3 ms·

I respect your expertise, but this estimate seem at odds with the mainstream reporting on the difficulty of building it. Can you elaborate why you think this co

by aristus 16y ago

I respect your expertise, but this estimate seem at odds with the mainstream reporting on the difficulty of building it. Can you elaborate why you think this could be a low 6-figure job? It seems to have used more than one 0day, for example.

tptacek 16y ago
One of the four "zero days" it's alleged to have targeted was disclosed last year. Two of the others are privilege escalation bugs, which probably aren't worth tens of thousands of dollars. You can probably buy real clientsides in IE or a popular plugin for far less than six figures.
- qq66 16y ago
  Haha, it's fascinating to see someone in the security field talk about purchasing exploits. It sounds only one step removed from discussing the price to purchase a proof of the Riemann Hypothesis.
  - lsc 16y ago
    from the parent: "You can probably buy real clientsides in IE or a popular plugin for far less than six figures." I'm pretty sure that what the parent means is that you could buy a plugin, or rather the company that writes a plugin. say, adblock (okay, adblock might be more than six figures... a less popular plugin that is still fairly widely used.) along with the rights and credentials to upload a new version. (of course, you'd pretend to be a legitimate business to do this.) Now, I don't know how IE works, but FireFox has a mechanism to automatically update plugins to their latest versions. You now insert your malicious code into the plugin and cause the auto-update to run. Assuming the infection isn't immediately obvious, you will, within a few days, infect nearly all users of that plugin.
    - JoachimSchipper 16y ago
      I am pretty sure that tptacek does mean buying vulnerabilities. There are quite a few unsophisticated hackers offering exploits for sale ("serious buyers only") (e.g. on the Full-Disclosure mailing list), and the occasional debate about publishing/selling to "good guys" like Zero Day Initiative/selling to "bad guys" suggests that these sellers are, indeed, unsophisticated. (Which is not to say that your way wouldn't work too.) EDIT: Mention Full-Disclosure somewhere.
      - lsc 16y ago
        you might be right. But I know if I was to attempt to buy a botnet (note, I'm a SysAdmin, not a security expert, so I might be doing it wrong.) I'd probably try to do it as I described in my post. People put a lot of trust into popular browser add-ons, and there is very little oversight.

by aristus 16y ago

tptacek 16y ago

One of the four "zero days" it's alleged to have targeted was disclosed last year. Two of the others are privilege escalation bugs, which probably aren't worth tens of thousands of dollars. You can probably buy real clientsides in IE or a popular plugin for far less than six figures.

qq66 16y ago
Haha, it's fascinating to see someone in the security field talk about purchasing exploits. It sounds only one step removed from discussing the price to purchase a proof of the Riemann Hypothesis.
- lsc 16y ago
  from the parent: "You can probably buy real clientsides in IE or a popular plugin for far less than six figures." I'm pretty sure that what the parent means is that you could buy a plugin, or rather the company that writes a plugin. say, adblock (okay, adblock might be more than six figures... a less popular plugin that is still fairly widely used.) along with the rights and credentials to upload a new version. (of course, you'd pretend to be a legitimate business to do this.) Now, I don't know how IE works, but FireFox has a mechanism to automatically update plugins to their latest versions. You now insert your malicious code into the plugin and cause the auto-update to run. Assuming the infection isn't immediately obvious, you will, within a few days, infect nearly all users of that plugin.
  - JoachimSchipper 16y ago
    I am pretty sure that tptacek does mean buying vulnerabilities. There are quite a few unsophisticated hackers offering exploits for sale ("serious buyers only") (e.g. on the Full-Disclosure mailing list), and the occasional debate about publishing/selling to "good guys" like Zero Day Initiative/selling to "bad guys" suggests that these sellers are, indeed, unsophisticated. (Which is not to say that your way wouldn't work too.) EDIT: Mention Full-Disclosure somewhere.
    - lsc 16y ago
      you might be right. But I know if I was to attempt to buy a botnet (note, I'm a SysAdmin, not a security expert, so I might be doing it wrong.) I'd probably try to do it as I described in my post. People put a lot of trust into popular browser add-ons, and there is very little oversight.