7 ms·

Well, it seems ZDI sort of missed the boat with their earlier statements about 60k not being enough. Quote: Due to our disagreement about the best way to get t

Well, it seems ZDI sort of missed the boat with their earlier statements about 60k not being enough. Quote: Due to our disagreement about the best way to get the most vulnerabilities fixed, Google has withdrawn sponsorship of Pwn2Own. We understand their reasons for doing so: they want to be able to receive the sandbox escape details to improve the security of their product. That is why they launched Pwnium. What we believe they fail to realize is that, for the $60,000 they are offering, it is incredibly unlikely that anyone will participate. For example, a quote from a prior Pwn2Own winner: https://twitter.com/#!/VUPEN https://twitter.com/#!/VUPEN: "Google canceled its sponsorship of #pwn2own and launched its own #pwnium. To win, report your sophisticated exploit. We're not interested!". http://dvlabs.tippingpoint.com/blog/2012/02/29/pwn2own-and-pwnium http://dvlabs.tippingpoint.com/blog/2012/02/29/pwn2own-and-p...

drivebyacct2 15y ago
I'm not big into the security game/community, but I really don't understand the logic of "don't divulge how you break out of the sandbox = more exploits get fixed". And I did read the source link and try to understand...
- DrCatbox 15y ago
  Google just wants the work done for them. If you can make an exploit, you can explain how it works and how to patch it. On the other hand if Google just sees an exploit in action, they have to spend time reverse-engineering it to find out how it breaks the sandbox and come up with a fix, that takes far more time than just to require the working exploit.
  - alexchamberlain 15y ago
    They are paying you $60,000... Hardly exploitative! And it's legal!
    - lawnchair_larry 15y ago
      $60k looks like a lot less when you don't know going in that you'll even find anything. It's potentially months of speculative work, and you stand a very good chance of coming up empty handed. For not much less, anyone with this skill set can have a guaranteed salary. There is also the fact that anyone in the industry can make a few phone calls and have a bidding war on this type of exploit that will go well into the 6 figures, possibly as high as 7 according to some. $1M sounds high to me personally, but there is no doubt that it will fetch a few hundred thousand.
      - khuey 15y ago
        Taking the 60k from Google doesn't lead to spending several years of your life in Federal prison, which is a significant risk with selling an exploit.
        lawnchair_larry 15y ago
        Where on earth did you get the idea that there is something illegal about selling exploits? Several companies exist that do exactly this, and they operate in public, above board. To my knowledge, the US government is the biggest buyer of unpublished exploits. And they pay a lot more than 60k. One well-known US-based company is even run by a former NSA employee, and they're currently advertising a remote pre-authentication exploit in the latest version of MySQL.
        Sire 15y ago
        Links please.
        deleted 15y ago
        [deleted]
        lawnchair_larry 15y ago
        https://lists.immunityinc.com/pipermail/canvas/2012-February/000014.html https://lists.immunityinc.com/pipermail/canvas/2012-February... http://securityevaluators.com/files/papers/0daymarket.pdf http://securityevaluators.com/files/papers/0daymarket.pdf
- kibwen 15y ago
  When it comes to vulnerabilities affecting modern day browsers, there are two main categories: code execution and post-exploitation bypasses (sandbox escapes). [...] Without one of these, the second type of vulnerability is neutered. The idea is to encourage researchers to divulge only their more common (and thereby relatively less valuable) code execution exploits, as fixing these exploits alone will (according to ZDI's theory) defuse any threat the sandbox escape exploits pose.
  - daeken 15y ago
    ZDI, though, is insanely biased in this regard. They make their money by selling protection to companies -- fewer bugs, less money for them. Google has a vested interest in making their software more secure, ZDI has a vested interest in keeping their customers coming back for more patches.
- deleted 15y ago
  [deleted]
- gcp 15y ago
  From a high level, divulging the details could lead to the hole being patched up. Not having the details requires a much more thorough study being done to find out what happened. i.e. if someone reports a working exploit for Chrome, but doesn't tell how, Google has no choice but to investigate as deeply as it can and root out any possibility it can think of, and perhaps do automated checks in all of the source where it could possibly happen. If you instead point out it's a buffer overrun in file x.c, they'll likely just patch up that one file.
Tobu 15y ago
Whatever the price, Google won't root out all the vulnerabilities. A (relatively) smaller price gets people to compete for fame, which can be a more powerful motivation; a large price gets people to compete for the money, but Google may not be the highest bidder. That said, ZDI may have a point that the requirement for the full exploit is unnecessary; seeing the exploit in action might be enough for educated guesswork, thus seeing more exploits might be a good thing (in terms of security, not reputation). The obvious compromise would be to set two rewards: one for showing the exploit, another for showing its source code, at the hacker's option. By not disclosing the exploit the hacker would give up a higher guaranteed reward in exchange for a chance to make a juicier deal, but they'd be racing against Google's reverse-engineering effort.
- cma 15y ago
  >a large price gets people to compete for the money, but Google may not be the highest bidder. How exactly does it hurt the fame angle?
  - Tobu 15y ago
    The extra money is for dealing in a grey market. I thought people would want to be more discreet about this.
  - FooBarWidget 15y ago
    It's a well-known psychological effect. If you reward people for an activity that they already enjoy, then they will enjoy the activity less; their motivation has been diverted towards the reward.
- pvarangot 15y ago
  > The obvious compromise would be to set two rewards: one for showing the exploit, another for showing its source code, at the hacker's option. By not disclosing the exploit the hacker would give up a higher guaranteed reward in exchange for a chance to make a juicier deal, but they'd be racing against Google's reverse-engineering effort. I'm not sure if I'm completely understanding your idea... but in your proposed scenario wouldn't Google be sponsoring a place were the actual attackers that want to screw their users can window shop for working exploits? All researchers would be getting money from Google for participating on their contest, to then sell their working exploit that would take Google a significant amount of time to fix to the highest bidding blackhat/government.
SODaniel 15y ago
If I was a white/grey-hat hacker prodding for exploits for lulz and fame, an extra $60k would come in pretty handy for something I would be doing for free anyway. Also, not to forget is that $60k is a LOT of money to most people that are not .com millionaires.
- bricestacey 15y ago
  Maybe I'm mistaken, but my takeaway is that any hacker with the skills necessary to find such an exploit would not bother. It's a lot of money for most of us, but my impression is that these competitions don't target most of us.
fl3tch 15y ago
No, actually ZDI was right, because VUPEN broke out of Chrome's sandbox in the Pwn2Own contest (not Google's contest) and refused to explain the vulnerability, because it's far more valuable to sell to their customers: http://www.wired.com/threatlevel/2012/03/pwnium-and-pwn2own/ http://www.wired.com/threatlevel/2012/03/pwnium-and-pwn2own/ "A Google engineer offered Bekrar $60,000 on top of the $60,000 he stands to earn in the Pwn2Own contest if he handed over the sandbox exploit and details. But Bekrar declined and joked that he might consider the offer if Google bumped it up to $1 million. After the Google engineer left the conversation, Bekrar told Wired that money wasn’t the main enticement for him and he had no plans to hand over the exploit to Google. "The Google security team member expressed frustration at Bekrar’s reluctance to provide information about the vulnerability so that it could be fixed."

