4 ms·

I'm sorry but you can't just throw a name out there like that! They didn't say anything at all that could possibly implicate Adobe. Are you just speculating idl

by lwat 16y ago

I'm sorry but you can't just throw a name out there like that! They didn't say anything at all that could possibly implicate Adobe. Are you just speculating idly or where did you come up with Adobe?

amock 16y ago
It sounds to me like he's referencing the Google China attacks, but I agree that there's nothing in this post that implicates anyone.
wingo 16y ago
It is a bit of a slur, but if _I_ had to attack an organization, I'd do it with PDF and Flash. If I were the CIA, then I'd pay for it. What's the market price for an Acrobat zero-day? A hundred thousand dollars?
- exit 16y ago
  in all seriousness, where is the marketplace for zero-day attacks? and how does one bring goods to market there?
  - sp_ 16y ago
    Find vulnerability, develop exploit, sell to http://www.zerodayinitiative.com/ http://www.zerodayinitiative.com/ or http://labs.idefense.com/vcp/ http://labs.idefense.com/vcp/ if you are a "White Hat" or the Russian mafia if you want to make more money and don't care what your exploit is used for. Once upon a time http://www.wslabi.com/ http://www.wslabi.com/ tried to create some kind of eBay for vulnerabilities too but it did not seem to go well.
    - phsr 16y ago
      How would one get into finding vulnerabilities with no prior security knowledge? I've always been interested in white hat security
      - deleted 16y ago
        [deleted]
      - sp_ 16y ago
        I think a good start would be to read http://www.amazon.com/Art-Software-Security-Assessment-Vulnerabilities/dp/0321444426 http://www.amazon.com/Art-Software-Security-Assessment-Vulne...
      - Apfel 16y ago
        http://myne-us.blogspot.com/2010/08/from-0x90-to-0x4c454554-journey-into.html http://myne-us.blogspot.com/2010/08/from-0x90-to-0x4c454554-... This is a guide I found on /r/reverseengineering on reddit (which actually has a decent community, considering the fact that its on reddit)
      - nikcub 16y ago
        without a doubt, the best book on the topic is: http://www.amazon.com/Art-Software-Security-Assessment-Vulnerabilities/dp/0321444426 http://www.amazon.com/Art-Software-Security-Assessment-Vulne... Mark is one of the best vulnerability researchers in the world. We used to hang in the same groups, and I remember that there was a 2-3 month period where he found and wrote exploits for vulnerabilities in almost a dozen different operating systems on 5-6 different architectures. the guy is a god Back then the only way to learn was to try it out yourself. there were no books, only phrack, IRC, and setting up boxes on your own network and having a go at them with a debugger running. you really have to be motivated, as the work is laborious, but worthwhile because there is nothing better than the rush you get from developing your own exploit. it is awesome that ppl like Mark are now writing books and dumping the knowledge they have gained through decades of real experience there are different types and categories of exploit. local apps and targeting privilege escalation, kernel exploits, server daemons (ie. anything that has a port opening and waiting for a connection), crypto implementation exploits and then webapps and browsers (more popular today). then there are different discovery methods: black box testing, where you throw data at an unknown system and through known inputs and outputs figure out what is in the box. white box testing, where it is still closed source, but you are able to attach a debugger, and then code auditing - which is simply going through the source code and attempting to find common errors that you can exploit. you will find that you will levitate to one particular type as you learn. for eg. for me personally it was IIS server (found and developed 6 diff vulnerabilities for IIS 4.0 and 5.0), NT kernel and web apps. good luck with it - if you find something, send it to me :)
  - lwat 16y ago
    There are dozens of forums hosted on Katz Global anonymous servers. Payment happens via anonymous gold-based payment systems like Pecunix. A top-of-the-range zero day exploit can set you back at least 5 figures. Also available: botnets for hire, stolen credit cards, WoW accounts, fake 'high yeild investment' scams and anything else you could think of.
MiguelHudnandez 16y ago
I apologize -- I should have cited recent events as the reason I brought up Adobe specifically. I did think I worded it in a way that made it clear I was speculating, but I see now I should have been much more specific. Yesterday Adobe released a very serious advisory for Flash Player: http://blogs.adobe.com/psirt/2011/03/security-advisory-for-adobe-flash-player-adobe-reader-and-acrobat-apsa11-01.html http://blogs.adobe.com/psirt/2011/03/security-advisory-for-a... http://news.ycombinator.com/item?id=2328928 http://news.ycombinator.com/item?id=2328928 And I was thinking of the highest-profile hacking case I can remember, when Google was infiltrated primarily by vulnerabilities in Adobe software. If I recall correctly, maliciously crafted PDFs were e-mailed to staff with cleverly engineered "From" addresses and subjects. For example, an employee received an e-mail from their boss's e-mail address.
- sp_ 16y ago
  Operation Aurora was an Internet Explorer vulnerability, not an Adobe vulnerability.
  - nigelk 16y ago
    It was both. If you read the various news reports closely, you'll see one vector was the 0-day IE vulnerability, another was malicious payloads in PDFs. The headlines haven't helped. http://www.computerworld.com/s/article/9144844/Hackers_used_IE_zero_day_not_PDF_in_China_Google_attacks http://www.computerworld.com/s/article/9144844/Hackers_used_... "Hackers exploited an unpatched vulnerability in Microsoft's Internet Explorer (IE) browser to break into some of the firms targeted in a widespread attack that compromised Google's and Adobe's corporate networks" "Google and Adobe, the only two companies to have stepped forward thus far to acknowledge the attacks, were hacked using malicious PDF files that exploited a zero-day vulnerability in Adobe's popular Reader software"
- nikcub 16y ago
  the context may not be right, but you do have a point. flash and acrobat are the easiest attack vector, as it seems that for years now they have almost constantly been vulnerable to one exploit or another, upgrading them is a PITA for users, and they are often easy to exploit for years now, whatever computer I have myself, or whenever I am setting a network policy (if the owner agrees), I always always disable flash and acrobat/pdf readr.

