8 ms·
Exploit broker Zerodium ups the ante with $500k to target Signal and WhatsApp
- tradersam 9y agoWhat a world we live in. I wish humanity made this turn out differently, where digital privacy was a human right, not something worth $100k.
- bluddy 9y agoI'm not sure this isn't a "good thing", to some degree. Companies like Apple and Google offer rewards for people who find exploits in their software, but they have little incentive to raise the reward even as the exploits become more and more rare, and demand more time to find. This may give them the false impression that there are no more exploits, while in reality they just haven't incentivized people sufficiently. This company operates on the other side (of which I don't approve), but by pricing exploits more accurately (via supply and demand), it forces companies to raise their prices as well to compete. In other words, this can be seen as part of the free market incentivizing people and companies to find and patch exploits, or for programmers to just write safer code in general.
- deleted 9y ago[deleted]
- confounded 9y agoCouldn't the same argument be made about a thriving market in ways to break into your house at night and kill you?
- l0b0 9y agoSince the offer is made by a shadowy organisation, how would we know whether it indicates anything reasonable? Companies with money to spare could use it to easily discredit competitors. First, company A offers $X (where $X might be a full-term equivalent salary or more) to a shadow broker for an exploit in company B's product. Likely outcomes include: If an exploit is found, company A can play it for what it's worth, either accusing B of negligent behaviour, sloppy coding, defunct bug award program, etc., or exploiting the bug (via anonymously hired help) for a while, possibly in such a way that company B's customers notice the issue before company B does. If an exploit is not found company A can still accuse company B of negligent behaviour if company B hasn't matched $X in their bug awards. If company B has done everything right company A can pull the offer, and try to convince a reporter that this indicates an exploit was found and is being used without anyone at company B noticing. Dumber stories certainly have surfaced, and the damage could be significant.
- exelius 9y agoHuman social order is built around a desire to feel superior to others. Capitalism "won" because it weaponised that desire -- not the other way around.
- pizza 9y agoIntentional division of capability is what the present economic system is based on, but I agree
- vectorEQ 9y agodigital privacy has never and will never exist... it's a myth created to sell 'secure' products. (which never turn out to be actually secure, and even if they were , are running on insecure devices....) you are right it's a human problem, and the problem is lack of respect for eachother. won't be fixed by any software patches for sure =]
- mmagin 9y agoI wonder if there's a way to use civil legal proceedings to punish these exploit-trading firms. Maybe class action lawsuit representing victims of these exploits.
- DataWorker 9y agoProbably not.
- revmoo 9y agoAs bad as these things are, you wouldn't want them to be illegal.
- confounded 9y agoWhy?
- sliken 9y agoMaybe because it increases the security significantly. Say a large government pays top $ for an exploit. Chances are pretty good that the vast majority of the black hats on the planet will not have it. Additionally publicity generates incentive to fix the problem. More apps/OSs/libraries will try harder to be secure. Apps could start wearing high exploit bounties as badges of honor. Much like how ransomware likely has increased security more and changed user behavior than an infinite amount of suggested security training. Some users even gasp ask about how to protect against ransomware and as a side benefit actually protect against mistakes, dying disks, and other flavors of malware at the same time. Seems better to trot this kind of stuff out in the open than to hide your head in the sand and try to hide security problems from the public.
- confounded 9y agoBut why incentivize the weakening of secure systems? I honestly don't think that black hat hackers would find much utility in cracking an app like Signal (except maybe for street cred). Relatively few of it's users would be "soft targets" in terms of susceptibility to phishing, social engineering, weak passwords, lack of 2FA, etc. Governments on the other hand would pay lots of money to increase their mass surveillance capabilities. Signal users are disproportionately young, sophisticated, and politically engaged. Given that Signal's budget is raised from donations and grants, and is much more fixed than an open market to undermine it, how would such a market incentivize them to increase funding on security? It's already their top priority.
- Abishek_Muthian 9y agoNot just Signal & WhatsApp, $500,000 - Messaging Apps RCE + LPE (SMS/MMS, iMessage, Telegram, WhatsApp, Signal, Facebook, Viber, WeChat) . Which I guess chat apps with > 250M MAU (except Telegram, which probably is because of it's high usage rate in Arab countries). Looking at their programme, they might probably approach the original vendor; but we all know who would pay hard cash for 0 days ;) Original Source : https://zerodium.com/program.html https://zerodium.com/program.html
- jorvi 9y agoStrange that they would pay the same money for an iMessage or Viber exploit. Those have very little market penetration compared to WhatsApp it's 90%+ (!)
- secfirstmd 9y agoIt's the countries that they are big in that probably make them think this way. For example, Viber is very popular in the Middle East, Russia, Africa, India, parts of Asia, Ukraine, Balkans, some of the 'Stans.
- gcp 9y agoFirefox/TOR LCE+SBX on Linux: 100k Chrome LCE+SBX on Linux: 80k Interesting.
- bmon 9y agoLikely because Firefox is shipped as default on a lot of distros.