drivebyacct2 15y ago

I'm not big into the security game/community, but I really don't understand the logic of "don't divulge how you break out of the sandbox = more exploits get fixed". And I did read the source link and try to understand...

DrCatbox 15y ago
Google just wants the work done for them. If you can make an exploit, you can explain how it works and how to patch it. On the other hand if Google just sees an exploit in action, they have to spend time reverse-engineering it to find out how it breaks the sandbox and come up with a fix, that takes far more time than just to require the working exploit.
- alexchamberlain 15y ago
  They are paying you $60,000... Hardly exploitative! And it's legal!
  - lawnchair_larry 15y ago
    $60k looks like a lot less when you don't know going in that you'll even find anything. It's potentially months of speculative work, and you stand a very good chance of coming up empty handed. For not much less, anyone with this skill set can have a guaranteed salary. There is also the fact that anyone in the industry can make a few phone calls and have a bidding war on this type of exploit that will go well into the 6 figures, possibly as high as 7 according to some. $1M sounds high to me personally, but there is no doubt that it will fetch a few hundred thousand.
    - khuey 15y ago
      Taking the 60k from Google doesn't lead to spending several years of your life in Federal prison, which is a significant risk with selling an exploit.
      - lawnchair_larry 15y ago
        Where on earth did you get the idea that there is something illegal about selling exploits? Several companies exist that do exactly this, and they operate in public, above board. To my knowledge, the US government is the biggest buyer of unpublished exploits. And they pay a lot more than 60k. One well-known US-based company is even run by a former NSA employee, and they're currently advertising a remote pre-authentication exploit in the latest version of MySQL.
        Sire 15y ago
        Links please.
        deleted 15y ago
        [deleted]
        lawnchair_larry 15y ago
        https://lists.immunityinc.com/pipermail/canvas/2012-February/000014.html https://lists.immunityinc.com/pipermail/canvas/2012-February... http://securityevaluators.com/files/papers/0daymarket.pdf http://securityevaluators.com/files/papers/0daymarket.pdf
kibwen 15y ago
When it comes to vulnerabilities affecting modern day browsers, there are two main categories: code execution and post-exploitation bypasses (sandbox escapes). [...] Without one of these, the second type of vulnerability is neutered. The idea is to encourage researchers to divulge only their more common (and thereby relatively less valuable) code execution exploits, as fixing these exploits alone will (according to ZDI's theory) defuse any threat the sandbox escape exploits pose.
- daeken 15y ago
  ZDI, though, is insanely biased in this regard. They make their money by selling protection to companies -- fewer bugs, less money for them. Google has a vested interest in making their software more secure, ZDI has a vested interest in keeping their customers coming back for more patches.
deleted 15y ago
[deleted]
gcp 15y ago
From a high level, divulging the details could lead to the hole being patched up. Not having the details requires a much more thorough study being done to find out what happened. i.e. if someone reports a working exploit for Chrome, but doesn't tell how, Google has no choice but to investigate as deeply as it can and root out any possibility it can think of, and perhaps do automated checks in all of the source where it could possibly happen. If you instead point out it's a buffer overrun in file x.c, they'll likely just patch up that one file.

