9 ms·

Nations Buying as Hackers Sell Computer Flaws

95 points by stfu 13y ago

s_q_b 13y ago
I'm surprised Endgame Systems isn't mentioned. As far as I can discern, they're one of the largest purveyors of zero-day exploits to the IC. They sell a target-mapping tool known as Bonesaw, and for a couple million a year you can upgrade it with zero-day exploit packs for every region on the globe. It's system compromise made point-and-click. EDIT: Should have read the second page. I'll leave it up as a testament to my haphazard reading ability.
- joshfraser 13y ago
  It was interesting to see that some of our own silicon valley folks are on Endgame's board. Notably, David Cowan from Bessemer and Ted Schlein from Kleiner Perkins.
  - s_q_b 13y ago
    Absolutely. I'm DC based, so it's more "your" than "our." But you'd be equally surprised to see the flow of money that moves in the opposite direction. In-Q-Tel, the non-profit venture capital firm of the CIA, has invested in many Valley companies including Facebook and Palantir. Now, I've heard that In-Q-Tel funding does not imply any obligation toward government interests in the future. However, from an organization who's stated mission is "specifically to help companies add capabilities needed by our customers in the Intelligence Community," such relationships pose interesting questions.
ihsw 13y ago
Responsible disclosure is one of the worst things to happen to the information security industry, and the sale of exploits is similarly terrible. Modern-day white hats have effectively turned into 'green hats' whose goals are no longer compatible with the previously-held ethical hacking belief system. Personally I feel that the sale of exploits should be outlawed, or at least specifically to customers have no intentions of fixing the exploit (buying a hackers silence), or to governments that are intent on conducting clandestine/offensive operations. I also agree with the EFF's stance on exploit sales, and that is that they should be front-and-center in any and all national cyber-security debates: https://www.eff.org/deeplinks/2012/03/zero-day-exploit-sales-should-be-key-point-cybersecurity-debate https://www.eff.org/deeplinks/2012/03/zero-day-exploit-sales... Also on Schneier.com: http://www.schneier.com/blog/archives/2012/06/the_vulnerabili.html http://www.schneier.com/blog/archives/2012/06/the_vulnerabil... No I'm not arguing for zero disclosure or that security researchers shouldn't be compensated for their hard work, I just think that the people and organizations that sell these exploits are effectively complicit in the destruction resulting from these exploits. The world of information security is slowly but surely moving towards a Cold War scenario where nation-states are fostering sustained and escalating tensions, especially where they maintain a stockpile of exploits to be deployed in war-time scenarios.
- tcoppi 13y ago
  I swear I'm not trying to be rude or snarky here, but do you also believe that manufacturing and selling weapons (guns, ammo, aircraft carriers, whatnot) should be illegal?
  - ihsw 13y ago
    No, absolutely not. There are many instances in history where fear and uncertainty were used as political tools to disarm and otherwise control 'untrustworthy' or 'unreliable' people. I'm sure you can imagine what usually follows that line of thought. I have a hard time reconciling that with my feelings about information security and I can see how this would contradict my statement above, but I have different feelings about information security and physical security (ie: in information security there is a very fine line between offensive and defensive capabilities). You and anybody else are welcome to convince me otherwise.
  - _delirium 13y ago
    If you take that analogy seriously, a lot of current exploit sales would already be illegal, even without restricting weapons sales further (which I personally think should be done, but that's another discussion). For example, you cannot generally export weapons to another country without a license. In the U.S. you cannot even sell weapons across state lines without a license. Many countries also restrict the sale of even low-level devices likely to be used for sabotage, e.g. molotov cocktails, and that may extend to marginal sabotage devices like spray paint as well. Burglary tools are another example of a restricted device that has some analogies. Lots of what the "security industry" does would land them in jail in any other field, even if it were selling low-level burglary devices to car thieves. Whether it's a good thing it doesn't, I'm not sure. The people taking money for exploits in a "don't ask what they'll do with it" kind of arrangement have a pretty dark shade of gray on their hats.
    - tcoppi 13y ago
      Right, so why is nobody instead saying that exploit sales should be regulated? Why are most people drawing such stark distinctions between exploit weapons and meatspace weapons?
pm24601 13y ago
Quite frankly I also blame the criminalization of responsible bug reporting. For example, Barret Brown ( http://www.democracynow.org/2013/7/11/jailed_journalist_barrett_brown_faces_105 http://www.democracynow.org/2013/7/11/jailed_journalist_barr... ) is facing jail time. Others have tried to report security issues and been threaten or charged with hacking. ( I will let you google for examples - there are quite a bit) At DefCon there have been cases where presenters were threatened with charges for reporting security issues. Selling the vuln "solves" the problem for the responsible hacker. I know if I found a bug - I would be unlikely to report it - too dangerous.
- ontoillogical 13y ago
  Barret Brown wasn't really involved in bug hunting. He is charged with posting a link to an email dump (hacked by someone else) that contained financial data among other things. You're probably thinking of weev, although what he didn't wasn't exactly "responsible bug hunting either", if you follow the common definition of that term.
- preter 13y ago
  It's sad but accurate. The safest route for the reporter is to sell it to people who want to attack their enemies, the vendor wont bully them, administrators wont attack them and you're shielded from criticism. It's unfortunately common for administrators to believe security is the state of perpetual ignorance of vulnerabilities that affect them, if Windows Update says "No updates available" then you're secure. If you tear them from that blissful ignorance, then they get angry and shoot the messenger. Security researchers do not introduce insecurity, they expose it. This is apparently a very hard concept to grasp for a lot of people.
lawnchair_larry 13y ago
Exploits are not weapons, they are research. They are the discovery of the correct sequence of bytes that someone else's program has been written to accept as input and perform actions that the author (probably) did not intend. Exploits are not any act of doing this, they are the knowledge of how to do it. There is no physical analogy. A bomb doesn't care what its target is, it's an indiscriminate destructive force. You cannot do something similar with an exploit. The exploit only has context within the rules set forth by the programmer of the target software. Just because I know which inputs you accept that cause unintended behavior, that you put there and I had nothing to do with, does not mean I have "created" something, positive or negative. Fundamentally, exploits are not created, they are discovered. This discovery process is expensive, and it's easy for you to say that it is ethical for me to share what I've found for free. I think that's arrogant and disrespectful, and I also think that criminalizing my knowledge is far more dystopian than what you think my knowledge might be used for if shared with someone else. I don't like what some governments are doing with them or that my tax money is feeding the industrial complex, but such a fundamental attack on freedom cannot be tolerated.
tcoppi 13y ago
Apparently Regulation of exploits has made it into the 2014 NDAA: http://blog.erratasec.com/2013/07/thanks-eff-for-outlawing-code.html#.UeQmUcUjsUE http://blog.erratasec.com/2013/07/thanks-eff-for-outlawing-c...

