7 ms·

Unless Google is one of their customers it may actually be a little while before this exploit is fixed. VUPEN does security research and doesn't disclose to ori

• xutopia 15y ago
  The reality is that there is probably no chance that they would ever find these bugs if they weren't funded to do it and the only way to be funded is to have customers. The net result is probably safer software for all.
  • alanh 15y ago
    The net result in this case is the government owning a zero-day root exploit for every Chrome/Win citizen’s computer. It’s worse than zero-day because we have no reason to expect a patch, so the window of attack will stay open.
    • kin 15y ago
      Out of speculation, would this tie in at all to an article I saw on HN a while back about the Government hiring 3rd parties to hack Google for some reason?
      • GrandMasterBirt 15y ago
        Is it wrong for our government to do any security research? I mean can good things not come out of it? Be thankful it was reported.
        • kin 15y ago
          I never said if anything was right or wrong, nor did I assume any of it, I just asked if it was related. Good to know curiosity gets flagged around here.
      • deleted 15y ago
        [deleted]
      • sswam 15y ago
        maybe Govt is envious because Google is already more powerful and capable and certainly better liked than it!
    • AndrewMoffat 15y ago
      On an exploit like this, I expect a patch. I'm sure people at Google and abroad (if the exploit exists in Chromium) are scrambling to find it, both for the e-cred and just to make other people safer.
      • SkyMarshal 15y ago
        Agreed, no need to freak out, the sky's not falling. I expect Google will either find the spoit on their own, or pay what to them is a pitance to become a customer and acquire it that way. Sounds like a good company to have on the payroll anyway, doing what three years of Pwn2own hasn't managed to.
        • sswam 15y ago
          they did say "exclusive"
        • sswam 15y ago
          I thought Pwn2own didn't even try to?
      • cop359 15y ago
        If if Google does find a serious security flaw, how can they be sure it's the same one?
        • piaskal 15y ago
          Just ask vupen if their exploit still works on new version.
          • Tyrannosaurs 15y ago
            Unless you're a customer of theirs why would you expect an answer to that?
    • schrototo 15y ago
      Wouldn't "the government" keep quiet about even having found an exploit? Why let VUPEN publicize this if they intend to use it?
      • lukeschlather 15y ago
        The government is generally more worried about keeping foreign governments out of high-tech firms like Google than about their ability to hack high-tech firms like Google.
        • CGamesPlay 15y ago
          Which government are you referring to?
          • gcb 15y ago
            think he was being generic. as in "the man".
          • alanh 15y ago
            I have to imagine everyone is referring to the same government agencies referred to in the article.
    • sswam 15y ago
      so, avoid .gov and similar :) it's a silly TLD anyway. Did the .gov pwn TPB and put their exploit up there?
      • deleted 15y ago
        [deleted]
  • wmf 15y ago
    OTOH, if they weren't paid then maybe the bugs would never be found and people wouldn't get owned.
    • tptacek 15y ago
      So your theory is that they, unlike organized criminals with 6-7 figure budgets, are atomic supermen?
  • rsoto 15y ago
    I'm confused. Why would the government want to break Chrome? Also, if they are not going to release the exploit soon (especially to Google), why are you saying 'safer software for all'?
    • bjonathan 15y ago
      you know that there is more than one government on earth... and all of them arent pro free-speech :) Safer software for all, because it's a better thing that VUPEN discover the bug than if it's discovered by some criminals who keep it secret and scam/hack
      • jonknee 15y ago
        > Safer software for all, because it's a better thing that VUPEN discover the bug than if it's discovered by some criminals who keep it secret and scam/hack I suppose it depends on the point of view, but having it exclusively in the hands of governments can easily mean it's limited to criminals who keep it secret and hack.
      • rsoto 15y ago
        Thanks for your response, but my question remains. Why would a entity as big as "the government" would invest in breaking one browser used by a minority (~10%) of users in the web? Wouldn't it be much easier to just compromise their Internet connections?
        • deleted 15y ago
          [deleted]
        • sswam 15y ago
          Let's say that, like most everyone else in the world, they already know how to break firefox and internet explorer, etc. They don't want to spy on your net, they want to steal your files.
      • quanticle 15y ago
        Arguably, that's exactly what VUPEN is doing here. They're keeping it secret, and only letting those who are willing to pay have the necessary knowledge regarding this vulnerability and any possible workarounds. It might not be a scam, but I do find it morally questionable to hide the details of a bug of this significance.
  • ChuckMcM 15y ago
    "The net result is probably safer software for all." I don't think that follows. Clearly there are folks in some governments who would fund finding zero day exploits so that they can use them to conduct cyber-warfare operations. Stuxnet comes to mind and the HBGary emails were telling in this regard. It seems there is a market for 0 day attacks that are not known to the manufacturer. So while Google would clearly give them $13,373 for the bug report but that is no doubt mouse nuts compared to what the someone would pay them while it's not in the 'known' state. So I find Vupen's business model not unlike the business of creating munitions. No doubt profitable but not something I'd personally want to participate in.
• ignifero 15y ago
  Do policemen work for free? It's a dirty job, I 'd want to be paid
  • eli 15y ago
    That's a poor example. Policeman get paid to protect everyone; police protection is not (usually) a subscription service.
    • forensic 15y ago
      Do police protect inner city poverty-stricken people victimized by gangs? It's pretty easy to argue that police only protect those who pay them.
      • shpxnvz 15y ago
        Police don't really "protect" anyone, their job is to cleanup the mess and investigate after the fact.
        • forensic 15y ago
          They use intimidation and other tactics to keep crime confined to certain neighborhoods. They have a lot of strategies geared toward prevention. If the police fail to respond to calls in the ghetto then the crime in the ghetto increases, for instance.
