12 ms·
Zero-day Exploit Price List
- dlokshin 14y agoThe article says that this practice is legal. If the sale is made, and then the client uses it to do something illegal, is the hacker / Grugq free of liability?
- jameskilton 14y agoI would guess yes. The sale of firearms is legal, but if a buyer then goes and kills someone with the gun, the seller of the gun is not liable. Not an exact comparison but for legal comparisons I believe it's apt.
- Achshar 14y agoBut there are noble and perfectly legal ways to use a gun. But there are not many for 0 days.
- daeken 14y agoJailbreaking, test cases for hardening your own systems (c.f. Metasploit), opening appliances/devices to other analysis. Three very common cases. Would quarter million dollar exploits be used for these? Probably not, but it doesn't change the fact that there are legit reasons to buy, sell, and use zero-day vulnerabilities.
- yuliyp 14y agoThe prices that go on in these markets make any of those reasons fall pretty blatantly on their face. Just like someone wanting to buy 100 AK-47s is also certainly not going to use them to just take to the range.
- uid501 14y agoCydia (the gray market app store) generates over a million dollars a year in revenue. The operation of this store, and thus its revenue stream, is entirely dependent on jailbroken iOS devices. Thus, there is a business entity with a existential interest in iOS exploits that are easily available to the iOS using community (i.e. the public). Would Cydia pay a quarter million dollars for an exploit to ensure that their customer base continues to exist? (Disclaimer: I'm not affiliated with Cydia in anyway, that revenue figure is from an ex-Apple employee discussing an informal estimate.)
- druiid 14y agoNoble? Not necessarily. Perfectly legal? The article talks about government linked buyers. If the behavior associated with using the exploit is technically illegal why would that ever stop a large government from using and deploying it?
- hobin 14y agoOn the other hand, selling firearms to people without doing a background check or when you know they're mentally ill or any such thing can be illegal (in some places, at least; I of course can't be familiar with legislation everywhere). I expect similar legislation may be introduced in the 'exploit market'.
- deleted 14y ago[deleted]
- cdooh 14y agoI think he is free, however with all the fear-mongering how long before calls to regulate this appear?
- yaix 14y agoDepends what country they are in and if that country actually enforces their own law. Thailand or one of its neighbors is probably a good place to live until any legal uncertainties are sorted out.
- alan_cx 14y agoHacker sells to a broker in South Africa. AFAIK, SA is not black listed or anything, and who knows who the broker sells too or who the broker says he sells to. I don't see how the hacker is any more liable than a petrol sales assistant selling fuel to a drug courier. But then the law is a strange thing.
- lawnchair_larry 14y agoIt's important to consider that Grugq is selective about his buyers. He won't broker a deal with Syria. As long as he sells to friends of the World Police, prosecution is not really a risk.
- rmk2 14y agoIt's a pity the article only mentions client-side exploits, it would have been interesting to see what is paid for server-side zero-days, especially linux/LAMP related...
- uid501 14y agoConsider the possibility that governments can create their own exploits. If they have a large quantity of server side bugs the marginal utility of one more is effectively 0. It is safe to assume that they have existing capabilities in that area. Just mentioning a LAMP stack means SQLi as the most likely vector. No point in paying for someone to run sqlmap for you... ;)
- lukeschlather 14y ago>One of the most vocal of those critics is Chris Soghoian, a privacy activist with the Open Society Foundations, who has described the firms and individuals who sell software exploits as “the modern-day merchants of death” selling “the bullets of cyberwar.” Are there any documented cases of malware killing someone? All this cyberwarfare stuff seems a little overblown.
- Achshar 14y agoWith flame and stuxnet in picture, cyber warfare looks a lot more real and physical. From disabling production of nuclear weapons to extremes of (highly unlikely) blowing up of reactors. That's a little more than a bullet.
- lukeschlather 14y agoI'd still call it less than a bullet. You can also potentially use a wrench to blow up a reactor, but ultimately I wouldn't call a wrench a powerful weapon. (That distinction goes to the reactor.)
- Achshar 14y agoI would say the "blame" is transferable indefinitely. The reactor is not responsible either, the enriched uranium is responsible instead, for the damage. But then uranium is not responsible either, the atoms are, that fuse (or fission), or the momentum (of atoms) can also be at blame. There has to be a line that needs to be drawn here. Wrench can explode a reactor, but it is not made specifically to blow up a reactor. Stuxnet, on the other hand was specifically made to do the damage to fuel cells. Hence it's a weapon and wrench is not.