95 points by stfu 13y ago

s_q_b 13y ago

I'm surprised Endgame Systems isn't mentioned. As far as I can discern, they're one of the largest purveyors of zero-day exploits to the IC. They sell a target-mapping tool known as Bonesaw, and for a couple million a year you can upgrade it with zero-day exploit packs for every region on the globe. It's system compromise made point-and-click. EDIT: Should have read the second page. I'll leave it up as a testament to my haphazard reading ability.

joshfraser 13y ago
It was interesting to see that some of our own silicon valley folks are on Endgame's board. Notably, David Cowan from Bessemer and Ted Schlein from Kleiner Perkins.
- s_q_b 13y ago
  Absolutely. I'm DC based, so it's more "your" than "our." But you'd be equally surprised to see the flow of money that moves in the opposite direction. In-Q-Tel, the non-profit venture capital firm of the CIA, has invested in many Valley companies including Facebook and Palantir. Now, I've heard that In-Q-Tel funding does not imply any obligation toward government interests in the future. However, from an organization who's stated mission is "specifically to help companies add capabilities needed by our customers in the Intelligence Community," such relationships pose interesting questions.

ihsw 13y ago

Responsible disclosure is one of the worst things to happen to the information security industry, and the sale of exploits is similarly terrible. Modern-day white hats have effectively turned into 'green hats' whose goals are no longer compatible with the previously-held ethical hacking belief system. Personally I feel that the sale of exploits should be outlawed, or at least specifically to customers have no intentions of fixing the exploit (buying a hackers silence), or to governments that are intent on conducting clandestine/offensive operations. I also agree with the EFF's stance on exploit sales, and that is that they should be front-and-center in any and all national cyber-security debates: https://www.eff.org/deeplinks/2012/03/zero-day-exploit-sales-should-be-key-point-cybersecurity-debate https://www.eff.org/deeplinks/2012/03/zero-day-exploit-sales... Also on Schneier.com: http://www.schneier.com/blog/archives/2012/06/the_vulnerabili.html http://www.schneier.com/blog/archives/2012/06/the_vulnerabil... No I'm not arguing for zero disclosure or that security researchers shouldn't be compensated for their hard work, I just think that the people and organizations that sell these exploits are effectively complicit in the destruction resulting from these exploits. The world of information security is slowly but surely moving towards a Cold War scenario where nation-states are fostering sustained and escalating tensions, especially where they maintain a stockpile of exploits to be deployed in war-time scenarios.

