Slashdot Mirror
An eBay For Hackers
cyberdelicat writes to let us know about a Swiss security firm called WabiSabiLabi that is causing waves with its open auction for zero-day security vulnerabilities. While WSLabi claims they will thoroughly vet both buyers and sellers of vulnerabilities, many researchers are skeptical about how effectively they can do this. The Washington Post article mentions the guy who almost opened a similar auction site several years back, to be called Zero-Bay, but pulled the plug at the last minute. SearchSecutiry notes that some security researchers are now referring to WSLabi as "zerobay" as they undermine the auction site by reproducing and publishing vulnerabilities as soon as they appear for sale.
http://it.slashdot.org/article.pl?sid=07/07/06/014 4234
same crappy three exploits that were up a week ago
OK now I know I'm reading Slashdot ;)
What do you guys think of this one http://www.swarmbuy.com/
http://it.slashdot.org/article.pl?sid=07/07/06/014 4234
Yet Another Dupe.
~ a low user id is no indication I have a clue what I'm talking about.
i guess we could just stay here....
A sold vulnerability ends up being used against the site?
Only 4 Items for sale...and 550 euro for the Linux Kernel memory leak sounds fishy with only 1 bid
If they're auctioning off vulnerabilities... and someone that we'd prefer to not know about them knows... who's at fault?
Site slashdotted out? Use SharePapyrus under Site Directory
It's not Unusual to have secks in tha butt...
(DaNaNaNaNaaaa...)
FREAKIN ' LOAL DUDES!!!
ME AM BRAZIL!!!!
This whole idea is wrapped in so many layers of stupid I can't wrap my brain around it.
Problem is, like many functional solutions in this world, it may be just stupid enough actually work.
Either because it's a dupe or we read about it somewhere else a week earlier.
But hey, keep up the good work, kdawson!
*Yes, I'm duping my own post on Slashdot about dupes on Slashdot. Seriously, are kdawson and Zonk actually paid for the time they waste here?
How does someone selling something illegal get paid? If I open an auction site for heroin it would be greeted with great fanfare, even by the law enforcement community. Because they could just arrest the "winners" (actually losers). Sounds like a real money-maker for about 30 seconds.
OK, so there is an open auction for a remote exploit for Yahoo Messenger. So if I wanted to steal bank account information from lots of Yahoo Messenger users, this would be a good start. The minimum bid is 2000 Euro, which sounds pretty fair for something that could be used to grab millions of dollars from unsuspecting users worldwide. I would assume that similar exploits could be used in a similar fashion - to steal from people. Isn't that the new way to make money on the Internet from Eastern Europe?
Welcome our new dupe overlords. Soon we'll have enough to make a beowulf cluster of them.
Give Kashyyyk back to the Wookies
I saw via a security mailing list ridicule at "Who the hell would buy a Yahoo messenger exploit. har har". So let's think about this for a minute... Done, how many people do you know that use Yahoo messenger at their corporate office? As obscure as some may think the site will be, all you need is some hardcore "pwning" going on, and some government will treat the site as they did Pirate Bay and shut it down quickly
Infiltrated dot Net
I posted this awesome cultural comment the last time this story was posted and nobody even replied. Now the dupe is just plowing up all those bad memories again. http://it.slashdot.org/comments.pl?sid=246095&cid= 19763499
Of course it sounds ridiculous, but if you think about it, it's actually not a bad idea. For one, if there are these critical bugs being published all the time and big companies are taking the heat for these vulnerabilities, you can bet the companies would either a) pay top dollar to buy the exploit themselves and hopefully patch the hole, or b) encourage them to be more proactive. Rewards for finding holes would mean a reliable stream of money for those who find them, ensuring that there would be plenty of people willing to essentially clean up what the original programmers missed. You'd have to live under a rock to think that vulnerabilities were not already traded in a black market (and this isn't a normal black market -- it's a market of people who, buy their very presence in this market, are very technologically adept and know exactly where to seek out these sorts of things). If they're going to be bought and sold anyway, why not legalize it and have it do some genuine good?
Oh man, I wonder if I could get five bucks for a rickroll! I mean.. that shit has to be worth five bucks. =)
A Slashdot for Dupes?
Selling information about security vulnerabilities may be considered unethical by some, but it is perfectly legal in almost all countries (notable exception: France). Don't forget that a vuln is just a bug, they are selling information about how to trigger a bug. Why would that be illegal ? If a buyer exploit the bug for nefarious purposes, then the buyer is doing something illegal, not the seller. There are plenty of legitimate cases where a market for selling vulnerabilities is a good thing:
Working As Designed. This is Slashdot.
