4 ms·

Haha, it's fascinating to see someone in the security field talk about purchasing exploits. It sounds only one step removed from discussing the price to purchas

by qq66 16y ago

Haha, it's fascinating to see someone in the security field talk about purchasing exploits. It sounds only one step removed from discussing the price to purchase a proof of the Riemann Hypothesis.

lsc 16y ago
from the parent: "You can probably buy real clientsides in IE or a popular plugin for far less than six figures." I'm pretty sure that what the parent means is that you could buy a plugin, or rather the company that writes a plugin. say, adblock (okay, adblock might be more than six figures... a less popular plugin that is still fairly widely used.) along with the rights and credentials to upload a new version. (of course, you'd pretend to be a legitimate business to do this.) Now, I don't know how IE works, but FireFox has a mechanism to automatically update plugins to their latest versions. You now insert your malicious code into the plugin and cause the auto-update to run. Assuming the infection isn't immediately obvious, you will, within a few days, infect nearly all users of that plugin.
- JoachimSchipper 16y ago
  I am pretty sure that tptacek does mean buying vulnerabilities. There are quite a few unsophisticated hackers offering exploits for sale ("serious buyers only") (e.g. on the Full-Disclosure mailing list), and the occasional debate about publishing/selling to "good guys" like Zero Day Initiative/selling to "bad guys" suggests that these sellers are, indeed, unsophisticated. (Which is not to say that your way wouldn't work too.) EDIT: Mention Full-Disclosure somewhere.
  - lsc 16y ago
    you might be right. But I know if I was to attempt to buy a botnet (note, I'm a SysAdmin, not a security expert, so I might be doing it wrong.) I'd probably try to do it as I described in my post. People put a lot of trust into popular browser add-ons, and there is very little oversight.

by qq66 16y ago

Haha, it's fascinating to see someone in the security field talk about purchasing exploits. It sounds only one step removed from discussing the price to purchase a proof of the Riemann Hypothesis.

lsc 16y ago

from the parent: "You can probably buy real clientsides in IE or a popular plugin for far less than six figures." I'm pretty sure that what the parent means is that you could buy a plugin, or rather the company that writes a plugin. say, adblock (okay, adblock might be more than six figures... a less popular plugin that is still fairly widely used.) along with the rights and credentials to upload a new version. (of course, you'd pretend to be a legitimate business to do this.) Now, I don't know how IE works, but FireFox has a mechanism to automatically update plugins to their latest versions. You now insert your malicious code into the plugin and cause the auto-update to run. Assuming the infection isn't immediately obvious, you will, within a few days, infect nearly all users of that plugin.

JoachimSchipper 16y ago
I am pretty sure that tptacek does mean buying vulnerabilities. There are quite a few unsophisticated hackers offering exploits for sale ("serious buyers only") (e.g. on the Full-Disclosure mailing list), and the occasional debate about publishing/selling to "good guys" like Zero Day Initiative/selling to "bad guys" suggests that these sellers are, indeed, unsophisticated. (Which is not to say that your way wouldn't work too.) EDIT: Mention Full-Disclosure somewhere.
- lsc 16y ago
  you might be right. But I know if I was to attempt to buy a botnet (note, I'm a SysAdmin, not a security expert, so I might be doing it wrong.) I'd probably try to do it as I described in my post. People put a lot of trust into popular browser add-ons, and there is very little oversight.