5 ms·

If it was kept secret, what would the value of this zero day exploit have been on the black market?

by lifeformed 9y ago

beamatronic 9y ago
This is a fantastic question and should be higher.
- Sohcahtoa82 9y ago
  This isn't reddit. Written upvotes like this are highly frowned upon.
  - thiagocsf 9y ago
    I like your username.
kakarot 9y ago
I'd be surprised if Meltdown was worth less than $2B. And I wouldn't be surprised if it was worth over $100B. Of course that is raw value, however in practice it would be EXTREMELY hard to launder such a large amount of money into and out of an online transaction. The question then becomes, what kind of person is the hacker? Are they in a position where they can wait and find a good deal or would they rather wash their hands of it over $100M or so?
- tomschlick 9y ago
  For this kind of exploit, I don't think you'd have to worry about the transaction. The NSA/(insert spy agency here) would gladly send a truck full of cash to your house for it (assuming they didn't know about it already).
  - PuffinBlue 9y ago
    I like to think the NSA/TLA folks are sitting in an office somewhere incredulous that someone found this bug they'd never have even dreamed up, whilst a catalogue of simple buffer overflows and mandated backdoors that no one has yet found sits on the shelf ready for offensive use.
    - rphlx 9y ago
      > they'd never have even dreamed up Side channels in general have been known for a long, long time in mil and intel communities, so it is likely that folks there long ago identified and understood that it's a bad idea to share a single x86_64 core between multiple tenants in a public cloud, for example, even if this specific attack vector was not explicitly tagged & bagged.
      - kakarot 9y ago
        I was under the assumption that it's worse than just sharing cores or servers. Even machines that do not share cores but share a common hypervisor are cross-vulnerable. From Wikipedia [0]: Spectre has the potential of having a greater impact on cloud providers than Meltdown. Whereas Meltdown allows unauthorized applications to read from privileged memory to obtain sensitive data from processes running on the same cloud server, Spectre can allow malicious programs to induce a hypervisor to transmit the data to a guest system running on top of it. However I have also read that Spectre is confined to userspace, so I'm not sure who is correct. [0] https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)#Impact https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...
deleted 9y ago
[deleted]

If it was kept secret, what would the value of this zero day exploit have been on the black market?

beamatronic 9y ago

This is a fantastic question and should be higher.

Sohcahtoa82 9y ago
This isn't reddit. Written upvotes like this are highly frowned upon.
- thiagocsf 9y ago
  I like your username.

kakarot 9y ago

I'd be surprised if Meltdown was worth less than $2B. And I wouldn't be surprised if it was worth over $100B. Of course that is raw value, however in practice it would be EXTREMELY hard to launder such a large amount of money into and out of an online transaction. The question then becomes, what kind of person is the hacker? Are they in a position where they can wait and find a good deal or would they rather wash their hands of it over $100M or so?

tomschlick 9y ago
For this kind of exploit, I don't think you'd have to worry about the transaction. The NSA/(insert spy agency here) would gladly send a truck full of cash to your house for it (assuming they didn't know about it already).
- PuffinBlue 9y ago
  I like to think the NSA/TLA folks are sitting in an office somewhere incredulous that someone found this bug they'd never have even dreamed up, whilst a catalogue of simple buffer overflows and mandated backdoors that no one has yet found sits on the shelf ready for offensive use.
  - rphlx 9y ago
    > they'd never have even dreamed up Side channels in general have been known for a long, long time in mil and intel communities, so it is likely that folks there long ago identified and understood that it's a bad idea to share a single x86_64 core between multiple tenants in a public cloud, for example, even if this specific attack vector was not explicitly tagged & bagged.
    - kakarot 9y ago
      I was under the assumption that it's worse than just sharing cores or servers. Even machines that do not share cores but share a common hypervisor are cross-vulnerable. From Wikipedia [0]: Spectre has the potential of having a greater impact on cloud providers than Meltdown. Whereas Meltdown allows unauthorized applications to read from privileged memory to obtain sensitive data from processes running on the same cloud server, Spectre can allow malicious programs to induce a hypervisor to transmit the data to a guest system running on top of it. However I have also read that Spectre is confined to userspace, so I'm not sure who is correct. [0] https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)#Impact https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...

deleted 9y ago

[deleted]