by lwat 16y ago

I'm sorry but you can't just throw a name out there like that! They didn't say anything at all that could possibly implicate Adobe. Are you just speculating idly or where did you come up with Adobe?

amock 16y ago

It sounds to me like he's referencing the Google China attacks, but I agree that there's nothing in this post that implicates anyone.

wingo 16y ago

It is a bit of a slur, but if _I_ had to attack an organization, I'd do it with PDF and Flash. If I were the CIA, then I'd pay for it. What's the market price for an Acrobat zero-day? A hundred thousand dollars?

exit 16y ago
in all seriousness, where is the marketplace for zero-day attacks? and how does one bring goods to market there?
- sp_ 16y ago
  Find vulnerability, develop exploit, sell to http://www.zerodayinitiative.com/ http://www.zerodayinitiative.com/ or http://labs.idefense.com/vcp/ http://labs.idefense.com/vcp/ if you are a "White Hat" or the Russian mafia if you want to make more money and don't care what your exploit is used for. Once upon a time http://www.wslabi.com/ http://www.wslabi.com/ tried to create some kind of eBay for vulnerabilities too but it did not seem to go well.
  - phsr 16y ago
    How would one get into finding vulnerabilities with no prior security knowledge? I've always been interested in white hat security
    - deleted 16y ago
      [deleted]
    - sp_ 16y ago
      I think a good start would be to read http://www.amazon.com/Art-Software-Security-Assessment-Vulnerabilities/dp/0321444426 http://www.amazon.com/Art-Software-Security-Assessment-Vulne...
    - Apfel 16y ago
      http://myne-us.blogspot.com/2010/08/from-0x90-to-0x4c454554-journey-into.html http://myne-us.blogspot.com/2010/08/from-0x90-to-0x4c454554-... This is a guide I found on /r/reverseengineering on reddit (which actually has a decent community, considering the fact that its on reddit)
    - nikcub 16y ago
      without a doubt, the best book on the topic is: http://www.amazon.com/Art-Software-Security-Assessment-Vulnerabilities/dp/0321444426 http://www.amazon.com/Art-Software-Security-Assessment-Vulne... Mark is one of the best vulnerability researchers in the world. We used to hang in the same groups, and I remember that there was a 2-3 month period where he found and wrote exploits for vulnerabilities in almost a dozen different operating systems on 5-6 different architectures. the guy is a god Back then the only way to learn was to try it out yourself. there were no books, only phrack, IRC, and setting up boxes on your own network and having a go at them with a debugger running. you really have to be motivated, as the work is laborious, but worthwhile because there is nothing better than the rush you get from developing your own exploit. it is awesome that ppl like Mark are now writing books and dumping the knowledge they have gained through decades of real experience there are different types and categories of exploit. local apps and targeting privilege escalation, kernel exploits, server daemons (ie. anything that has a port opening and waiting for a connection), crypto implementation exploits and then webapps and browsers (more popular today). then there are different discovery methods: black box testing, where you throw data at an unknown system and through known inputs and outputs figure out what is in the box. white box testing, where it is still closed source, but you are able to attach a debugger, and then code auditing - which is simply going through the source code and attempting to find common errors that you can exploit. you will find that you will levitate to one particular type as you learn. for eg. for me personally it was IIS server (found and developed 6 diff vulnerabilities for IIS 4.0 and 5.0), NT kernel and web apps. good luck with it - if you find something, send it to me :)
- lwat 16y ago
  There are dozens of forums hosted on Katz Global anonymous servers. Payment happens via anonymous gold-based payment systems like Pecunix. A top-of-the-range zero day exploit can set you back at least 5 figures. Also available: botnets for hire, stolen credit cards, WoW accounts, fake 'high yeild investment' scams and anything else you could think of.

MiguelHudnandez 16y ago

I apologize -- I should have cited recent events as the reason I brought up Adobe specifically. I did think I worded it in a way that made it clear I was speculating, but I see now I should have been much more specific. Yesterday Adobe released a very serious advisory for Flash Player: http://blogs.adobe.com/psirt/2011/03/security-advisory-for-adobe-flash-player-adobe-reader-and-acrobat-apsa11-01.html http://blogs.adobe.com/psirt/2011/03/security-advisory-for-a... http://news.ycombinator.com/item?id=2328928 http://news.ycombinator.com/item?id=2328928 And I was thinking of the highest-profile hacking case I can remember, when Google was infiltrated primarily by vulnerabilities in Adobe software. If I recall correctly, maliciously crafted PDFs were e-mailed to staff with cleverly engineered "From" addresses and subjects. For example, an employee received an e-mail from their boss's e-mail address.

sp_ 16y ago
Operation Aurora was an Internet Explorer vulnerability, not an Adobe vulnerability.
- nigelk 16y ago
  It was both. If you read the various news reports closely, you'll see one vector was the 0-day IE vulnerability, another was malicious payloads in PDFs. The headlines haven't helped. http://www.computerworld.com/s/article/9144844/Hackers_used_IE_zero_day_not_PDF_in_China_Google_attacks http://www.computerworld.com/s/article/9144844/Hackers_used_... "Hackers exploited an unpatched vulnerability in Microsoft's Internet Explorer (IE) browser to break into some of the firms targeted in a widespread attack that compromised Google's and Adobe's corporate networks" "Google and Adobe, the only two companies to have stepped forward thus far to acknowledge the attacks, were hacked using malicious PDF files that exploited a zero-day vulnerability in Adobe's popular Reader software"
nikcub 16y ago
the context may not be right, but you do have a point. flash and acrobat are the easiest attack vector, as it seems that for years now they have almost constantly been vulnerable to one exploit or another, upgrading them is a PITA for users, and they are often easy to exploit for years now, whatever computer I have myself, or whenever I am setting a network policy (if the owner agrees), I always always disable flash and acrobat/pdf readr.