Slashdot Mirror
$16,000 Bounty for Sendmail, Apache Zero-Day Flaws
Famestay writes "Verisign's iDefense is putting up a $16,000 prize for any hacker who can find a remotely exploitable vulnerability in six critical Internet infrastructure applications. The bounty is for a zero-day code execution hole on the following Internet infrastructure technologies: Apache httpd, Berkeley Internet Name Domain (BIND) daemon, Sendmail SMTP daemon, OpenSSH sshd, Microsoft Internet Information (IIS) Server and Microsoft Exchange Server. 'Immunity founder Dave Aitel, who also purchases flaws and exploits for use in the CANVAS pen testing tool, says its doubtful iDefense will get any submissions from hackers. "It's very hard to exploit [those listed applications]," Aitel said. "IIS 6 hasn't had a public remotely exploitable bug in it. Ever." Several other hackers I spoke to had very much the same message, arguing that $16,000 can never equate to the amount of work/expertise required to find and exploit a hole in the six targeted technologies.'"
Easy money....easy money.
start here http://secunia.com/product/73/?task=advisories
arguing that $16,000 can never equate to the amount of work/expertise required to find and exploit a hole in the six targeted technologies. Clearly, the so called experts aren't aware of the multitudes of enterprising folks living outside the inflated Western wage spectrum. For someone a little more eastbound, that's a nice chunk of change.
Does it count if we "find" a "hole" in the current CVS snapshot?
Do daemons dream of electric sleep()?
*begins digging through code*
Hydraulic pizza oven!! Guided missile! Herring sandwich! Styrofoam! Jayne Mansfield! Aluminum siding! Borax!
It's a great reward if you've stumbled across a hole. Also, you may be able to collect multiple bounties from different organizations for the same hole. I think the bounty system has plenty of merit.
Triple that amount of cash. Or more. Or your life. Or, the well being of those you love.
You get the point.
IIS 6 hasn't had a public remotely exploitable bug in it. Ever.
How can that be? IIS is crap! Slashdot tells me so!
$16000 is not worth the time to make the internet safer. Now stop bothering me while I spend my time trying to figure out how to save $15 by cracking DVDs. After that, I'm off to steal some music.
So, it would be reasonable to assume that any development branch stuff including current CVS snapshot would be inadmissible.
Considering that creating exploits and/or publishing them is considered a criminal offense in some jurisdictions, I wonder how many submissions they'll get. Especially when a good unknown exploit could be worth far more than 16,000.
Hax-fu?
$16,000 ?
That's it ?
That type of exploit is worth at least a brand new BMW.
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
Also, you may be able to collect multiple bounties from different organizations for the same hole.
... but I bet breaking an NDA with the Russian mob could adversely affect your ability to work in the computer-security field in the future.
True
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Pfff.... Ms. Echange ....
:P
No need to find a flaw, Ms exchange will crash on it's own.
I wonder if the current rise in prizes being offered for discovering vulnerabilities in code might lead to some sneaky behavior.
1. Leave subtle flaw in your code
2. Share information with distant acquaintance
3. Profit!
1. Find 12 Exploits
2. Submit 6 Exploits
3. ????
4. PROFIT!
Multiple choice for #3 today, class...
A) Collect $16,000
B) Create botnet using other 6 exploits and rent to spammers - Collect $???,000
C) Wait for next contest, submit remaining exploits - Collect $newprize, repeat
D) All of the above
Suppose you know an exploit in IIS or Exchange.
... or do you see what Microsoft will pay you NOT to sell it to them?
Do you sell it to those guys for $16K
oops LIGHTTPD cant edit damned comments, it was meant to have a hyperlink to lighttpd.net
>the following Internet infrastructure technologies:
Since when are we using marketing speak here? Can we please call them programs or program systems?
thegodmovie.com - watch it
Maybe there are people out there who already have more than one exploit for these and wouldn't mind trading one in for a legal source of quick cash. Who knows? 16k buys very a nice chunk of electronics for people who don't need the money for anything else.
Liberty.
Somewhere, I believe in one of Scott Adam's (the Dilbert creator) books he has a (purportedly) true story about a company where the testers were paid $100 per bug they found. According to him, the program was scrapped after a week, but not before quite a few expensive gifts went from testers to programmers.
It seemed like the an urban legend ala the Woz getting $100 for each chip he got off a board, but I've heard that that one is actually true, so maybe both are??
