4 ms·

And then what? Exploits need to plug into a business plan. Like any business plan there has to be somewhere that money gets extracted and that money needs to b

And then what? Exploits need to plug into a business plan. Like any business plan there has to be somewhere that money gets extracted and that money needs to be more than the exploit cost & infrastructure costs & a risk premium. If you can’t trivially say how the exploit explicitly gets turned into cash you probably are on the wrong track. Doubly so if it’s not a known standard and commoditized way that’s happened before.

chmod775 2y ago
There is often phishing campaigns targeting larger channels on YT, trying to trick someone with access to it into opening malicious e-mail attachments, with the end-goal of taking over the channel. Usually the attackers then put a livestream on it and push some crypto scam. It must make enough money, given that it keeps happening. Most recent example I've seen: https://www.youtube.com/watch?v=EnVxWK6DfMQ https://www.youtube.com/watch?v=EnVxWK6DfMQ
- UncleMeat 2y ago
  So then why do they need additional information about emails? They clearly already can email these youtubers.
  - chmod775 2y ago
    This will enable you to get the private e-mail of the google account that owns the channel, which is not necessarily the same one a channel may give away publicly. So for some channels that provided no contact information, you now can acquire an email address, and for everyone else you may now get an additional one. It also enables you to link multiple channels back to the same person. Every bit of information you can get your hands on counts for social engineering attacks. For very famous individuals this may also open them up to harassment. You can't find Elon Musk's private telephone number on the Tesla homepage for good reason. For that class of people, any time that sort of information leaks, they need to get a new private phone number/e-mail address.
    - UncleMeat 2y ago
      I think we can imagine reasons why this would be valuable. It's a vuln. That's worth know about and fixing. I'm not sure that there are terribly many black market opportunities for "every bit of information" such that this should be a six figure payout or whatever.
      - chmod775 2y ago
        Sure, but here's some examples that may be worth a lot of money to the right person, or can just cause a lot of harm: - Regime critics with a channel on YT. - Vulnerable individuals and others trying to keep their identity a secret. Putting yourself on YT means putting yourself in front of every deranged individual out there. - Trump quite famously runs some of his own social media accounts personally, for better or for worse. And even where he doesn't, he probably retains ultimate control - in the case of YT it might be his personal google account that created the channel. He's probably not the only high value target to do so. Also if you happen to be in any date leak, being able to figure out your private e-mail address gives attackers another place to check whether you re-used a password.
        kasey_junk 2y ago
        This is the “heist vs exploit sale” dichotomy that tptacek mentions. For any vuln you can make up a hypothetical one off usage. But to find the right buyer for that is effectively building a team ala The Great Muppet Caper.
grog454 2y ago
> Exploits need to plug into a business plan Or, you know, develop a new "business plan" around an exploit.
- tptacek 2y ago
  Nobody does this. It would be an insane proposition. The vulnerability is going to die very shortly into your attempt to capitalize on it. Businesses have startup costs they have to pay off.
  - ineedasername 2y ago
    Wouldn't that require, if true, that new revenue streams around exploits aren't generally pursued? It seems like new scams, and variations on old ones around new methods, come about on a somewhat regular basis. And as with any business, there is going to be some speculative work around new "product offerings", so to speak. I'm with you on the idea that they are less valuable, as 'spec work, than something that enhances existing revenue streams in a more predictable way.
  - mmsc 2y ago
    >Nobody does that. Sure: https://www.abc.net.au/news/2016-07-01/league-of-legends-queenslander-avoids-jail-over-sale-user-data/7557982 https://www.abc.net.au/news/2016-07-01/league-of-legends-que...
    - fn-mote 2y ago
      He reportedly made $32k and barely avoided jail time... which does not sound to me like the $10k payout is undervalued.
  - deleted 2y ago
    [deleted]
  - wepple 2y ago
    You could dump all the data over a matter of weeks, then you’re sitting on a treasure trove that will pay out over 5+ years. You could sell it non-exclusively to every data broker
wswope 2y ago
Say you’re a blackhat OSINTer trying to steal crypto. You have a first initial and a last name for a target (“J. Smith”) - plus you know this person is on github and discord. You take out your handy email list and run a regex to find candidate accounts that match “J Smith”. You pipe matches into a recon script to check if github and discord accounts exist for each email. Suddenly, you’ve got a small pool of matches. You try more account-existence recon to find all the sites they’re signed up on. You look up all breached creds tied to the target emails, then run cred stuffing against any sensitive services they’ve signed up for. Boom, you’ve gone from first initial + last name to compromising an account in thirty minutes.
- UncleMeat 2y ago
  Surely the key part of this is "this person's email address and password has been published online together" rather than "I can identify this person's email address."
mmsc 2y ago
It can get turned into cash by the EU when Google gets a massive fine for leaking private data.

