5 ms·

That's what I was thinking. $100k for this sounds low.

by hrrsn 10y ago

Royalaid 10y ago
While crafting the exploit may seem like the hard part I can imagine trying to market it and get paid can be very difficult too.
roel_v 10y ago
Say you have such an exploit. How do you propose making money from it? Exactly what steps would you take?
- sillysaurus3 10y ago
  There are various security broker companies that governments work with. An unscrupulous pentester could find one, email them, and ask them if they're interested. The trouble would be how to prove the exploit works without also revealing how it's done. The best bet would be to demo one or two out of the three exploits required to work, then talk business in exchange for the third.
  - jacquesm 10y ago
    Business transactions between parties that don't trust each other is a solved problem: escrow.
    - alexkon 10y ago
      Does escrow really work with secrets like this? The buyer receives the exploit and claims it doesn’t work. The seller claims it does. The money is still in escrow. How do you proceed? The escrow agent is getting a commission, they should not have access to the full secret. It’s really hard to find an escrow agent who has the skills to assess an exploit and whom both the buyer and the seller would trust not to leak it or use it for their own benefit.
      - jacquesm 10y ago
        You could have the inspection done by an independent. Anyway, it's been done before by guess-who: https://www.mitnicksecurity.com/shopping/absolute-zero-day-exploit-exchange https://www.mitnicksecurity.com/shopping/absolute-zero-day-e...
    - andrepd 10y ago
      Does escrow really work with shady black hat deals like these?
      - jacquesm 10y ago
        Depends on who the buyer is and yes, it does work, there are even specialized marketplaces. You'd still be dealing with the devil but you very likely will get paid.
- fragmede 10y ago
  Find the sketchiest ad networks (http://krebsonsecurity.com/ http://krebsonsecurity.com/ has lots of reading and links). You'll need to front some cash to buy bitcoin to buy time on those ad networks. Put your "ad" consisting of this exploit on the network, which then manages to root both the machine visiting the web page, and the VMWare host machine. Use this to build a botnet. Given how juicy the VMWare escape is, I'd also just start dumping ~/Documents/ on any machine that you escape out from the guest OS on. Who knows what they'll have? It's mostly going to be boring, so you'll want to automate this, but infect enough machines and you'll hit easy scammer pay dirt- PII on millions of people, despite regulations that prohibit doing this. Credit cards, social security numbers, phone numbers, addresses. From there, it's just a felony or two away from either stealing people's identities yourself, or selling the list in a scam forum (for way more than $100k). There are all sorts of juicy data that you might find; VMWare isn't something that most people run, and maybe there are other monetizable bits of data. Assuming you don't find the scammers' wet dream in stolen data though, you're reduced to trying to monetize from other ways. Desktop popups, DDoS for hire, cryptolocker-style data-ransom, using the machine as a host for sending spam. It's 2017 and it really sucks that spam is still such a huge problem (Gmail's spam filter is only so effective because Google's team works hard, and is good at their job, not because the problem has gone away). As a spammer though, this means it's still lucrative enough that there's some non-zero amount of money to be made. Due to the VMWare escape involved, you'll have fewer problems with machines in your botnet going offline (how often do you reimage a VMWare host compared to the guests on it?) and can charge more money to use it too. There are established scammer networks that can already monetize a botnet and selling your botnet and its capabilities to them might be easier than monetizing yourself, but at some level in order to make money you start getting some serious exposure that will land you in prison for years if you get caught, plus you'll eventually start working with scary people that will kill you if it suits them.
  - MichaelGG 10y ago
    I think you're vastly overestimating the number of VMware backed browsers as well as the money to be made in a botnet. As well as the effort in actually setting all this up and maintaining opsec. I'm also not convinced a VMware escape is something people get killed over. The leaked "Hacking Team" data shows exploits aren't worth that much more on the market (iOS being a big exception).
joeyspn 10y ago
For me $100k sounds almost like a joke... specially when it puts billion-dollar companies to shame.
dageshi 10y ago
Perhaps they think the exposure they'll get from this is worth it.