Yes, it's the fallacy of assuming the whole set has parts comprable to one element. Yes I know this. Please mod the logic Funny and the first paragraph Informative.
Thank You
Your ad here. Ask me how!
Here are the terms of the challenge -
* The vulnerability must be remotely exploitable and must allow arbitrary code execution in a typical installation of one of the technologies listed above
Ok, so you pick some of the oldest and most robust technologies around - things that have had a LOT of the bugs worked out of them already and things are you're not that likely to have to pay out on.
* The vulnerability must exist in the latest version of the affected technology with all available patches and/or upgrades applied
* 'RC' (Release candidate), 'Beta', 'Technology Preview' and similar versions of the listed technologies are not included in this challenge
So you eliminate any upcoming versions, but you forget to exclude the previous versions....
* The vulnerability must be original and not previously disclosed to any party
So if I've already informed the software maker, it's out, further reducing the likelihood of any kind of a payment having to be made.
* The vulnerability cannot be caused by or require any additional third party software installed on the target system
Reasonable, but...and this is a big but....many things are quite secure on their own, but not so much so when you actually start using them. Prime example, Apache. Apache on it's own is fine. Install one of the open source PHP web apps and then see how secure it is. How many people run Apache serving up hand coded HTML?
* The vulnerability must not require any social engineering
This is because we all know that there is no patch for human stupidity...though I've never seen it admitted quite so blatantly.
PHOOEY ON YOUR CHALLENGE
It would take me a lot of man hours to come up with something, more to code an exploit for it and by the time I'm done...I'd be better off financially if I had worked at Wal-Mart for those hours. $16,000 divided by 4 (people on my team) = $4000 each. Let's say we spend 5 weeks on this. That's 200 hours each. That works out to having a chance to get $20/hr. And frankly, I think that 200 hours each is pretty optimistic. We're talking about pouring over their code base, becoming familiar with it, and looking for places that we can try to break it. That's in excess of 89,000 lines of code just for Apache and more than another 70,000 for Sendmail. Then we have to load it up, write some code to test the exploit, and run it to see if works. If it doesn't on the first try, it's rinse and repeat until we give up on that possible exploit and try a different one.
I'm guessing that this is more of a publicity stunt than anything else. Anyone in the industry should know better. This has to be something that the marketing poohbah's have dreamed up. Just more marketing hype so that they can say, "We're more secure than those other guys. We ran our challenge and we didn't get anything. These apps are safe to use."
2 cents,
Queen B.
HDGary secures my bank
Hax-fu?
Is it just me or is anybody else tired of hearing the phrase "zero-day" on a daily basis?
The criminal underground (russian mafia etc.) supposedly pay $50k-$100k for zero-days, if you're after the money might as well sell your exploit to them.
If you're after fame, you report it through the proper channels (CERT or the vendor directly). You get credited in the bugfix, but gain no money at all.
Selling to one of these guys just goes into the pockets of these zero-day vendors, who then get more customers paying them $$$ to be a few days ahead of everyone else (but they'll get the patches at the same time as anyone else anyway, their IDS's just get signatures for these new exploits)
Could I just offer up a $16,000 bounty as well? 'Cause there's plenty of money to be made with 0day flaws.
Anyone can discover them, so it's plausible that two people can know the same flaw. So one party gets the flaw and gives the $16,000, then communicates the exploit to a third party who hacks in and gets trade secrets (or teh g0ld) and sells those, or whatever.
Twinstiq, game news
$16000 is nothing. If you run a botnet you can have $10000 rolling in per week, alternatively if you have undisclosed vulnerabilities and the right contacts, you wont bother with the silly bot-masters who will get you discovered even though they will gladly pay anything from 50 - 150 grand for a remote hole. More likely, you would save up the good holes for high-paying, one shot mob deals against banks, and maybe government intelligence (they have a big budget for that in Soviet Russia and China). 16000 dollars? No, sorry, IIS is perfectly secure!!
:D
PS: I am not some shady person who wears black hats. Hacking is too dangerous for a nice guy like me, even though almost anything can be done with time and dedication..even the functions that check string lengths to prevent overflows can be hacked
Just $16000. I guess some 0 are missing. There are more info on http://inews.110mb.com/
Romania rocks.... they have the best Hackers in Europe!
Strive to be happy...