- justinludwig 14y agoA wrench is a weapon in the war against loose bolts. However, most people would probably call it a weapon only when wielded with the intention of hitting another person. I don't think it's fair to characterize the intention of stuxnet as blowing up reactors. From what I've read, the purposeful damage it was designed to inflict was to disable uranium-enriching equipment. I don't recall reading anything about purposeful attempts to use the software to kill or wound. That's where I'd draw the line: purposeful killing. So I'd describe this as a case of cyber-sabatoge -- not a case of cyber-war.
- cdooh 14y agoAnother article that reveals nothing new and only serves to help elevate the public's fear that a full scale cyber war is imminent...
- iuguy 14y agoDisclaimer: I know people referenced in this article. Whatever your views on the morality or ethics surrounding this market, the fact is that it exists and isn't going away. In fact it has existed for a long time (I certainly remember exploits being traded, bought and sold in the early 2000s and 90s) but the thing that's new-ish is the presence of numbers in the public eye. Charlie Miller's paper on the 0day market[1] provides an example of what happens when someone has a lack of market information (they lowball and sell the bug for less than it's worth) in this space, and might be of interest to people who enjoyed this article. [1] - http://securityevaluators.com/files/papers/0daymarket.pdf http://securityevaluators.com/files/papers/0daymarket.pdf
- underwater 14y agoYou're right, but saying "someone else would do it if I didn't" is a pretty weak rationalization. They're making themselves rich at the expense of everyone else. They're a leech on society.
- smokeyj 14y agoIn a way, these "leeches" are providing free pen-testing, and publicizing the fact that software is cheap to exploit. If this drives the markets to invest in security software, I think it's a net win.
- uid501 14y agoCould you explain your reasoning a bit more? I am not following from "individual invests thousands of hours into their passion; some are compensated for their work by people who value their skills; those individuals are leeches on society". I think there is a step or twenty in there that you could expand.
- underwater 14y agoThey making a explicit decision to reap a larger payday by selling the exploits to governments or other companies rather than disclosing it to the original application authors for the standard bug reward. The sellers have no way of determining how the exploits will be used. The mere fact that buyers are willing to spend so much on an exploit indicates they are not just collecting them out of idle curiosity. Even we could completely trust the buyers to not misuse or share information about the exploit, the original bug remains unpatched for others to independently discover and exploit. The sellers are willing to inflict damage on everyone else so they can benefit. That sounds like leeching to me.
- ninjin 14y agoSchneier has recently written an excellent analysis of the exploit market. He also links to a ton of interesting related material. https://www.schneier.com/crypto-gram-1206.html#1 https://www.schneier.com/crypto-gram-1206.html#1
- evmar 14y agoOne time I was working on a MapReduce that processed a lot of XML found on the internet (I can't remember why anymore (edit: I remember now why I can't remember, it was a friend's program that I was helping out on)) and I found it crashing on some input. After some examination of my code I traced it to a bug in libxml (which is also used by Chrome, Safari, and others). I simply reported the bug to the appropriate parties and it got fixed. It's funny to think that the author of that bogus xml file had gotten the syntax wrong enough in a way that would've been worth thousands of dollars!
- eddington 14y agoIt's worth noting that not every bug is a security-critical bug. Similarly, not every crash is a security-critical crash. Sometimes you can exploit a bug to give you something, sometimes it's just a plain old bug. People only pay for the security-critical ones.
- greedo 14y agoA bug is sometimes just a bug. To be valuable, it has to lead to a vulnerability and ideally to privilege escalation. If it simply crashes the application without the ability to control further program execution, it's useless.
- gus_massa 14y agoThere was a recent article about using random generated programs to crash different C compilers. Then they automatically reduce the size of the programs to make them readable. Some corner cases are difficult to find thinking, and their approach was to find them by brute force. "57 Small Programs that Crash Compilers" http://blog.regehr.org/archives/696 http://blog.regehr.org/archives/696 (14 comments) http://news.ycombinator.com/item?id=3794934 http://news.ycombinator.com/item?id=3794934
- givan 14y agoLinux is not interesting for the buyers or not that easy to hack?
- uptown 14y agoSo is it a safe assumption that all porn sites are riddled with these types of exploits? Excluding generating revenue from these types of exploits, I've never understood how those sites could be sustained given the bandwidth charges those sites must incur.
