3 ms·

What percentage of these kind of exploits does hn think are found by these kind of white hat exercises and what percentage are sitting out there in an intellige

What percentage of these kind of exploits does hn think are found by these kind of white hat exercises and what percentage are sitting out there in an intelligence service or private entity's 0-day database? I have always been curious.

degenerate 6y ago
A wild guess is 3:1 (3 working 0-day exploits in existence for every 1 found with exercises like this). My reasoning is because every time there is a very high-priced bounty on an exploit, it seems to get discovered and pay out. So if governments and blackhats have people hunting full time for these exploits, you better bet they are finding them too.
comboy 6y ago
If I were running an agency... You don't have to find many zero days. Just have enough. Huge backend of tools and network of contributors surely helps, but if 0-day is gone in Zoom, and say you don't have their explicit cooperation (which you totally can have) and you only have one, then it may not be such a worry if it is commonly used with other software that you can own. Besides that, there are tiers of 0-days, some of which you would not touch unless the target is exceptionally valuable and you did some homework with oh-just-a-common-malware to learn about their system and response. There is no system that is secure. There may be systems that are obscure. But if they would be targeted they can be owned with easy because they are not popular and security is really really hard. This is not just crazy talk anymore, it's reality. It's enough to watch CVEs, think what you could do if you exploit them silently and what that allows you to do in the future. Watch them not only for abstractions on top, but for whole tons of firmware running both on your machine and machines that you trust. Oh and certificates... It's just too easy. Way too easy.
stjohnswarts 6y ago
I would guess at least 10:1

degenerate 6y ago

A wild guess is 3:1 (3 working 0-day exploits in existence for every 1 found with exercises like this). My reasoning is because every time there is a very high-priced bounty on an exploit, it seems to get discovered and pay out. So if governments and blackhats have people hunting full time for these exploits, you better bet they are finding them too.

comboy 6y ago

If I were running an agency... You don't have to find many zero days. Just have enough. Huge backend of tools and network of contributors surely helps, but if 0-day is gone in Zoom, and say you don't have their explicit cooperation (which you totally can have) and you only have one, then it may not be such a worry if it is commonly used with other software that you can own. Besides that, there are tiers of 0-days, some of which you would not touch unless the target is exceptionally valuable and you did some homework with oh-just-a-common-malware to learn about their system and response. There is no system that is secure. There may be systems that are obscure. But if they would be targeted they can be owned with easy because they are not popular and security is really really hard. This is not just crazy talk anymore, it's reality. It's enough to watch CVEs, think what you could do if you exploit them silently and what that allows you to do in the future. Watch them not only for abstractions on top, but for whole tons of firmware running both on your machine and machines that you trust. Oh and certificates... It's just too easy. Way too easy.

stjohnswarts 6y ago

I would guess at least 10:1