tcoppi 13y ago
I swear I'm not trying to be rude or snarky here, but do you also believe that manufacturing and selling weapons (guns, ammo, aircraft carriers, whatnot) should be illegal?
- ihsw 13y ago
  No, absolutely not. There are many instances in history where fear and uncertainty were used as political tools to disarm and otherwise control 'untrustworthy' or 'unreliable' people. I'm sure you can imagine what usually follows that line of thought. I have a hard time reconciling that with my feelings about information security and I can see how this would contradict my statement above, but I have different feelings about information security and physical security (ie: in information security there is a very fine line between offensive and defensive capabilities). You and anybody else are welcome to convince me otherwise.
- _delirium 13y ago
  If you take that analogy seriously, a lot of current exploit sales would already be illegal, even without restricting weapons sales further (which I personally think should be done, but that's another discussion). For example, you cannot generally export weapons to another country without a license. In the U.S. you cannot even sell weapons across state lines without a license. Many countries also restrict the sale of even low-level devices likely to be used for sabotage, e.g. molotov cocktails, and that may extend to marginal sabotage devices like spray paint as well. Burglary tools are another example of a restricted device that has some analogies. Lots of what the "security industry" does would land them in jail in any other field, even if it were selling low-level burglary devices to car thieves. Whether it's a good thing it doesn't, I'm not sure. The people taking money for exploits in a "don't ask what they'll do with it" kind of arrangement have a pretty dark shade of gray on their hats.
  - tcoppi 13y ago
    Right, so why is nobody instead saying that exploit sales should be regulated? Why are most people drawing such stark distinctions between exploit weapons and meatspace weapons?

pm24601 13y ago

Quite frankly I also blame the criminalization of responsible bug reporting. For example, Barret Brown ( http://www.democracynow.org/2013/7/11/jailed_journalist_barrett_brown_faces_105 http://www.democracynow.org/2013/7/11/jailed_journalist_barr... ) is facing jail time. Others have tried to report security issues and been threaten or charged with hacking. ( I will let you google for examples - there are quite a bit) At DefCon there have been cases where presenters were threatened with charges for reporting security issues. Selling the vuln "solves" the problem for the responsible hacker. I know if I found a bug - I would be unlikely to report it - too dangerous.

ontoillogical 13y ago
Barret Brown wasn't really involved in bug hunting. He is charged with posting a link to an email dump (hacked by someone else) that contained financial data among other things. You're probably thinking of weev, although what he didn't wasn't exactly "responsible bug hunting either", if you follow the common definition of that term.
preter 13y ago
It's sad but accurate. The safest route for the reporter is to sell it to people who want to attack their enemies, the vendor wont bully them, administrators wont attack them and you're shielded from criticism. It's unfortunately common for administrators to believe security is the state of perpetual ignorance of vulnerabilities that affect them, if Windows Update says "No updates available" then you're secure. If you tear them from that blissful ignorance, then they get angry and shoot the messenger. Security researchers do not introduce insecurity, they expose it. This is apparently a very hard concept to grasp for a lot of people.

lawnchair_larry 13y ago

Exploits are not weapons, they are research. They are the discovery of the correct sequence of bytes that someone else's program has been written to accept as input and perform actions that the author (probably) did not intend. Exploits are not any act of doing this, they are the knowledge of how to do it. There is no physical analogy. A bomb doesn't care what its target is, it's an indiscriminate destructive force. You cannot do something similar with an exploit. The exploit only has context within the rules set forth by the programmer of the target software. Just because I know which inputs you accept that cause unintended behavior, that you put there and I had nothing to do with, does not mean I have "created" something, positive or negative. Fundamentally, exploits are not created, they are discovered. This discovery process is expensive, and it's easy for you to say that it is ethical for me to share what I've found for free. I think that's arrogant and disrespectful, and I also think that criminalizing my knowledge is far more dystopian than what you think my knowledge might be used for if shared with someone else. I don't like what some governments are doing with them or that my tax money is feeding the industrial complex, but such a fundamental attack on freedom cannot be tolerated.

tcoppi 13y ago

Apparently Regulation of exploits has made it into the 2014 NDAA: http://blog.erratasec.com/2013/07/thanks-eff-for-outlawing-code.html#.UeQmUcUjsUE http://blog.erratasec.com/2013/07/thanks-eff-for-outlawing-c...