9 ms·

Kevin Mitnick Now Selling Zero-Day Exploits

• Pxtl 12y ago
  ... I think a lot of geeks might be burning their "free kevin" t-shirts.
• mhurron 12y ago
  "Mitnick became a symbol of government oppression in the late 1990s, when he spent four and a half years in prison and eight months in solitary confinement before his trial on hacking charges. The outcry generated a miniature industry in “Free Kevin” T-shirts and bumper stickers." I wonder if money could be made selling 'Fuck Kevin' shirts and bumper stickers now. Incidentally, Fuck Kevin.
  • westernmostcoy 12y ago
    There actually were "Fuck Kevin" stickers all over DEFCON a few years ago.
    • mhurron 12y ago
      Well damn. I almost might have been motivated to do something.
  • laxatives 12y ago
    I think it would be a little more condescending if you sold 'Fuck Mitnick', as if he were ubiquitous enough to be known as just Kevin.
  • danesparza 12y ago
    I had a "free Kevin" bumpersticker (one of these: http://en.wikipedia.org/wiki/Kevin_Mitnick#Arrest.2C_conviction.2C_and_incarceration http://en.wikipedia.org/wiki/Kevin_Mitnick#Arrest.2C_convict...). I now regret having one.
    • sp332 12y ago
      You just need to put a "fuck Kevin" sticker right next to it. Like when weev was imprisoned: yeah he probably deserves to be in jail, but not for that particular "crime", and probably the abuse he got while in jail was also inappropriate.
      • muyuu 12y ago
        Fuck free Kevin* *consensually.
• drzaiusapelord 12y ago
  It amuses me to hear how middle-class people are baffled by the fetishization of criminality in hip-hop culture, when we fetishize the same type of assholes in our culture. Mitnick is a criminal and all the pro-hacking sympathies have been wasted on a very, very undeserving person. Funny how easily you can manipulate public opinion with the right PR and anti-government message. Everyone wants to be the rebel against "the system." Everyone seems to think they're the Ayn Rand hero amongst the idiots, when in reality, the rebels and the intellectually vain are easily co-opted politically. The rise of libertarianism in geekdom seems to fall under the same dynamic.
  • mc_hammer 12y ago
    -deleted misread original comment :/-
    • sliverstorm 12y ago
      How exactly does "pioneered what Russian crime rings are doing today" make someone deserving of support & sympathy?
  • guelo 12y ago
    Your pro-government rant doesn't fit in this case because the government is one of the customers in the zero day market.
    • melville_X 12y ago
      Governments are almost always the market for zero-days. Private security companies also buy them, but guess who their primary market is? Look at FinFisher's customer list. There is nothing libertarian about the defense industry or their actors. Unless you mistake neo-liberalism as libertarianism as far too many people do.
    • hackuser 12y ago
      > Your pro-government rant doesn't fit in this case because the government is one of the customers in the zero day market. (Legitimate) governments generally are the only legitimate users of 0-days. Governments can legitimately and legally hack into your computer; nobody else can. Governments can legitimately and legally shoot you, but generally nobody else can. One definition of government is that they have a monopoly on violence. (I say "generally" above because there are exceptions, of course.)
• andrewljohnson 12y ago
  My initial thought was "this should be illegal" - but if there's no market for exploits, security will remain poor. So, this sort of business is a bump on the road to global security, which I have some hope we're heading towards. Either way, an exploit market is a grimy business, basically war profiteering. I wonder who is off-limits to sell to - certainly the Iranians, but who else, and who decides who is evil and who is good? People will die from some of these sales. I think we'll see pervasive encryption and P2P (blockchain-based) applications that will push back tyranny a bit. There will be technological solutions to things like secret legal proceedings and warrantless wiretaps. And by pushing computation back out to decentralized nodes, there won't be such juicy targets to attack.
  • dmethvin 12y ago
    > "this should be illegal" Governments define legality, and governments are likely to be some of Mitnick's best clients. Funny thing is, if I were Iran's government I would be concerned about buying exploits there because for all I know Mitnick has double-crossed me and given the US government info on the exploit and how to neutralize or detect it. Pervasive encryption only helps if the endpoints doing the encryption aren't compromised, and this type of service is aimed at those endpoints.
    • andrewljohnson 12y ago
      * Governments also enter into treaties to define international law. * We need less endpoints in general. You can imagine a blockchain-based encrypted email system, which could not be tapped, pen-registered, and the government would have to issue a subpoena to actual users to see data.
    • apetresc 12y ago
      That's irrelevant. Governments are in the habit of doing lots of things that would be illegal for me and you to do. For example, jail systems can exist while it's still illegal for me to keep people locked up in my basement.