I guess some people reading this may be more used to Windows and therefore not entirely familiar with the functionality of the Unix packages that were mentioned. Allow me to summarise :
OpenSSH - A service you can install on a Unix system to enable remote admin access for known users.
Sendmail - A service you can install on a Unix system to enable remote admin access for complete strangers.
Hope this helps.....
LMAO.
Did Microsoft hire Baghdad Bob as their PR guy?
http://secunia.com/product/1176/?task=statistics
I say things which affects my Karma negatively. (and I don't care) For instance; All religion is false.
Well, at least Exchange on SBS 2003 needed the service restarted every day due to the caching in memory of all emails converted to HTML for OWA. I found that to be unbelievable. On the servers that we put out there if they ran for a Week then Exchange would eventually take over all available RAM and the server would run like a dog.
I don't know if Microsoft ever put out a fix for that flaw, but it has been a while since I have installed SBS 2003. It certainly isn't a bug that is exploitable for remote code execution.
Cheers, Chris
...for creating a 'busy work' distraction for the geek students who would normally spend the summer holidays writing this year's worm.
...but my opinions are purely my own and I speak for myself, not my employer.
y _Services_Tours_&_Demos/security-threat-video.html shows one way that this intelligence is used.
:)
Anyone "in the industry" already knows about iDefense and their Vulnerability Contribution Program, so you obviously are not. iDefense isn't the only company that posts challenges or pays for vulnerabilities. Perhaps you should read up at http://labs.idefense.com/vcp/
It is not a marketing ploy or publicity stunt. The iDefense business is about selling internet intelligence, not pushing anyones software. This is an initiative to discover critical vulnerabilities in those applications so that they can be patched. Nothing more. If you believe that BlackHats aren't already looking for vulnerabilities in those applications then you need to get a clue stick and start whacking yourself over the head with it. The VCP gives WhiteHats (and GreyHats) incentive to find them first, so that they can be dealt with responsibly rather than end up a zero-day exploit.
The applications chosen are old and considered robust. That's why they form the backbone of the internet in the first place. And also why a critical bug in them could bring the internet to its knees. Any QA engineer worth their salt will tell you that the first place to look for a bug is in software that has shown itself to be buggy - and that applies at whatever level you want to consider - block, function, class, library, application or suite. sendmail anyone? Bind? If you believe that there are no more bugs to be found then you are likely mistaken. I think iDefense will (gladly) pay out on more than one of these applications during this challenge.
The terms to the challenge are fairly standard and non-onerous, and I think you're reading too much into them. The version restriction is purely because no-one is interested in vulnerabilities in Apache 1.4, nor IIS 5 anymore. The additional software clause is again non-onerous. Your example isn't valid as a vulnerability in e.g. vBulletin would be a vulnerability in vBulletin, not a vulnerability in apache itself. Now if you could make a well configured mod_php fall over and clobber the box without requiring badly written php pages installed, then I think they'd be interested in that. The term about having not previously reported it is so that the vulnerability can be labelled iDefense-exclusive, adding value to the intelligence report.
Ask yourself where the iDefense business model is if there were no vulnerabilities in any software. The entire business is built on the premise that there are vulnerabilities and that there are customers willing to pay for intelligence reports about them, and vendors willing to receive notifications about them. iDefense would love to pay out on all of those prizes.
iDefense do not sell any software, so there is no reason to say "We're more secure than those other guys". They sell actionable internet intelligence. http://www.verisign.com/Resources/Managed_Securit
Frankly, maybe you should stick to Walmart as you don't seem to know much about the internet security business. I doubt that you could make a living in it. You should get your patch installed..
(BTW - for all the slashdot VeriSign haters out there - after over a decade in the workforce with multiple employers, I can honestly say that I have never worked for a company so committed to helping customers solve problems. Every engineer I work with is dedicated to making the internet a better, faster, safer internet, and I work among extremely smart people who have respect, integrity and drive.
So the company implemented a RFC1034- and RFC1035- compliant service a few years back before pulling it after customer feedback. Get over it already.)
That's a little like implying that the fact that you can (probably) compile Apache 2.0 to run on Solaris 2.5 means there is something buggy about Apache 2.0.
money is the source of all evil code ... wait ... or is it the other way round?