          • shpxnvz 15y ago
            I'm curious if you have a link to decent evidence of this. From both personal experience and per city data I've found, police response times are universally pretty dismal but I would be interested to see the same data broken down by neighborhood.
            • forensic 15y ago
              I've read various stuff to this extent, but the most interesting treatment was in the documentary called "Crips and Bloods: Made in America" that examines the origins of those two gangs. A big part of it was how the LAPD would only enforce laws in certain neighborhoods. The gangs were literally trained by the police that if they commit crimes on one side of a particular street, the laws will be enforced, but if they commit crimes on the ghetto side of the street, they will not be.
• VladRussian 15y ago
  Looking at VUPEN services it sounds like HBGary twin : http://www.vupen.com/english/services/ http://www.vupen.com/english/services/ "offensive security", yep. The guys are dirty like the Gary. Why a racket and government always means a happy marriage?
  • getsat 15y ago
    One difference is that it appears that these VUPEN folks are not entirely incompetent.
    • VladRussian 15y ago
      people were telling the same about HBGary before they started to tell the opposite. Though my post isn't about technical brilliance. Being in bed with Power and relaxing one's moral standards to better serve it always leads the same way....
      • getsat 15y ago
        > it always leads the same way.... To profit? I believe most people would get into bed with the government if offered the correct incentives. I probably would, too. It's unfortunate, but that's how things work. Is it immoral not to relax your morals to, e.g., secure a better life for yourself and your family? (Apologies for being meta, but I've recently begun studying morality/ethics so I'm exploring ideas for which I currently do not have answers. Suggestions/directions are appreciated.)
        • vikingux 15y ago
          As you are researching I'd check out the writing and thoughts of Norwegian Philosopher Arne Næss. He has a lot to say about different levels of rationality which are quite interesting. He began his philosophical as a hard-core rationalist with the Vienna school but later in life expanded rationality to include a larger rationality and human feeling. Also Christopher Alexander has insight here about including human feeling as an objective instead of solely subjective part of decision making. http://www.amazon.com/Lifes-Philosophy-Reason-Feeling-Deeper/dp/0820324183 http://www.amazon.com/Lifes-Philosophy-Reason-Feeling-Deeper... http://en.wikipedia.org/wiki/Arne_N%C3%A6ss http://en.wikipedia.org/wiki/Arne_N%C3%A6ss
• deleted 15y ago
  [deleted]
• timdorr 15y ago
  Funny thing is Google does actually pay for reported security bugs. Up to $3133.70: http://dev.chromium.org/Home/chromium-security/vulnerability-rewards-program http://dev.chromium.org/Home/chromium-security/vulnerability...
  • masklinn 15y ago
    I'm pretty sure VUPEN asks for an order of magnitude or two more. Hell, they don't even provide prices on their website, you can request quotes.
    • VMG 15y ago
      I wonder if this kind of thing will set a precedent. If a security firm can "extort" google, what stops a lone hacker to put up a video of a chrome exploit on youtube and demand some arbitrary amount of money as compensation? According to Wikipedia it is technically not extortion because the obtained information that is of value to google is not obtained "unlawfully" and doesn't seem to fall under the category "money, property or services". There seem to be some similarities though.
      • masklinn 15y ago
        > I wonder if this kind of thing will set a precedent. Erm... it's a traditional business model of security firms on the internets... > If a security firm can "extort" google, what stops a lone hacker to put up a video of a chrome exploit on youtube and demand some arbitrary amount of money as compensation? They're not extorting anything. They're not menacing google or anything like that, they have not obtained this information illegally, they've done security research and are releasing their findings to their clients because that's how they make their money. That's it.
• exit 15y ago
  why do they announce it at all then?
  • joelthelion 15y ago
    Advertising?
• deleted 15y ago
  [deleted]
• sswam 15y ago
  LOL, and Google does not have enough money to pay them a few measly billions to help fix their crown jewel chrome browser?? Don't make me laugh like that! Poor Google, not enough money, that'll be the day. These things should not in my opinion be disclosed to (the idiot skript kiddie segment of) the public before the vendors have been given a good long window to fix them. I prefer what VUPEN does when compared to irresponsible discoveries by black hats who do not give a shit about the integrity of the installed product and privacy / safety / security of how many millions of users, who can then be screwed over by every skript kiddie and his dog because they released the info straight to the public. Sure, if the vendor has absolutely ignored you and your loud demos of the bug, and won't respond to threats to release, you might release the exploit to a small segment of the IRREPROACHABLE VANILLA WHITE HAT security community with the intention that they might help persuade the vendor to take it seriously. That's about as far as I'd want go with releasing serious exploits. Although of course grey/black hat stuff is fun - look, mum, I have a cool exploit! If VUPEN are sworn to secrecy by their Government customer, and cannot tell the vendor or help them fix the bug, maybe it's time to get a new Government and public service. Your Government (US arrogances with a captial G) is trying to pwn you and spy on you. Fuck that, the government should answer to the will of the people (and don't talk to me about the farce we call democratic election. Democracy is where (almost) all the people are deeply involved in determining policy, it's more like the ideal soviet system, really, which was not realized AFAIK.) Anyway, isn't that why you're carting guns around all these years, in case your (US) Government turns nasty and starts pwning your ass up down right and left with a canoe? (Not that it wasn't already.) Yes indeed, guns!! However let it not be said that I am inciting violent revolution with this sarcastic post, as I don't believe in or wish to promote that or any violent act. Poor Google, not enough money. LOL!
  • sswam 15y ago
    "VUPEN provides vulnerability research and intelligence for defensive and offensive security." so, they are I presume happy to help the US CIA/MIL fvck people over (who most likely don't deserve it).
    • mattgreenrocks 15y ago