• saosebastiao 12y ago
  I've always thought it would be a just punishment for a neutral, but government arbitrated, third party to hold a highest bid auction for zero-day exploits, where the breached company has the opportunity to buy back their bad security at a market price. I feel as though making it public and legal would force larger targets to make better security decisions, instead of the current status quo of letting them off with tiny fines if anything at all.
  • andrewljohnson 12y ago
    +1 for the creative thinking. We need the market forces improving security, but at the same time, brokering for profit seems imperfect.
    • gfodor 12y ago
      Can be solved by funneling the profits into some other neutral cause.
    • opendais 12y ago
      Eh, just require all profits above $XX million to go to paying down the national debt. Its a government sponsored monopoly that he is suggesting, its reasonable to cap its profits.
  • moggflunkies 12y ago
    is the goal to make a mega corp think twice about adding a product of feature? Now they can cancel that feature in fear of having to buy a 0day back for a gorillion dollars?
• josefresco 12y ago
  For those wanting to criticize Mitnick's actions, what I gather from the following quote is that there is an existing "industry" around finding, and selling these exploits... "Researchers find them, they sell them to us for X, we sell them to clients for Y and make the margin in between." Can anyone shed light on these "researchers" and how they sell their exploits now? Or is this just a friendly way of saying "we pay hackers for exploits and then blackmail vendors"?
  • danielweber 12y ago
    They generally don't blackmail the vendors. Someone paying $100,000 wants to get in someplace. I can't say I like the money-for-exploits thing, but one good thing is that it's made most companies be very nice to people to want to voluntarily report bugs. Silver lining and all that.
  • ipsin 12y ago
    VUPEN is an example of how exploits are monetized. "Trusted organizations" can subscribe to their vulnerability service for a large chunk of money.
• sarciszewski 12y ago
  So, who did he buy the 0days from? I know he didn't find them himself. The boy can't code. https://keenot.es/read/kevin-mitnick-is-celebrated-nobody https://keenot.es/read/kevin-mitnick-is-celebrated-nobody
  • sp332 12y ago
    Unlike Mitnick, Gonzalez is still in prison and doesn't have speaking gigs that cost (from a leaked email in Zero For 0wned 2) $18,500 USD plus business class travel and expenses for one hour of speaking and 15 minutes of Q&A. Sounds like Mitnick is well ahead of Gonzalez, there.
    • sarciszewski 12y ago
      Depends what you mean by "ahead". They're both scumbags who deceive others for personal gain.
• vtlynch 12y ago
  “Researchers find them, they sell them to us for X, we sell them to clients for Y and make the margin in between.” A glorified reseller and scumbag. Pathetic.
  • vijayr 12y ago
    This is similar to patent trolls, no? Both don't produce anything worthwhile, buy from others and use it to intimidate others (except patent trolls do it themselves in the open, whereas he sells it to people who'll probably use it secretly)
    • x1798DE 12y ago
      It's also similar to patent trolls in that the people doing it breath oxygen and have skin. In the case of patent trolls, they're leveraging asymmetries in the legal system and flaws in intellectual property laws to profit from non-meritorious lawsuits. To the extent that a market in zero-day vulnerabilities is something you want to have (I'm not sure where I stand on this, exactly), a firm with a reputation to maintain does have a role to play. They sell the exploit to Mitnick, who has an idea of which ones he'll be able to sell, and the companies buying them are able to avoid the transaction costs and risks associated with buying and then testing potential zero-day vulnerabilities submitted by arbitrary hackers and counterparties. He's playing a valuable role by mitigating risk for both the companies he approaches and the random hackers. Consider also that it's hit-or-miss when you try to contact a company about zero-day vulnerabilities whether or not they are going to pay you, ignore you or, worse, sue you. Knowing Mitnick doesn't sue people who submit bugs to him, and presumably he has lawyers vetting this operation carefully, is a significant benefit for bug-finders.
  • depingus 12y ago
    Worse than a reseller. If you read his website, it turns out he's just a broker. He doesn't actually buy them from the researcher and then try to sell them. He just brokers a deal between the researcher and the buyer (if he can find one); taking an exorbitant fee in the process.
    • 12y ago
• carsonreinke 12y ago
  Why does anyone need to legitimately buy a zero-day?
  • eli 12y ago
    A "bug bounty" is kinda like a vendor buying a zero-day about its own product.
    • kauffj 12y ago
      At below market rates.
• at-fates-hands 12y ago
  So the same people who support Silk Road and black markets suddenly say, "Yeah, Fuck Kevin Mitnick!" because he's a capitalist and using essentially the same system to make some money??
  • Jtsummers 12y ago
    > So the same people who support Silk Road and black markets suddenly say, "Yeah, Fuck Kevin Mitnick!" because he's a capitalist and using essentially the same system to make some money?? Who says it's the same people? Because it's people on the same site? If you treat the commenters here as a single entity you'll really hurt your head trying to make sense of the HN consensus. There often isn't one because so much of this boils down to opinions about and attitudes towards governments, economics, personal responsibility, corporate responsibility, and laws.