Quite often, it is illegal to sell someone something if you should reasonably know they are planning on using it for an illegal purpose. As a simple example, a gun dealer in in a world of shit if someone comes in and says "I need a gun so I can go kill my wife, what do you have for me?" Basically, you are an accessory to a crime if you have or should reasonably have knowledge that a crime is going to be committed and you provide support, material or otherwise, for the commission of the crime. So while not disclosing a venerability is legal, selling it to someone that you have a good idea is going to use it for criminal means is illegal. The ignorance defense only goes so far, while being an accessory requires knowledge of the crime (you can't be charges for letting someone in a house if you legitimately believed they should be there, for example) it doesn't require that it was spelled out for you. If there was enough evidence that you should have known what was happening and were just being willfully ignorant, that doesn't cut it, especially if there was profit involved.
There are additional problem when you start dealing with certain classes of items. If something has substantial legal uses you are on much more solid ground. To use the gun example again, guns are widely used for hunting, target shooting, personal and home defense, all perfectly legal uses. Thus it isn't a stretch to assume someone has a legal use for it, unless there's specific reason to believe otherwise. However if the item in question has little to no legal use, then there can be problems. I see exploits as being mostly in this category. Other than the companies, who really has a legit use for the details behind an exploit? Now this isn't a challenge to try and come up with obscure reasons someone might want it, it is something to think about in general. What would people by and large want to buy these for? If the majority of realistic answers are illegal ones, then you can have a real problem when you sell it if you aren't real careful.
Not exactly zero-day news
This zero day exploit uses a buffer overflow in IE to delete all the files on the PC. Ending in 7 days.
I usually try to not feed the troll, but eh.
If you think malware comes only from Eastern Europe, you're mistaken.
Thats a good idea. From now on, I'll sell the defective products and then later auction the known defects :)
???
Profit!!
Eclipse PDE and Me
Or the most basic: A sold vulnerability market also supports honest scurity researchers financially. Security will become a higher priority for venders if they must bid against black hats. etc.
Big security problems currently come from people not installing patches. You can't fix this since you can't write perfect code. But you can help by writing better code. So we must make venders see the real costs.
The Christian religion has been and still is the principal enemy of moral progress in the world. -- Bertrand Russell
If something is a problem for you but the people that could fix it don't care, then naturally no one is in a hurry to fix it. MAKE it an immediate problem and you will get a faster fix. There will be more collateral damage of course, but the unfortunate part is not the collateral damage, it's that we have to HAVE it to motivate the people to fix their crap. This whole concept of blaming, attacking, and trying to silence the whistleblowers has got to stop. It's not their fault. Are they making the problem worse? You bet they are. But the problem should not have existed in the first place, and the ones that are in a position to fix the problem are in no hurry and so these things just get hidden, ignored, and drug out. By making the problem a magnitude worse, they mostivate people to fix things because they can no longer tolerate the reproducssions of their apathy. (or rather, their customers can't tolerate it, and rocks roll downhill)
I'm all for this. The only ones that are really against this are the producers that are too cheap to invest sufficient funds in securing their product and do not want their cheapness to be exposed - they cry that their shortcoming is someone else's fault, merely because they pointed it out to the public. If I expose your failure, that doesn't make the results of your failure suddenly my fault.
I work for the Department of Redundancy Department.
Most are just extortionists, especially ever single poster on Full-Disclosure who claims they should profit ``their work'' (which is used to extort companies) .
The ``work'' they speak of is running tools they didn't make on code and finding bugs then trying to extort companies because they found this bug. Don't let the full-disclosure ethic confuse you, security researchers are black hat extortionists, the only ones who aren't are those who bother holding a faculty position, so they are already paid.
The whole thing just seems stupid. Sell information about a vulnerability, then wonder why your website is down 5 minutes later...
The eBay we already have is the 'for hackers' one.
I use it regularly to buy PIC controllers, semi-exotic silicon, and weird computer hardware (i.e. anything 'the natives' can't Install Windoze on here in tardo flyoverlandia). I also sell a lot of cool stuff, like PDP-11 hardware, etc. Without eBay or at the least the Web and mail order, a person such as myself couldn't live in this godforsaken (actually, god-addled) part of the country.