9 ms·
Zerodium offers $100k for a RCE in Pidgin, who received $25k donation this year
- tptacek 5y agoI'm not sure I understand the cognitive dissonance here. The same imbalance exists in a lot of commercial products; for instance, a new reliable Chrome bug chain might earn you more than a Chrome developer makes in a year, and a lot of those people make bank. It's simply the case that for some projects, reliable exploits are more scarce than feature engineering resources --- they involve different skill sets. None of this is to say that $25k is adequate compensation for critical FOSS development work.
- pjc50 5y agoSolution: put bug in, get accomplice to claim bug bounty under an alias. (This is fraud, don't actually do this! But it comes up every time someone does bug fixing metrics)
- failwhaleshark 5y agoObfuscated Open Source Subtle Bug Insertion Contest Edit: If it's not a bug bounty to fix it, but a vuln bounty to sell it, then it's highly-unethical but not necessarily illegal.
- mlex 5y agoSounds like the University of Minnesota already has a team ready.
- jonfw 5y agoSeems like unnecessary steps- I'm sure Zerodium would be happy to just pay you directly to put in a backdoor
- mindslight 5y agoErm how would that be fraud? It's certainly unethical to the software's users, but seems to fit the spirit of a private bug bounty. Apart from the ethics, what would legally trip you up is later "disclosing" that bug as a public bugfix, which is presumably against Zerodium's terms.
- failwhaleshark 5y agoSploits are worth a lot more because of the damage they can do. Fixing some bugs and adding some features is a nice-to-have that most people and companies aren't willing to pony-up much for.
- paulgb 5y agoFair point, but as someone not familiar with exploit markets, I do find it surprising that an exploit in a relatively niche (because desktop linux is relatively niche) IM client is worth $100,000k.
- mike_d 5y agoZerodium is a proxy for governments wanting to buy exploits. That niche IM client might be the software of choice for a child-exploitation ring or a high level ISIS commander. Comparatively a single hellfire missile costs $150k - plus $32 million for the drone to fire it from.
- t0mas88 5y agoThe 100k exploit bounty is probably less than the yearly cost of 1 agent for many government organisations. So the target doesn't even have to be a high value ISIS terrorist to make this bounty worth it. Just save them 1 or 2 FTE somewhere and the economics already work.
- g_p 5y agoI would have thought the same, but the existence of this "ask" certainly would suggest there is indeed demand from a market dynamic perspective. Pidgin is cross-platform, and you could conceive that it was being used by people for various activities with OTR or OMEMO end-to-end encryption. At that point, there's a bunch of potential customers looking to pay Zerodium for a good, robust, zero-click exploit that would give them access to exfiltrate and monitor messages sent through the client.
- tptacek 5y agoThe work is the work, no matter how much the project itself took to build. If it was easy for exploit developers to pull a Pidgin exploit out of their butt, they'd be cheap. The fact that it's a niche target can actually make bugs scarcer; sometimes, exploit devs can draft off the work other people have done beforehand.
- paulgb 5y ago
- mike_d 5y agoThe 0day market is actually getting disrupted by cryptocurrency. Even the major exploit brokers can't compete with weaponizing the exploit against an exchange or online wallet provider to net tens of millions in easily cleaned money.
- celticninja 5y agoAny evidence of this?
- throwaway2048 5y agoIts pretty common sense, if you exploit people and steal their cryptocoin wallets, that is worth a lot more than a single one time payment of 100k.
- viro 5y agoSpeaking of common sense ... most people don't have cryptocoin wallets
- doopy1 5y agoAlso, those selling 0days are not the one's using them in the wild... out or principal. One can sell a 0day and float away on a silver cloud never to be seen again, but use it in an active campaign and they'll come after you hard.
- celticninja 5y agoYes it makes sense, that doesn't mean it is common. I can sell a 0-day for money and it is legitimate income. If I try and scam an exchange I have to be successful, be able to clean the coins I steal and then hope I am not caught. I would take the 0-day payday thanks.
- mike_d 5y agohttps://blog.coinbase.com/responding-to-firefox-0-days-in-the-wild-d9c85a57f15b https://blog.coinbase.com/responding-to-firefox-0-days-in-th...
- OJFord 5y agoBut not more than Google's revenue / Chrome project funding. (Or at least not above board, out in the open like this.) I don't necessarily disagree with you, but I do think it's dissonant enough to be interesting.
- Cyph0n 5y agoThe difference is that Zerodium can turn around and sell these exploits to autocratic governments. More often than not, these governments then use the exploits to monitor political dissidents.
- tptacek 5y agoIf you're reading me as saying the two enterprises are morally equivalent, you're taking something I'm not saying from that comment.
- Cyph0n 5y agoSorry, I did not mean to imply that. I was just noting an important difference between bug bounty-style exploits funded by companies and what Zerodium does.
- lovasoa 5y agoand to democratically elected governments too, who will then spy on their own citizens
- phh 5y agoCompare the project fundings? Chrome funding is probably in the XXM$/year, while Zerodium offers 500k$ for a vulnerability, that's an approximate 20-100 funding / vulnerability ratio. Pidgin is at 25k$/year, for 100k$ for a vulnerability, so a ratio of 1:4. I think the only reasonable conclusion is that community-driven opensource projects are 100 time safer than private company-funded opensource projects /s
- thaumaturgy 5y agoI don't think cognitive dissonance is the right label to apply to this. I read it more as a misalignment of incentives. It's a sad comment on the state of things that a year of effort to produce some popular software is worth only a quarter of what somebody else is willing to pay for exploitable bugs in that same software. Like, I understand why that's the case, but it still sucks.