- gcp 9y agoIt used to be 30k for Firefox vs 80k for Chrome, though. I'm thinking it's a combination of being the default, Firefox just having enabled the sandbox on Linux, and it being the base of the Tor Browser (which means Firefox exploits can sometimes be used against Tor too).
- julianj 9y agoYeah... I recently uncovered a way to bypass the tor browser bundle proxy on some linux flavors [0]. Unfortunately, The bounty from the tor project isn't nearly as much[1], but at least I can sleep at night. [0] https://blog.torproject.org/blog/tor-browser-703-released https://blog.torproject.org/blog/tor-browser-703-released [1] https://hackerone.com/torproject https://hackerone.com/torproject
- r3bl 9y agoGood job! If it's not a secret, how much did they pay to you? Seems like this could be considered, at least, a medium severity, and the top bounty they gave so far is only $500. If you don't wanna disclose that, that's perfectly understandable. I'm just curious.
- julianj 9y agoI haven't received a payment yet actually -- it is still pending.
- gcp 9y agoUnfortunately, The bounty from the tor project isn't nearly as much It sounds like it's a privacy leak, but not an RCE/SBX? Especially as it's saying that the sandboxed version of Tor isn't affected. Bit sad that you can't click the revisions on https://trac.torproject.org/projects/tor/ticket/23044#no2 https://trac.torproject.org/projects/tor/ticket/23044#no2 to see the diff.
- weddpros 9y agoSay a company buys and sells insider trading information... Would it be legal? So why is buying/selling 0 days OK? Both are selling information that will be used wrongly in the wrong hands, the kind of information you don't want a "broker" to know about, the kind of information you don't want a broker to find clients for. And if there's only one potential buyer (the target), they're basically black mailing 0 days targets: "become a client or... who knows what will happen... maybe the NSA or hackers will buy it?"
- stagbeetle 9y agoMost firms are unwilling to invest any sort of money into security for their customers (this includes preventing breaches and having a sufficiently enticing bug bounty program). Third-party private firms are an arbiter that puts pressure on those same companies to invest more into their security or face the risk of serious PR problems. >Say a company buys and sells insider trading information... Would it be legal? So why is buying/selling 0 days OK? Insider trading is a Victorian-esque and arbitrary law. The same way sports ban PEDs under the guise of "fairness" (when in reality everyone uses steroids and PEDs, and most everyone does insider trading) so too do these outdated laws do nothing but put the SEC on a moral high-ground and bolster the tax bucket. >Both are selling information that will be used wrongly in the wrong hands, the kind of information you don't want a "broker" to know about, the kind of information you don't want a broker to find clients for. May be used wrongly. Zerodium is a grey hat distributor. They can sell to the companies themselves, domestic and foreign governments, or terrorists. The first three can be used for good (and it could be argued so could the terrorists if their idealogies converge with some oppressed opinions among a populace). It's not 100% and it's likely, but "good" comes out of it. >And if there's only one potential buyer (the target), they're basically black mailing 0 days targets: "become a client or... who knows what will happen... maybe the NSA or hackers will buy it?" In a perfect world, you shouldn't have to have a coal tax and companies would care about the environment, but we don't live in this world. We live in a world where the only that matters is asset value, and good security is rarely seen as increasing asset value (only stopping asset decreation from scandals).
- qeternity 9y ago
- w8rbt 9y agoI expect two factor authentication over cellular networks (SMS and voice callbacks) to be commonly exploited in a year. Orgs really need to force OATH (HOTP, TOTP) and FIDO (U2F, UAF) and begin transitioning away from cellular two factor.
- ihattendorf 9y agoThe problem that I haven't seen a good answer to, is what happens when (not if) the customer loses their 2nd factor device? If someone loses their phone, they can still keep their same number and receive an SMS verification on their new phone. With OATH/FIDO, that won't happen.
- Spooks 9y agoIf I was WhatsApp I would offer a larger bounty. If they get the 0 day they could fix it before it gets into the wrong hands. I would think 500k is a drop in a bucket for them, and give them good press that they are actively keeping up with privacy/security of their users
- fauigerzigerk 9y agoIf I was WhatsApp, I would offer to compensate those who have found the exploit for their work. If someone else buys the exploit I would sue the broker for extortion.
- tryingagainbro 9y agoIf I was WhatsApp, I would offer to compensate those who have found the exploit for their work. Sure, their rate is $1 million an hour :). I could see the government jump in and pressing charges but the worst thing Whats-app can do is piss them off.
- Spooks 9y agowell the thing is offering to compensate the work won't be their go to. The one who finds the exploit will most likely sell it to the highest legal bidder, which at the moment is Zerodium.
- CleaveIt2Beaver 9y agoInterestingly, I don't see a payout linked to Zerodium directly. What happens if someone they do business with decides they can just grab the keys to the castle directly? I wonder if they'd bargain, or just set another bounty on the individual or group in question.
- segmondy 9y agoWish someone will offer a bounty to target Zerodium.