquesm 10y ago
        Depends on who the buyer is and yes, it does work, there are even specialized marketplaces. You'd still be dealing with the devil but you very likely will get paid.
- fragmede 10y ago
  Find the sketchiest ad networks (http://krebsonsecurity.com/ http://krebsonsecurity.com/ has lots of reading and links). You'll need to front some cash to buy bitcoin to buy time on those ad networks. Put your "ad" consisting of this exploit on the network, which then manages to root both the machine visiting the web page, and the VMWare host machine. Use this to build a botnet. Given how juicy the VMWare escape is, I'd also just start dumping ~/Documents/ on any machine that you escape out from the guest OS on. Who knows what they'll have? It's mostly going to be boring, so you'll want to automate this, but infect enough machines and you'll hit easy scammer pay dirt- PII on millions of people, despite regulations that prohibit doing this. Credit cards, social security numbers, phone numbers, addresses. From there, it's just a felony or two away from either stealing people's identities yourself, or selling the list in a scam forum (for way more than $100k). There are all sorts of juicy data that you might find; VMWare isn't something that most people run, and maybe there are other monetizable bits of data. Assuming you don't find the scammers' wet dream in stolen data though, you're reduced to trying to monetize from other ways. Desktop popups, DDoS for hire, cryptolocker-style data-ransom, using the machine as a host for sending spam. It's 2017 and it really sucks that spam is still such a huge problem (Gmail's spam filter is only so effective because Google's team works hard, and is good at their job, not because the problem has gone away). As a spammer though, this means it's still lucrative enough that there's some non-zero amount of money to be made. Due to the VMWare escape involved, you'll have fewer problems with machines in your botnet going offline (how often do you reimage a VMWare host compared to the guests on it?) and can charge more money to use it too. There are established scammer networks that can already monetize a botnet and selling your botnet and its capabilities to them might be easier than monetizing yourself, but at some level in order to make money you start getting some serious exposure that will land you in prison for years if you get caught, plus you'll eventually start working with scary people that will kill you if it suits them.
  - MichaelGG 10y ago
    I think you're vastly overestimating the number of VMware backed browsers as well as the money to be made in a botnet. As well as the effort in actually setting all this up and maintaining opsec. I'm also not convinced a VMware escape is something people get killed over. The leaked "Hacking Team" data shows exploits aren't worth that much more on the market (iOS being a big exception).
joeyspn 10y ago
For me $100k sounds almost like a joke... specially when it puts billion-dollar companies to shame.
dageshi 10y ago
Perhaps they think the exposure they'll get from this is worth it.

ctz 10y ago

Do you really believe that this team has the skills and knowledge to find these bugs and construct working exploits for them, but then don't understand the exploit market? Or, that they act against their own best economic interests?

nickik 10y ago
It can be in your long run interest not to sell attacks on companies on the open market. That is shady stuff and not worth it for many people.
jacquesm 10y ago
> but then don't understand the exploit market? Or, that they act against their own best economic interests? Maybe they're just ethical by nature. If I could make lots of money by breaking the law or doing something un-ethical I (and in fact the vast majority of people) still wouldn't do it. Money isn't the only motivating factor. So it is very well possible these exploits would have been worth more on the open market and still the team decided to work on this in a white-hat setting because they are simply good people.
- chrischen 10y ago
  They could sell it to the US Government.
  - jacquesm 10y ago
    That would not be ethical either.
    - notgood 10y ago
      Given the current administration and political climate giving it to the government would be even more unethical. Specially because criminals don't have the funds the NSA does, and they are 100% guaranteed to get away with any wrongdoing

mobiplayer 10y ago

It's not high because it is VMware Workstation, not ESXi.