Slashdot Mirror
MS Excel exploit on auction
geo_2677 writes "Someone had put up for auction on eBay the details of an exploit in Microsoft Excel according to a recent article on Securityfocus. According to the article Microsoft has confirmed that this vulnerability exists, but in the meantime the original listing on eBay has been pulled. " The now pulled auction, but it does appear that Microsoft has confirmed the vulnerability in an eweek article.
First, in the interest of stimulating more informed discusion, here is some more information concerning the auction:
From the auction text: Second, two questions:
Discuss.
____
~ |rip/\/\aster /\/\onkey
Who is the bigger sucker?
t =b&na=88&View=en-us&qu=excel+crash
The people who bid on an exploit to make Excel crash? Or those who believed that this was a critical security flaw? Or Ebay for posting it in the first place?
If you really want to know how to make Excel crash, pick your poison - here is a free link:
http://search.microsoft.com/search/results.aspx?s
He who knows best knows how little he knows. - Thomas Jefferson
Why should not one be able to sell a vulnerability since they are in fact commodities?
If you can profit from making them, profit from dealing with them then why not profit by discovering them? There are precidents like this, the patent system has companies that hold patents for no other reason than to sue other companies when they trip on a patent.
All this will do is force the practice underground. Mind you, it does let the world know it is going on.
How would you go about setting the price of a security hole? What is the worth?
"By monetary value of what could be lost exploiting the hole", or something else? Estimation of possible gains (user data like credit card info) through usage of the hole - the perpetrators view?
Because, lets face it: There are people out there willing to pay for information like this.
(and I'm not saying its right - just stating the fact). There are also others wondering how some things come to pass, and the damage bad code review actually causes.
ok, sorry - possibly OT. But I *am* intrested in /. ers reasoning about "the value/possible cost of security holes".
"If it can be thought up, there exists at least one person trying to make it happen for real" - Phil
http://feedback.ebay.com/ws/eBayISAPI.dll?ViewFeed back&userid=fearwall
:)
Looks like the seller just bought a keystroke logger....
This could be the start of a good way to embarrass companies into fixing bugs AND punishing bad people. Evil person wants to use the exploit, so they bid. Microsoft don't want the exploit usable, so they fix it (run with me on this one for a moment) The clever bit is, the Seller (who is honest, intelligent and socially responsible) sets the auction expiry time far enough into the future to cause a race between the two. M$ are put on public notice when the exploit becomes usable. If they win the race, Evil Person has to pay for no benefit (or M$ would give them a bad ebay rating - that'd hurt, right?). If they lose the race, public humiliation ensues. This is sort of like the Bounty system, in reverse. Or just plain blackmail. Either way, it would be fun to watch.
So is it OK for me to provide a detailed description of how to make a suitcase nuclear weapon, including people to contact to get the materials used in its production? How about the nuclear launch codes and how to use them? How about some top secret security codes used for encryption of data regarding national security? How about the security codes to your house alarm?
Supression of information is a necessary fact of life in a world where information can be used to harm others.
This does not justify supression of any information a goverment feels like supressing. Each case must be examined carefully, but to say that there is never a justifiable reason to supress information is dangerous and clearly at odds with reality.
A security hole would gets its value from the attached object. A how-to on bypassing shed locks is less value then a how-to on bypassing a bank safe.
Next would come how easy it is to exploit the security hole. This one seems to require people to open an excell sheet. This obviously makes it off lesser value then say an exploit that works when a user opens a gif file via IE. Even more valauble would be an exploit that does not require the user to do anything but can attack any computer just hooked up to the net.
Would there be money in it? You bet. Once you got an exploit using it to install a botnet is childsplay and botnets are big business. If you can deliver a 10.000 zombie network there are people willing to pay you hard cash in exchange. Even for just renting it.
However you would hardly do this over e-bay. There are very few legit uses for a botnet and therefore your potential customers would prefer a less public way of trading it.
But it does happen. It is one of the reasons we see so few destructive virusses vs the ones that turn a pc into a zombie. Used to be different. Once the majority of virusses either joked or destroyed your machine. Now you just got a zombie. Do I have proof?
No of course not. Just stories tall tales from the server room and hints that should a company that hosts pay sites wish to do some advertising that they might know ways that do not involve constantly trying to find the next provider willing to be placed on a ban list for spam.
Spam sells, ISP's are unwilling to hosts spammers, so the only question is, will spammers pay for a botnet that can do their spamming. Does the pope shit in the woods?
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Hunting stores sells lots of guns and knives all the time, and if someone buys one of these and kills someone else the hunting store is not to blame. Just as this guy should not be blamed it his sale had lead to a misuse of the exploit.
Your right. We should just cover these things up like stinky poo and ignore that they exist. That will make them go away!