105 ms·
Likely referencing https://www.crowdfense.com/exploit-acquisition-program/ https://www.crowdfense.com/exploit-acquisition-program/ Zerodium used to offer up to
by kuroguro 4mo ago
Likely referencing https://www.crowdfense.com/exploit-acquisition-program/ https://www.crowdfense.com/exploit-acquisition-program/
Zerodium used to offer up to 300k in 2021 https://www.securityweek.com/sites/default/files/images/Zerodium_WordPress_exploit.png https://www.securityweek.com/sites/default/files/images/Zero...
These brokers usually don't pay the bulk sum - they sell access to nation actors and you get payed out over time as long as the bug is not patched to discourage reselling and burning it. I doubt anyone would confirm if they got the full payment or not for something similar.
- tptacek 4mo ago[flagged]
- StrauXX 4mo agoOf course it is. It just no longer exists.
- tptacek 4mo agoOh, you've done business with them then? Know someone who has?
- jnbcxdrun 4mo ago[dead]
- cmeacham98 4mo agoYes actually, I know someone who did business with them many years ago (before the advent of LLMs), although for a smaller sum than the advertised top payouts (the vulnerability they had was much less important). Why post these random unsubstantiated claims on HN?
- close04 4mo ago> Why post these random unsubstantiated claims on HN? To show everyone the Gell-Mann amnesia effect in action. When HN top karma poster and security professional posts something like this, doubles down, and can’t even be bothered to support it in any way (I’m open to learning and changing my opinion) it completely blurs the line going into social media influencer. Quantity over quality.
- StrauXX 4mo agoI do, as a matter of fact.
- monster_truck 4mo agoMy lawyer says I can't answer that
- parl_match 4mo agoYes, I have briefly done business with them as well. We also worked with Bekrar and Vupen briefly. Albeit, it was done through a broker. The second time around, we exited negotiations. Just because they're exclusive about their clients doesn't mean they're not real. Their impact and effectiveness is a separate topic though. I don't think they're still actively operating or taking new clients, at least. btw: "Oh, so you've done x?" What a snarky and confrontational way to ask someone something. Especially when it's asserting a well documented company and person is "not real".
- tptacek 4mo ago[flagged]
- ofjcihen 4mo agoWhy are you constantly responding to people like this? What makes you think you’re above the rest of HN?
- tptacek 4mo agoYou apparently work in the field. Do you take these "price lists" seriously?
- ofjcihen 4mo agoThey can be and they can not be depending on what you’re selling. But that’s besides the point. You straight up argued that one isn’t real in the most asinine way you could. Even if you were right that would be ridiculous. The fact that you’re wrong and have multiple people telling you you are makes it even worse. I’ve seen you replying in snide comments whenever someone disagrees with you before. Your status as…whatever you are doesn’t give you carte to treat randoms like they’re beneath you.
- tptacek 4mo agoI'm noticing you didn't answer my question.
- ofjcihen 4mo agoWhy would you reply with something completely unsubstantiated that anyone in security at that time worth their salt would be able to call you out on and then in subsequent comments call people liars for insisting it did, in fact, exist? I’m just baffled.
- dadrian 4mo agoThe pricelist was a marketing stunt.
- intheitmines 4mo agoIs there anywhere currently buying that you can approach without a pre-existing relationship?
- StrauXX 4mo agoMaybe the MEA brokers still are. But don't if you live in the west.
- Hizonner 4mo agoWhy would anybody trust criminals to pay them over time?
- idiotsecant 4mo agoBecause if they don't other people will hear they don't pay and won't sell them 0days
- nativeit 4mo agoHow long do you figure a criminal reputation typically needs/wants to last? I have always been skeptical of “black market credit ratings”. If you happen to build one up, it’s likely only in order to rip someone off at a higher price and cash in the value of it. It’s not like you’ll need that good rep for your retirement.
- applfanboysbgon 4mo agoShinyHunters has been "in business" since 2019 and it is their reputation that resulted in eg. Canvas paying their ransom this year. Without that reputation, it is unlikely a large-scale ransom would have been paid, because the reputation is what gives them credibility that paying the ransom will actually result in the promise being upheld.
- bink 4mo agoI work in the field and I just cannot believe anyone would pay that much for a Word Press exploit. People pay money for iOS or Android because there is valuable information stored on devices running those operating systems. There's absolutely nothing of value on any Word Press site. The only possible reason I can think of is for a watering hole attack, but that would require a second exploit that would be worth far more (and they aren't).
- tedggh 4mo agoI currently work for a federal contractor including the DoD as their customer, using Wordpress as their main website. You would think there’s no sensitive information there, but some times all it takes is enough information about someone and their team to impersonate that person and gain access to an email thread, file sharing system or even an access card to a building. Never underestimate incompetence.
- soulofmischief 4mo agoAnd never underestimate the competence of others.
- kulahan 4mo agolol, a big part of security is being smart enough to never challenge the bored…
- marysol5 4mo agoSurprising amount of gov use WP as a CMS on their websites. So it's not that far off.
- madaxe_again 4mo agoThere’s a server running behind a Wordpress site. If you have RCE, you can run whatever arbitrary code you like there - mine crypto, run a botnet, all sorts of fun and profitable stuff. Hey, you can even make the site make the site’s users your unwitting hosts, too. You don’t go hack a Wordpress site, you go grab a few hundred thousand of them and do industrial scale crimes.