- arkem 14y agoWhile porn sites might be riddled with malware it is unlikely that they'll be zero days. More likely you'll see exploits for bugs that are publicly known but not yet patched everywhere. The value of a zero days is largely rooted in the fact that it hasn't been disclosed publicly and any widespread use of a zero day threatens that value. Zero days will be used when the risk of discovery is very low or the payoff is very high and attacking random people who visit dodgy websites is unlikely to meet those conditions.
- nolok 14y ago1. Grab as many viewers as you can 2. Push as many links for subscription to "legit" porn site (those 5-7 minutes video with a "view more / view the full version here") 3. Take a % on the people that register through that That and ads are the main income source. The percentage of people who end up subscribing is very small, but then again a dozen bucks buys you a lot of bandwith these days.
- TimPC 14y agoHopefully the result of this revealed information will encourage companies to raise the prices they offer for reporting/fixing security critical updates. It's a shame that the legitimate route pays 1/10th to 1/25th of the alternative. Particularly since the illegitimate route is basically selling coding services to a government agency in a lot of cases (albeit closer to cracker than hacker), which some people do anyways as a part of their normal coding jobs.
- DanielBMarkham 14y agoThis is a great idea. Directly and publicly monetize security bugs. This is technical debt in terms of real, hard, cold cash. As a community it makes sense to embrace this. As vendors (and especially people who develop apps for walled gardens) start seeing real-world feedback on platform security, we can all make more informed choices. It also incentivizes the hell out of companies to make their stuff more secure. Terrific concept. This shouldn't be some kind of dark grey-market site. It should be on a web location as visible as E-bay. (owned by somebody with no skin in the game) For those of you arguing that such information can and does kill people, I feel your pain. But you can't hide knowledge. There will be a market whether or not there's a Forbes article about it. The only difference is whether you know about these vulnerabilities or you don't. A big, public market lets everybody see how crappy the things we use are. A secret, government-controlled market keeps all of that critical information away from the very people who need it. If the Syrian government is using security exploits to kill dissidents, all the more reason to let the sun shine in.
- joeguilmette 14y agoJust as important as the 0days themselves is keeping public who bought them. 0days, in many cases, are weapons. By keeping this market and it's transactions in the open perhaps we can keep the purchasing parties a little less evil, or at least drive up their costs. This market, to me, looks very similar to the weapons industry. The more open it is the better for everybody. The other commenters are correct, this market isn't going anywhere. We may as well shed light on it.
- Strom 14y agoI don't see how you can reveal the buyer. It doesn't take much effort to buy through a proxy entity.
- uid501 14y agoThe more public the market is, the less effective it is. WabiSabiLabi tried (and failed) to create an eBay for exploits years ago. The item of value is the information, not necessarily the code. As such, the more information is provided gratis, the less it is worth overall. In theory, a nice principle, but it is directly opposed to the forces that drive the market.
- bryans 14y agoI know it was inevitable, but I find it rather disappointing that exploits have become such big business. I felt like the hacker/cracker community between the late-80s to mid-90s was just that: a community, which likely developed naturally because of the scarcity of information at the time. Sure, there were exploits being traded (and probably even sold occasionally), but I never got the impression that anyone treated it like a business. Admittedly, I'm probably just being sentimental about my childhood, but that's how I remember it.
- greedo 14y agoIt has changed a lot in the last 20 years. Now organized crime as well as the involvement of nation-states has made it far more lucrative, and conversely, dangerous. Kingpin (kingpin.cc) does a good job of describing how much money there is to be made, even when you're not a PhD.
- charlieok 14y agoIs there some aspect of this story that is new? The article was published three months ago.
- leeoniya 14y ago"Google typically offers a maximum of $3,133.70" i believe they recently paid out 2x $60,000 prizes.
- rpsw 14y agoThey did, but this was for prizes during Pwnium at CanSecWest , not everyday amounts up for grabs.
- arkem 14y agoTrue but the reward is now up to US$20,000 in some cases. http://www.google.com/about/company/rewardprogram.html http://www.google.com/about/company/rewardprogram.html
- daeken 14y agoI should also note that that's $20k for a bug or series of bugs, not an exploit. Considering the monumental effort required to write a stable, viable exploit, getting 1/5 of the money (in theory) could well be worth it.
