3 ms·

In what sense? I'm sure you could find people who would pay $20,000 to view anyone's private photos.

tptacek 13y ago
If you say so. Where would you find them? There appears to be a functioning market for drive-by clientside RCE. The Interwebs seem to have interpreted this as evidence that there is a market for all kinds of vulnerabilities. I am skeptical that this is the case, and, unlike the RCE markets, I have no evidence to suggest that the website auth bypass markets are real. I suppose the ability to generate unbounded Facebook likes or Twitter followers is monetizable.
- shawabawa3 13y ago
  Just to clarify, "drive-by clientside RCE" means remote execution on the browser just by visiting a website? Like one of the recent Java 0-days?
  - tptacek 13y ago
    Yes.
- mootothemax 13y ago
  I have no evidence to suggest that the website auth bypass markets are real. You could definitely contact your local firm of private investigators, insinuate that "I can access anyone's FB account," and make a tidy sum from doing just that. Playing devil's advocate, admittedly, but there is still a very active market for quite petty-yet-nasty stuff, e.g. land developer wanting to access email accounts of local residents protesting against the plans. Actually, you want weird? Thanks to my latest "seeking work" post on HN (and "Hacker" appearing in the page's title), I had someone ask me to hack the local authority computers responsible for registering peoples' deaths. This was, apparently, in order to give his funeral director company a leading edge. Does Matasano never get cranks asking for stuff of a similar nature?
  - tptacek 13y ago
    There's a difference between a functioning market for something and your ability to one-off 1:1 contracts for things. Hyperbolic comparison: you can also pay to have someone killed, but random people on the Internet don't have access to a market for putting out hits.
borlak 13y ago
You can't just view anyone's private photos. They have to have been logged into facebook (have a session) and then go to your domain with the exploit.
- tomjen3 13y ago
  Most people are locked into facebook. And you could just send them an email, carefully tailored to target them, with a link to your exploit site.

If you say so. Where would you find them? There appears to be a functioning market for drive-by clientside RCE. The Interwebs seem to have interpreted this as evidence that there is a market for all kinds of vulnerabilities. I am skeptical that this is the case, and, unlike the RCE markets, I have no evidence to suggest that the website auth bypass markets are real. I suppose the ability to generate unbounded Facebook likes or Twitter followers is monetizable.

shawabawa3 13y ago
Just to clarify, "drive-by clientside RCE" means remote execution on the browser just by visiting a website? Like one of the recent Java 0-days?
- tptacek 13y ago
  Yes.
mootothemax 13y ago
I have no evidence to suggest that the website auth bypass markets are real. You could definitely contact your local firm of private investigators, insinuate that "I can access anyone's FB account," and make a tidy sum from doing just that. Playing devil's advocate, admittedly, but there is still a very active market for quite petty-yet-nasty stuff, e.g. land developer wanting to access email accounts of local residents protesting against the plans. Actually, you want weird? Thanks to my latest "seeking work" post on HN (and "Hacker" appearing in the page's title), I had someone ask me to hack the local authority computers responsible for registering peoples' deaths. This was, apparently, in order to give his funeral director company a leading edge. Does Matasano never get cranks asking for stuff of a similar nature?
- tptacek 13y ago
  There's a difference between a functioning market for something and your ability to one-off 1:1 contracts for things. Hyperbolic comparison: you can also pay to have someone killed, but random people on the Internet don't have access to a market for putting out hits.

borlak 13y ago

You can't just view anyone's private photos. They have to have been logged into facebook (have a session) and then go to your domain with the exploit.

tomjen3 13y ago
Most people are locked into facebook. And you could just send them an email, carefully tailored to target them, with a link to your exploit site.