I'm surprised to see Microsoft's server software in there. I'm not surprised because I thought IIS was insecure, I'm surprised because I didn't realize it wasn't secure, I just assume it was, and buggy generally, like all other Microsoft software. Certainly, the few MS programs I've used were buggy (XP, Word, Vis Stu, SQL Server) so I assumed they all were. If Microsoft has the institutional ability to make bug free software, then why don't they make more of it? Why don't they share the magic team of wizards who built IIS with the rest of the company?
Maybe I should ask for corroboration. Is IIS really bug free software? I mean, at lease for security bugs?
...for any developer of Sendmail or Apache or BIND sneaky enough to slip in a new security hole.
Did you ever notice that *nix doesn't even cover Linux?
> The bounty is for a zero-day code execution hole on the following
:o)
> Internet infrastructure technologies: Apache httpd, Berkeley Internet
> Name Domain (BIND) daemon, Sendmail SMTP daemon, OpenSSH sshd, Microsoft
> Internet Information (IIS) Server and Microsoft Exchange Server.
Anybody else noticed that the acronym for "Microsoft Internet Information Server" (MIIS) is pronounced "miss"?
In this case, "infrastructure technology" doesn't seem so assinine. Services like BIND, Sendmail, httpd, IIS are pretty much What the Web Runs On(tm).
That's wicked man, just wicked. This, folks, is a true geek!
Cracking DVDs is easy, and it helps fair use (playback on Linux, etc).
Cracking most of this stuff is, I'd imagine, significantly harder -- after all, it is possible for Apache to be secure, whereas it's not even close to possible for DVDs to be uncrackable.
That's ignoring the economics of it -- $15 per DVD? Fine, you just need to sell 1,067 copies and you've made $16k. That's assuming money was ever the point.
Don't thank God, thank a doctor!
So Mr. 733t H4x0r, put your money where your mouth is and produce the exploit and get back to us when you've won the prize. I know lashing out at Microsoft is par for the course here on Slashdot, but you might be intrested to know that according to TFA, IIS hasn't had a single public remotely exploitable hole.
1) It's a remote request
2) It's public
3) It's an exploit
=================
But then again, you'd know about that if you followed my first link.
There's a reason that companies like JS Wurzler charge a 15% premium to IIS users.
Count me among the webmasters who abandoned IIS long before the Code Red virus came along. If you want to keep treading in those waters blindly believing that IIS is the most secure web platform feel free. Even Gartner has recommended against using IIS. Yeah, that was before version 6 came out, but really - if things went so far that Gartner actually issued a recommendation do you think it's a smart thing to start using it again as soon as a version upgrade is released?
Appearantly what you were looking at was an attempt by someone to discredit IIS 6.
.NET so I highly doubt they will be turning on ASP.
Full Disclosure: IIS 6 Remote Buffer Overflow Exploit ????
Anyone can send an email into FULL DISCLOSURE, it doesn't mean their is any merit to his claim.
Do you see any published remotely executable exploits on secunia?
( http://secunia.com/product/1438/?task=advisories )
I see 3. One has a remotely executable vulnerability. BUT you have to turn on ASP to exploit the vulnerability.
Most organizations that are running IIS 6 are
Dont worry Kid.......it's OK to be a N00b.......Just dont talk shit when you dont know shit!
This is just another marketing ploy by Big MaMa Verisign.
Someone should offer $20K for Verisign vulnerabilities since iDefense cant publish those.
Just as a hint, start your research with Verisign PKI and focus on sophia.exe.
so next time you see sophia.exe in your browser cache....open it up and view in notepad.
WOW, there is my username and password cched to my browser in a hidden field.
Trust me, there are alot more exploits then that.
where i work we manage a lot of clients sbs servers with exchange and i've not noticed such a performance hit, so im guessing whatever was causing this issue is long gone...
jaymz
Aitel said. "IIS 6 hasn't had a public remotely exploitable bug in it. Ever."
I can't comment about IIS 6's apparently good security record... But as IIS 6 only runs on Windows platform it doesn't make much sense to talk about remotely exploitable holes in IIS 6 without talking about remotely exploitable holes in Windows does it!?
I mean, I could read that as "woaw, cool, now I'll install IIS 6 on OpenBSD an I'll have a secure system! Uh, wait, I can't do that!?". Who cares about the security of the front door when the only windows you can have on that house are wide open?
replace "if not" with "if he didn't need the huge bonus to find and release the information on the issue"
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register