- gallerytungsten 14y agoPerhaps this is the explanation for how Flame and Stuxnet had so many zero day exploits: the Feds crowdsourced them through the Grugq.
- lawnchair_larry 14y agoIt's an open secret that they both build them and buy them. Where the stuxnet ones came from is uncertain, but it could have gone either way. I've heard they'll actually pay for one they already have if they hear a broker selling it. In this case, they are paying to keep it scarce (as these deals come with exclusivity).
- nsomething 14y agoPerhaps the worst thing about this is that engineers at the browser makers are now incentivized to create Zero-days. $250k and rising for knowingly creating a backdoor? There's now a market for software engineer corruption. Maybe add in some middlemen...
- TwoBit 14y agowhy would iphone be harder to hack than android? is it because iphone software is more closed source?
- andreyf 14y agoI've always wondered this about vulnerabilities: how can one guarantee an exclusive sale? And why doesn't someone who bought it just go ahead and re-sell it to (multiple) others to make a profit?
- uid501 14y agoAs mentioned elsewhere, generally the payment is spread out over months, contingent on the seller keeping their side of the bargain. And the second query describes the business practices of many defense contractors who act as de facto gatekeepers to government contracts.
- greedo 14y agoThis implies that "there can be only one." The idea that you could effectively prove that a seller is keeping their side of the bargain also implies that no one else would discover it.
- uid501 14y agoIt just means that the seller is incentivized to minimize the number of people that know about the vulnerability. Which is effectively what "exclusivity" actually means, at least in this case. As an additional point, if either side becomes known as a bad actor in the market, they will severely limit their ability to operate. There is some short term incentive to be dishonest (more money now), but in the long term it removes the ability to earn in the future. Like selling your fishing rod for fish today, tomorrow you'll be hungry again, only now you can't fish. (To butcher a cliche.) [edit: grammar]
- greedo 14y agoHow would you prove that the seller didn't resell the exploit?
- GoodIntentions 14y agoBrokering 0days - legal? yes. Risk free? I doubt it. Grugq makes me think of Gerald Bull.
- deleted 14y ago[deleted]
- tptacek 14y agoIn reality, exploit sellers and exploit buyers are engaged in discovering the value of security exploits. That the value of those exploits might be pinned to unethical, immoral, unlawful, or belligerent conduct is irrelevant; markets have to operate in the real world, and we cannot stipulate that the bad actors absent themselves from the real world. So while I personally find the sale of exploits distasteful†, I think Soghoian is in the weeds with this argument about exploit developers being "modern merchants of death". Exploits are nothing like conventional munitions. They're extremely scarce and their extraction from software imposes no intrinsic costs on the rest of the world. In other words: vendors can simply outbid intelligence agencies for their bugs, or, better yet, invest more heavily in countermeasures to moot those bugs. Unlike guns, which can be manufactured so cheaply and at such a scale that no one organization could hope to stem the tide with markets, vendors can stop immoral abuses of their own software simply by participating more actively in the market. $200,000 sounds like a lot of money, but it's under the cost of one senior headcount at a major software vendor, and vendor cash flows are expressed in high multiples of their total headcount cost. The higher the prices go, the more incented vendors are to stop vulnerabilities at the source. Even today, the whole technology industry is captivated by the misconception that vulnerabilities somehow cost some fraction --- maybe 1/3, maybe 1/4 --- of a senior full-time dev salary. After all, they're generated by people who would otherwise be occupying that kind of headcount. And for the most part, that misconception has been bankable, because the best exploit developers almost as a rule suck at marketing themselves. Every other price in the application security field follows from this misconception, from headcounts and org charts at vendors to assessment budgets to shipping schedules for products to the salaries of full-time application security people. It's all built on a misconception; that misconception creates a market inefficiency; people like (allegedly) The Gruguqhquq are arbitraging on that inefficiency. But the solution to a market inefficiency is to eliminate it, not, as Soghoian implies, to install umpires around it and erect bleachers and a jumbotron so we can watch it more carefully. I see this story as evidence of chickens coming home to roost, not as some dangerous new ethical lapse on the part of the security industry. † This is an easy moral stance for me to take because I don't invest any serious time into developing exploits for the targets on this price list.
- soup10 14y ago
- kirian 14y agoThe hacker should accept bitcoins for the exploit and save the commission fee and maintain better anonymity. Also the buyer could stay anonymous too.
- azakai 14y agoLinux isn't on the list, so I'm safe! :P