  • aric 12y ago
    Yes. You make it sound like people can't hold multiple opinions. A person can simultaneously believe the drug war is unethical while believing that selling (rather than openly revealing) 0day exploits is unethical. The difference is that most of those people are not calling for any government interference. Otherwise that would be humorous given that governments and their no-trace-back shell companies are the largest clients. They simply disagree ethically through free speech.
  • andreasvc 12y ago
    Just because libertarians may hold the opinion that the government should not regulate things like this does not mean they cannot think that selling exploits to the highest bidder is a deplorable thing to do.
• alasdair_ 12y ago
  I was surprised by the ACLU response given that sharing source code is very clearly free speech. Is the ACLU of all groups really interested in stopping/censoring people from sharing ideas?
  • techpeace 12y ago
    In this case, there's no "sharing" of code. They're selling 0-day exploits, which is considered bad form by many in the security industry. If Kevin were sharing the exploit code publicly, so that the associated vulnerabilities could be properly fixed and defended against, there wouldn't be such backlash.
  • declan 12y ago
    Chris, the ACLU staffer quoted in the article, is not an attorney. Chris has likened selling 0-days to being an arms merchant -- not a bad comparison -- but I'm not aware of an ACLU policy calling for a ban on selling 0-day exploits. To respond to your point more broadly, the ACLU has done excellent work on many Internet issues, and has represented me in court on multiple occasions. But it is not a monolithic entity, its board members do not always make the decisions you and I might prefer, and it does not always come down on the free speech side of an issue: http://www.volokh.com/2011/04/27/harvey-silverglate-on-the-aclu-and-free-speech/ http://www.volokh.com/2011/04/27/harvey-silverglate-on-the-a...
• kauffj 12y ago
  People will decry this, but I'd argue a free and open market for vulnerabilities would be a great thing. Here's why: 1) It would result in more vulnerabilities found This is fairly axiomatic. An open market increases the price of vulnerabilities which in turn increases the number of vulnerabilities found (unless you want to argue the ability to find vulnerabilities is inelastic for some reason). 2) It would result in more vulnerabilities being disclosed to the proper authorities rather than malicious parties This is more debatable, but since there should always be significantly more incentive on good actors to prevent the exploit (i.e. the software creators and/or community) than bad actors, the good actors should always win the bid. Indeed, one could argue that it is only the prevention of free negotiation in the sale of vulnerabilities is the reason an exploit is ever sold to bad actors (e.g. if I found a Windows vulnerability and told Microsoft $10m or else, I'm a criminal). 3) It would ultimately increase the quality of software Given more vulnerabilities are found and more vulnerabilities would be disclosed to good actors, the quality of software increases. I believe that 2) is essentially the Coase theorem (http://en.wikipedia.org/wiki/Coase_theorem http://en.wikipedia.org/wiki/Coase_theorem), but I am only an arm-chair economist. Also, I'm not sure that what Mitnick is doing actually is a free and open market for vulnerabilities.
  • melville_X 12y ago
    I mostly disagree with arguments to rationalize the sale of exploits, they create a massive power balance towards bad actors, but we have to be honest with ourselves, and like drugs, 0days are not going away. Our only proper response is secure software development practices, employment of security reseachers, and adoption of security-centric practices in critical systems... such as the Linux kernel. Which is embarassingly not the case at the moment. For ex: http://unix.stackexchange.com/questions/59020/why-are-the-grsecurity-patches-not-included-in-the-vanilla-kernel http://unix.stackexchange.com/questions/59020/why-are-the-gr...
  • hawkice 12y ago
    I upvoted, not because I agree, but because I believe the people downvoting you are downvoting because they disagree and not because your comment shouldn't be heard. Imagine he had said: I believe a free and open market for weapons would be a good thing, because it would reduce the number of defenseless people, would result in a power imbalance that puts generally-okay actors at an advantage (say what you will, but the mob doesn't have 1% of the resources the US government does), and would therefore reduce crime. I do not personally find that argument compelling (and it is of identical structure to the above), but me disagreeing with it does not mean it isn't of sufficient quality for Hacker News.
• Pxtl 12y ago
  Isn't this blackmail? "Pay us for all your secret vulnerabilities or we'll sell them to the highest bidder".
• boomskats 12y ago
  It's all very nice hoping that a free market for this kind of thing will improve security, but I don't see how that's going to happen. Government agencies are probably going to be his top customers... let's face it, they obviously have more funding for this kind of thing than they know what to do with, and it saves them having to do any hard work. It's going to bring way way way more detriment than it is benefit, especially if his clients start looking at using semi-legal tactics to protect their investments.
• tomelders 12y ago
  t'would appear he cares about nothing and no-one, and has opted to use his powers for evil. We shall have wait and see how that works out for him.
