Slashdot Mirror
$16,000 Bounty for Sendmail, Apache Zero-Day Flaws
Famestay writes "Verisign's iDefense is putting up a $16,000 prize for any hacker who can find a remotely exploitable vulnerability in six critical Internet infrastructure applications. The bounty is for a zero-day code execution hole on the following Internet infrastructure technologies: Apache httpd, Berkeley Internet Name Domain (BIND) daemon, Sendmail SMTP daemon, OpenSSH sshd, Microsoft Internet Information (IIS) Server and Microsoft Exchange Server. 'Immunity founder Dave Aitel, who also purchases flaws and exploits for use in the CANVAS pen testing tool, says its doubtful iDefense will get any submissions from hackers. "It's very hard to exploit [those listed applications]," Aitel said. "IIS 6 hasn't had a public remotely exploitable bug in it. Ever." Several other hackers I spoke to had very much the same message, arguing that $16,000 can never equate to the amount of work/expertise required to find and exploit a hole in the six targeted technologies.'"
arguing that $16,000 can never equate to the amount of work/expertise required to find and exploit a hole in the six targeted technologies. Clearly, the so called experts aren't aware of the multitudes of enterprising folks living outside the inflated Western wage spectrum. For someone a little more eastbound, that's a nice chunk of change.
IIS 6 hasn't had a public remotely exploitable bug in it. Ever.
How can that be? IIS is crap! Slashdot tells me so!
$16000 is not worth the time to make the internet safer. Now stop bothering me while I spend my time trying to figure out how to save $15 by cracking DVDs. After that, I'm off to steal some music.
Considering that creating exploits and/or publishing them is considered a criminal offense in some jurisdictions, I wonder how many submissions they'll get. Especially when a good unknown exploit could be worth far more than 16,000.
Hax-fu?
Also, you may be able to collect multiple bounties from different organizations for the same hole.
... but I bet breaking an NDA with the Russian mob could adversely affect your ability to work in the computer-security field in the future.
True
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
I wonder if the current rise in prizes being offered for discovering vulnerabilities in code might lead to some sneaky behavior.
1. Leave subtle flaw in your code
2. Share information with distant acquaintance
3. Profit!
"Do you sell it to those guys for $16K ... or do you see what Microsoft will pay you NOT to sell it to them?"
Neither. You auction it off to the highest bidding spamgang. Or so I've heard.
Beauty is in the eye of the beerholder.
Also, you may be able to collect multiple bounties from different organizations for the same hole.
Yeah, but pimpin' ain't easy.
Fill in your four or five-letter word of wisdom here _ _ _ _ _.
Just to narrow it down, I redid your search with quotes and found 67. But the first one's a blast. It goes to the "w4ck1ng" forum where the thread goes...
"Hello found this exploit: http://www.derkeiler.com/Mailing-Lis...5-04/0436....and the response goes:
"you can not use exe files under unix y0u have to compile it with GCC..."
I *think* IIS is safe from *this* guy...
I guess some people reading this may be more used to Windows and therefore not entirely familiar with the functionality of the Unix packages that were mentioned. Allow me to summarise :
OpenSSH - A service you can install on a Unix system to enable remote admin access for known users.
Sendmail - A service you can install on a Unix system to enable remote admin access for complete strangers.
Hope this helps.....
What the fuck? Employee figures out way to save us $15 million. Employee parts with $1 million. Net savings: $14 million. So the company netted $14 million, and suddenly thinks this whole thing was a bad idea?
No comment.