Tobu 15y ago

Whatever the price, Google won't root out all the vulnerabilities. A (relatively) smaller price gets people to compete for fame, which can be a more powerful motivation; a large price gets people to compete for the money, but Google may not be the highest bidder. That said, ZDI may have a point that the requirement for the full exploit is unnecessary; seeing the exploit in action might be enough for educated guesswork, thus seeing more exploits might be a good thing (in terms of security, not reputation). The obvious compromise would be to set two rewards: one for showing the exploit, another for showing its source code, at the hacker's option. By not disclosing the exploit the hacker would give up a higher guaranteed reward in exchange for a chance to make a juicier deal, but they'd be racing against Google's reverse-engineering effort.

cma 15y ago
>a large price gets people to compete for the money, but Google may not be the highest bidder. How exactly does it hurt the fame angle?
- Tobu 15y ago
  The extra money is for dealing in a grey market. I thought people would want to be more discreet about this.
- FooBarWidget 15y ago
  It's a well-known psychological effect. If you reward people for an activity that they already enjoy, then they will enjoy the activity less; their motivation has been diverted towards the reward.
pvarangot 15y ago
> The obvious compromise would be to set two rewards: one for showing the exploit, another for showing its source code, at the hacker's option. By not disclosing the exploit the hacker would give up a higher guaranteed reward in exchange for a chance to make a juicier deal, but they'd be racing against Google's reverse-engineering effort. I'm not sure if I'm completely understanding your idea... but in your proposed scenario wouldn't Google be sponsoring a place were the actual attackers that want to screw their users can window shop for working exploits? All researchers would be getting money from Google for participating on their contest, to then sell their working exploit that would take Google a significant amount of time to fix to the highest bidding blackhat/government.

SODaniel 15y ago

If I was a white/grey-hat hacker prodding for exploits for lulz and fame, an extra $60k would come in pretty handy for something I would be doing for free anyway. Also, not to forget is that $60k is a LOT of money to most people that are not .com millionaires.

bricestacey 15y ago
Maybe I'm mistaken, but my takeaway is that any hacker with the skills necessary to find such an exploit would not bother. It's a lot of money for most of us, but my impression is that these competitions don't target most of us.

fl3tch 15y ago

No, actually ZDI was right, because VUPEN broke out of Chrome's sandbox in the Pwn2Own contest (not Google's contest) and refused to explain the vulnerability, because it's far more valuable to sell to their customers: http://www.wired.com/threatlevel/2012/03/pwnium-and-pwn2own/ http://www.wired.com/threatlevel/2012/03/pwnium-and-pwn2own/ "A Google engineer offered Bekrar $60,000 on top of the $60,000 he stands to earn in the Pwn2Own contest if he handed over the sandbox exploit and details. But Bekrar declined and joked that he might consider the offer if Google bumped it up to $1 million. After the Google engineer left the conversation, Bekrar told Wired that money wasn’t the main enticement for him and he had no plans to hand over the exploit to Google. "The Google security team member expressed frustration at Bekrar’s reluctance to provide information about the vulnerability so that it could be fixed."