• olssy 12y ago
  At least this way large corporations will start paying more for their bounties.
• raverbashing 12y ago
  Well, this is what happens when researchers are snubbed by software vendors. I don't agree with the attitude and sale of vulnerabilities, but if someone approaches the vendor and get the responses "this is not a vulnerability" or "why are you hacking our software, we're calling the authorities" this is where it ends up...
  • VikingCoder 12y ago
    ...but then you end up with the question of "what's a fair price?" I don't know what to do about it, either. About the best I can come up with is to support software that I feel makes the best effort they can to defend against exploits.
    • wdewind 12y ago
      I'm not sure you do. White hat the price is free, the only request here is that you don't sue me for pointing out a hole in your system.
      • VikingCoder 12y ago
        No dice. /smirk
• Elizer0x0309 12y ago
  This again, reminds me that money can buy you anything... apart from a free CONSCIENCE.
  • forgottenpass 12y ago
    No, but the money is a great catalyst for dreaming up a rationalization that lets you sleep at night. There are plenty of things in business that can be seen as unconscionable from the outside. I find more business practices disgusting than the general consensus of Hacker News threads, I'm kind of amused that selling exploits is one of the places where a line seems to be forming.
    • Elizer0x0309 12y ago
      I'm pretty sure the line is drawn here because it is pretty clear why this is wrong. The relaxed ethics of the general consensus of the Hacker News threads is probably due to the lack of information rather than people here having questionable morals, or so I'd like to believe :).
• mindcrime 12y ago
  It's disappointing to see that Kevin would sell exploits to a government body, but I don't otherwise see a problem with an exchange for exploits. I mean, they're going to get developed and sold eitherway, whether it's here, on some darknet forum, or whatever.
• misiti3780 12y ago
  His website needs some work
• sauere 12y ago
  Not another story about this overrated dude. Don't get me wrong, im sure hes a nice guy. But he hasn't demonstrated anything useful for 20+ years and it seems he is mainly making a living writing vague non-technical h4ax0r books and giving interviews. Hell, i think he cant even code.
  • razster 12y ago
    I wouldn't say nice, just full of himself. You're below him in a sense.
• chubot 12y ago
  "My clients may use them to monitor your activities? How do you like them apples, Chris?" -- Mitnick to ACLU technologist, last line of article Wow what a first class dick. He's implying that he will be glad to sell zero days to the government to illegally monitor ACLU activities (e.g. free speech, etc.)?
  • dennissmith 12y ago
    Look at Mitnick's twitter feed. He clarified that the comment was just a "fuck you" in response to Chris you are a felon comment. Mitnick said he wasn't serious.
• deleted 12y ago
  [deleted]
• deleted 12y ago
  [deleted]
• ascendantlogic 12y ago
  I'm old enough to remember this guy's moment in the sun by getting himself arrested. It was easy to fall into the "Free Kevin" mindset but now he's just trading on the name to make money. It's hard to keep that same "fuck the man" vibe when you become the man. EDIT: I realize he's been trading on his name for a while now but I was cool with it when he was a "white hat".
  • wavefunction 12y ago
    He wasn't ever a white hat, grey at best.
    • ascendantlogic 12y ago
      Hence my quotes.
• _archon_ 12y ago
  As an off-topic note, I'd like to see if the font is showing up as poorly for anyone else as it is for me. The kerning is atrocious, and several rounded lower-case letters run into each other. This article is hard to read. ea, oa, ce...
• blake8086 12y ago
  If I were, say, some sort of Global Passive Adversary, I would try very hard to spy on Mitnick's communications. Then I could have all the vulnerabilities, and know who is buying and selling. I wonder if maybe that has occurred to anyone.
• mathetic 12y ago
  Basically, he is doing arm trade in 21st century.
• Canada 12y ago
  Let me inturrupt this fascinating discussion for an important PSA: All of you who don't produce 0 day: You don't get to have a say. Your opinion doesn't matter and you don't get a seat at the table, not even as an observer. And now back to telling other people what to do with their work product...
• joshfraser 12y ago
  The prevalence of 0-day exploits and the booming marketplaces for them are the biggest challenge for our industry today. The economic incentives mean that the worst vulnerabilities will increasingly be sold instead of responsibility reported. Why report it to the company in hopes of a 5k bounty, when the US gov will pay you 100X that for exclusive use? We're at a point now where everything has been compromised -- the network, every OS, every browser, every popular application. The software we all rely on can not be trusted to be secure from governments or well-funded organizations. Having unbounded access to every computer in the world is a frightening amount of power for any government or organization to hold. Until we find a way to change the economic incentives, I'm afraid the consolidation of power and the associated abuses are only going to continue. I have no idea how we fix this.
• hokkos 12y ago
  His website look like very "Free Kevin" era, with Flash replaced by CSS tricks.