chmod775 2y ago

There is often phishing campaigns targeting larger channels on YT, trying to trick someone with access to it into opening malicious e-mail attachments, with the end-goal of taking over the channel. Usually the attackers then put a livestream on it and push some crypto scam. It must make enough money, given that it keeps happening. Most recent example I've seen: https://www.youtube.com/watch?v=EnVxWK6DfMQ https://www.youtube.com/watch?v=EnVxWK6DfMQ

UncleMeat 2y ago
So then why do they need additional information about emails? They clearly already can email these youtubers.
- chmod775 2y ago
  This will enable you to get the private e-mail of the google account that owns the channel, which is not necessarily the same one a channel may give away publicly. So for some channels that provided no contact information, you now can acquire an email address, and for everyone else you may now get an additional one. It also enables you to link multiple channels back to the same person. Every bit of information you can get your hands on counts for social engineering attacks. For very famous individuals this may also open them up to harassment. You can't find Elon Musk's private telephone number on the Tesla homepage for good reason. For that class of people, any time that sort of information leaks, they need to get a new private phone number/e-mail address.
  - UncleMeat 2y ago
    I think we can imagine reasons why this would be valuable. It's a vuln. That's worth know about and fixing. I'm not sure that there are terribly many black market opportunities for "every bit of information" such that this should be a six figure payout or whatever.
    - chmod775 2y ago
      Sure, but here's some examples that may be worth a lot of money to the right person, or can just cause a lot of harm: - Regime critics with a channel on YT. - Vulnerable individuals and others trying to keep their identity a secret. Putting yourself on YT means putting yourself in front of every deranged individual out there. - Trump quite famously runs some of his own social media accounts personally, for better or for worse. And even where he doesn't, he probably retains ultimate control - in the case of YT it might be his personal google account that created the channel. He's probably not the only high value target to do so. Also if you happen to be in any date leak, being able to figure out your private e-mail address gives attackers another place to check whether you re-used a password.
      - kasey_junk 2y ago
        This is the “heist vs exploit sale” dichotomy that tptacek mentions. For any vuln you can make up a hypothetical one off usage. But to find the right buyer for that is effectively building a team ala The Great Muppet Caper.

grog454 2y ago

> Exploits need to plug into a business plan Or, you know, develop a new "business plan" around an exploit.

tptacek 2y ago
Nobody does this. It would be an insane proposition. The vulnerability is going to die very shortly into your attempt to capitalize on it. Businesses have startup costs they have to pay off.
- ineedasername 2y ago
  Wouldn't that require, if true, that new revenue streams around exploits aren't generally pursued? It seems like new scams, and variations on old ones around new methods, come about on a somewhat regular basis. And as with any business, there is going to be some speculative work around new "product offerings", so to speak. I'm with you on the idea that they are less valuable, as 'spec work, than something that enhances existing revenue streams in a more predictable way.
- mmsc 2y ago
  >Nobody does that. Sure: https://www.abc.net.au/news/2016-07-01/league-of-legends-queenslander-avoids-jail-over-sale-user-data/7557982 https://www.abc.net.au/news/2016-07-01/league-of-legends-que...
  - fn-mote 2y ago
    He reportedly made $32k and barely avoided jail time... which does not sound to me like the $10k payout is undervalued.
- deleted 2y ago
  [deleted]
- wepple 2y ago
  You could dump all the data over a matter of weeks, then you’re sitting on a treasure trove that will pay out over 5+ years. You could sell it non-exclusively to every data broker

wswope 2y ago

Say you’re a blackhat OSINTer trying to steal crypto. You have a first initial and a last name for a target (“J. Smith”) - plus you know this person is on github and discord. You take out your handy email list and run a regex to find candidate accounts that match “J Smith”. You pipe matches into a recon script to check if github and discord accounts exist for each email. Suddenly, you’ve got a small pool of matches. You try more account-existence recon to find all the sites they’re signed up on. You look up all breached creds tied to the target emails, then run cred stuffing against any sensitive services they’ve signed up for. Boom, you’ve gone from first initial + last name to compromising an account in thirty minutes.

UncleMeat 2y ago
Surely the key part of this is "this person's email address and password has been published online together" rather than "I can identify this person's email address."

mmsc 2y ago

It can get turned into cash by the EU when Google gets a massive fine for leaking private data.