Slashdot Mirror
New Site Aims To Be iTunes For Exploits
Trailrunner7 writes "It's been tried before, but NSS Labs founder Rick Moy says his company's new Exploit Hub — a store front for exploit code — can work. In an interview, he explains why the current market for exploits doesn't work for the good guys, and why zero-day exploits don't help anyone. Above-board markets for software vulnerabilities have been around for close to a decade, but previous efforts to market exploits have had mixed results. The business of selling exploits versus vulnerabilities is fraught with danger, and organizations like WabiSabiLabi have operated eBay-style marketplaces for zero-day exploits for years, but haven't seen exploit writers beating a path to their door. The need for an above-board marketplace that can compete with the black market surely exists, but getting it to work is another matter entirely."
He compared his company to "Craigslist", not "iTunes".
I'm not sure that's the image you'd want to project for your company, but I'm not that guy.
Does this mean they force you to install quicktime?
Just say no.
An "above-board" market for exploits?
Who exactly is planning on buying these things and NOT planning to do something illegal with them?
I'm not all that familiar with the MetaSploit Framework (which has been bought out) but don't things like this already exist...except they're...you know...free!
We need an auction site where vendors, bad guys, and good guys all bid on 0days.
(I didn't RTFA, but in this case, that probably helped.) I interpret "iTunes for exploits" as meaning that you go to the trouble to load up your computer with exploits, then you do a sync, and suddenly all of the exploits which you had loaded, but which didn't come from their "iTunes for exploits" are inexplicably missing. So as long as you install this "iTunes for exploits" software but don't ever use it for installing your malware, then occasional syncs can function as malware disinfectant. That doesn't sound illegal; it sounds like the natural progression of AV software.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
I'm sure most of this will come from metasploit, packetstorm, and exploit-db. Directly selling exploits is shady, no matter what company is backing it.
Really, really awful analogy. I've already explained my viewpoint here:
http://slashdot.org/comments.pl?sid=1822976&cid=33911372
"When information is power, privacy is freedom" - Jah-Wren Ryel
Exploits have value on the 'black' market: they can be used to steal information or to redirect computer resources for the exploiters ends. Both information and captive computer resources are fungible; there are active markets for them.
In the hands of a cracker, an exploit can be used over and over to create value (illegally, immorally, unethically, etc, but so what.) It is a capital investment that can continue to pay dividends and has a long expected life span.
The value that is taken is spread out over diffuse and disorganized individuals.
Even better for the exploit writer, the exploit is a product that can be sold to many crackers at zero marginal cost. So the 'black' market for exploits has a large payoff for the exploit writer: the total value of the exploit is: what can be stolen X how often it can be reused X how many times it can be reused X the number of people who can use it
Now the legal market:
The exploit writer sells the exploit once, then it disappears. Potential buyers in this market are not the same people who are threatened directly by the exploit; instead, they are usually the creators of the exploited product. They have less to lose than the potential victims do, which is the same as saying that they have less to gain in preventing the exploit than the numerous crackers do in using it.
This is why the legal market does not work: the exploit writer is being asked to sell the exploit for less than its value elsewhere, and therefore is losing money.
The probability of being caught on the cross-border Internet ase pretty low, so its a good bet to try and profit from an illegal exploit.
So:
If you are willing to pay less than the total value of the exploit as a criminal tool, no one will sell it to you
If you are willing to pay the exact value, you can buy it, but you have created no value; you have only shifted wealth from your pocket to those of the potential victims.
If you are willing to pay more, you will get even more exploits created by raising the value of all exploits
Good luck with that.
So you're going to start out selling exploits for 99 cents? And then create a(n expensive) portable device that people can buy to run your exploits on? And then become the market leader? And then introduce new models of your hardware? And then create an "exploit" store sdk so people can sell there own exploits? And them submit to exploit creators demands that the price be raised to $1.29? And then remove color from the user interface?
Coder's Stone: The programming language quick ref for iPad
Seems like a nice easy way to make a bit of cash in your spare time without any particularly rare skills needed. Just find a vulnerability from CVE that doesn't have a corresponding Metasploit module, write a Metasploit module and put it up in Exploit Hub.
Since it's not a 0-day, there's nothing to be gained by getting an exclusive purchase so the prices will be reasonable. There's less risk of being sued too because it's not a 0-day; just a bit of code that you can use to test for an already disclosed vulnerability.
The "bad guys" probably won't want it. It's already known and getting patched and they'll have to rewrite it anyway because it will have an easily identifiable signature as it comes from Exploit Hub.
There will still be a market for 0-day exploits, but as the article mentions, it's a finicky market. Setting up a market for turning disclosed vulnerabilities into Metasploit modules is smart.
Sig matters not. Judge me by my sig, do you?
bloated and unstable exploits?