That's what I was thinking. $100k for this sounds low.

by hrrsn 10y ago

That's what I was thinking. $100k for this sounds low.

While crafting the exploit may seem like the hard part I can imagine trying to market it and get paid can be very difficult too.

roel_v 10y ago

Say you have such an exploit. How do you propose making money from it? Exactly what steps would you take?

sillysaurus3 10y ago
There are various security broker companies that governments work with. An unscrupulous pentester could find one, email them, and ask them if they're interested. The trouble would be how to prove the exploit works without also revealing how it's done. The best bet would be to demo one or two out of the three exploits required to work, then talk business in exchange for the third.
- jacquesm 10y ago
  Business transactions between parties that don't trust each other is a solved problem: escrow.
  - alexkon 10y ago
    Does escrow really work with secrets like this? The buyer receives the exploit and claims it doesn’t work. The seller claims it does. The money is still in escrow. How do you proceed? The escrow agent is getting a commission, they should not have access to the full secret. It’s really hard to find an escrow agent who has the skills to assess an exploit and whom both the buyer and the seller would trust not to leak it or use it for their own benefit.
    - jacquesm 10y ago
      You could have the inspection done by an independent. Anyway, it's been done before by guess-who: https://www.mitnicksecurity.com/shopping/absolute-zero-day-exploit-exchange https://www.mitnicksecurity.com/shopping/absolute-zero-day-e...
  - andrepd 10y ago
    Does escrow really work with shady black hat deals like these?
    - jacquesm 10y ago
      Depends on who the buyer is and yes, it does work, there are even specialized marketplaces. You'd still be dealing with the devil but you very likely will get paid.
fragmede 10y ago
Find the sketchiest ad networks (http://krebsonsecurity.com/ http://krebsonsecurity.com/ has lots of reading and links). You'll need to front some cash to buy bitcoin to buy time on those ad networks. Put your "ad" consisting of this exploit on the network, which then manages to root both the machine visiting the web page, and the VMWare host machine. Use this to build a botnet. Given how juicy the VMWare escape is, I'd also just start dumping ~/Documents/ on any machine that you escape out from the guest OS on. Who knows what they'll have? It's mostly going to be boring, so you'll want to automate this, but infect enough machines and you'll hit easy scammer pay dirt- PII on millions of people, despite regulations that prohibit doing this. Credit cards, social security numbers, phone numbers, addresses. From there, it's just a felony or two away from either stealing people's identities yourself, or selling the list in a scam forum (for way more than $100k). There are all sorts of juicy data that you might find; VMWare isn't something that most people run, and maybe there are other monetizable bits of data. Assuming you don't find the scammers' wet dream in stolen data though, you're reduced to trying to monetize from other ways. Desktop popups, DDoS for hire, cryptolocker-style data-ransom, using the machine as a host for sending spam. It's 2017 and it really sucks that spam is still such a huge problem (Gmail's spam filter is only so effective because Google's team works hard, and is good at their job, not because the problem has gone away). As a spammer though, this means it's still lucrative enough that there's some non-zero amount of money to be made. Due to the VMWare escape involved, you'll have fewer problems with machines in your botnet going offline (how often do you reimage a VMWare host compared to the guests on it?) and can charge more money to use it too. There are established scammer networks that can already monetize a botnet and selling your botnet and its capabilities to them might be easier than monetizing yourself, but at some level in order to make money you start getting some serious exposure that will land you in prison for years if you get caught, plus you'll eventually start working with scary people that will kill you if it suits them.
- MichaelGG 10y ago
  I think you're vastly overestimating the number of VMware backed browsers as well as the money to be made in a botnet. As well as the effort in actually setting all this up and maintaining opsec. I'm also not convinced a VMware escape is something people get killed over. The leaked "Hacking Team" data shows exploits aren't worth that much more on the market (iOS being a big exception).

joeyspn 10y ago

For me $100k sounds almost like a joke... specially when it puts billion-dollar companies to shame.

dageshi 10y ago

Perhaps they think the exposure they'll get from this is worth it.