- ianai 5y agoUnless the foss developer is also getting the RCE award.
- mcguire 5y agoThat would be a conflict of interest, no?
- lolsal 5y agoI would pay more than my yearly salary to find out if I have a 'curable' cancer, so that I could treat it. To not, or ignore that, would likely mean my death. I imagine it is similarly motivating for OSS projects.
- thaumaturgy 5y agoIt's not. OSS projects aren't people with curable diseases. Most of them are labors of love, run by people in their spare time. Those people have needs that are mostly not met by working on open source projects. Epsilon open source projects are well-enough funded that nobody in the project feels starved for resources. Bug bounty programs are only useful for these projects if the details of the bug are shared with the project. Zerodium's model relies on keeping developers unaware of the bugs for as long as possible [1]. Nobody developing OSS is grateful for programs like Zerodium. [1]: https://security.stackexchange.com/questions/199480/what-does-zerodium-do-with-their-bought-exploits-and-bugs https://security.stackexchange.com/questions/199480/what-doe...
- yoz-y 5y agoOne difference is that people may have a safety net in either savings or insurances, but underfunded open source projects don’t.
- deleted 5y ago[deleted]
- failwhaleshark 5y agoVupen / Zerodium folks (Chaouki Bekrar, et. al.): helping governments monitor, abduct, torture, silence, and murder their enemies through monetizing sploits.
- high_byte 5y agoexcept they don't see it that way. they don't see at all when money is blinding and used to look the other way.
- IncludeSecurity 5y agoThey know exactly where their sploits are going and how they're being used, they chose to look away with a blind eye.
- cypherg 5y agoMany of these exploits (certainly not all) have been used to catch child predators. I do not know of any case of a 0day being used against journalists or hackers from a NATO country.
- LordOfWolves 5y agoFrom Zerodium’s FAQ page: > Zerodium customers are government organizations (mainly from Europe and North America) in need of advanced zero-day exploits and cybersecurity capabilities. Based off Zerodium’s origin and reputation, it seems an exploit is sought which enables a governmental actor to examine information that it otherwise could not. I am assuming they do not have a legal basis for doing so or courts would have granted/ordered such access.
- g_p 5y ago> I am assuming they do not have a legal basis for doing so or courts would have granted/ordered such access. It's also possible that they have a lawful basis and warrant, but realise executing a physical warrant won't get access to what's required - with e2e encrypted chats going over Pidgin, on an encrypted laptop, you need to be very confident that when you swoop, the laptop is on and decrypted. You get one "go" at that, otherwise you have a suspect, little or no evidence, and an attorney requesting their immediate release on bail absent any actual evidence, which would let them flee and clean up any other evidence that may be out there, either with them or others.
- zulln 5y agoThis assumes they even know the physical location.
- tedunangst 5y agoHow do you think warrants work? The police suspect Criminal Charlie of organizing a crime using pidgin, so they get a warrant, then they give the warrant to Charlie? "Please remember to cc us on all your criminal plans. Thanks."
- throwaway481048 5y agoThe issue isn’t about the warrant but the over breadth of the method for getting the desired information as it can leave other users vulnerable. Whether they have a warrant or not, this seems like overkill, because they could obtain said info in a much more straightforward way, assuming they have probable cause.
- throwaway-571 5y agoWhat Pidgin user(s) could possibly be worth that much? Are there some activist or terrorist monitored by a 3 letter agency that is computer literate enough to use Linux + pidgin to try and keep away from prying eyes (or just plain ethical reasons)? Or would the exploit end up being targeted at some foreign government that has standardized on Pidgin?
- normaler 5y agoThere are many government organizations which are still using XMPP and the Clients they usw are most likely based on libpurle the vasic library for pidgin and similar clients (Adamantium on MacOS).
- paulryanrogers 5y agoAdium?
- kilroy123 5y agoMaybe someone who's holding a LOT of crypto?
- meowface 5y agoMaybe. But if you're holding a LOT of crypto, it's very unwise to store the private keys on an internet-connected computer you also use for instant messaging and other things. (I'm sure plenty of people do actually do that; just lamenting the fact rather than expressing skepticism at the plausibility.)
- VRay 5y agoI left like $80 worth of crypto on a computer that my nephew was using for gaming online, and only remembered when I realized that it had grown to be worth over $1000 Fortunately I recovered it before any of the virus-riddled crapware he downloaded noticed it was there, haha
- 5y ago
- renewiltord 5y agoWell, surely you just have a confederate add one, sell the exploit, then patch it. Do it three times and you’ve got a decade of funding. I’m sure you’ll get away that many times.
- viro 5y agoI wonder which Pidgin user is the "target" of this increase.
- riffic 5y agoisn't this the polar opposite of responsible disclosure? This rubs me as completely unethical.
- monkey_monkey 5y agoZerodium is an ethics-free company.
- gurjeet 5y agoIt’s sad state only because the FOSS developer managed a low funding. OTOH, if they had managed significantly more, say a million, then irrespective of the bounty size we wouldn’t label it a sad state. This is to say that FOSS needs more funding and contributors; rest of the industry can do whatever they want, and we wouldn’t care.
- sebyx07 5y agoBegging cash for os exploits is trashy and rude, the author should have just submit a pr with the fix. Target crapy closed projects where real money is next time and ask for more, peasant.
- yissp 5y agoWait, couldn't the developer just add an RCE vuln intentionally and then claim the bounty ;)