Meet the Hackers Who Get Rich Selling Spies Zero-Day Exploits

← Back to Stories (view on slashdot.org)

Meet the Hackers Who Get Rich Selling Spies Zero-Day Exploits

Posted by samzenpus on Wednesday March 21, 2012 @08:00AM from the selling-to-the-man dept.

Sparrowvsrevolution writes "Forbes profiles Vupen, a French security firm that openly sells secret software exploits to spies and government agencies. Its customers pay a $100,000 annual fee simply for the privilege of paying extra fees for the exploits that Vupen's hackers develop, which the company says can penetrate every major browser, as well as other targets like iOS, Android, Adobe Reader and Microsoft Word. Those individual fees often cost much more than that six-figure subscription, and Vupen sells them non-exclusively to play its customers off each other in an espionage arms race. The company's CEO, Chaouki Bekrar, says Vupen only sells to NATO governments and 'NATO partners' but he admits 'if you sell weapons to someone, there's no way to ensure that they won't sell to another agency.'"

13 of 158 comments (clear)

Min score:

Reason:

Sort:

Thieves among thieves by hjf · 2012-03-21 08:07 · Score: 5, Insightful

Oh, they only sell to NATO, right? You know, you can TRY to lie to us, but in the end, lying to the CIA is the same as lying to yourself. They know you sell to Iran, China, and every other regime out there.
You're on a shady enough business not to sell to the best offer.
1. Re:Thieves among thieves by L4t3r4lu5 · 2012-03-21 21:02 · Score: 3, Insightful
  
  Compared to who? I'm pretty sure NATO collectively ranks at the very top of human rights respect on this planet.
  Well put. Furthermore, Harold Shipman is my choice of Serial Killer of the Year, as he only ended the lives of the elderly and infirm, and in a humane fashion.
  
  --
  Finally had enough. Come see us over at https://soylentnews.org/
Kind of shady? by K.+S.+Kyosuke · 2012-03-21 08:07 · Score: 5, Insightful

I mean, aren't there laws against doing things like hacking into computers you don't own? Isn't this aiding in a crime? The last time I checked, even government agencies were obliged not to break laws.

--
Ezekiel 23:20
1. Re:Kind of shady? by PPH · 2012-03-21 08:20 · Score: 4, Insightful
  
  even government agencies were obliged not to break laws.
  Unless we're at war.
  We're always at war.
  
  --
  Have gnu, will travel.
2. Re:Kind of shady? by Real_Reddox · 2012-03-21 08:22 · Score: 5, Insightful
  
  if a soldier hears his superior yell "fire", he shoots, no questions asked.
  
  As a soldier, I can only note your lack of insight in how the military works.
  
  --
  I spent five minutes stealing cool sigs and all I got was this.
3. Re:Kind of shady? by Opportunist · 2012-03-21 10:20 · Score: 3, Insightful
  
  If you go by logic, committing the war crime is the logical conclusion.
  Imagine you're ordered to shoot civilians, or having the option to get shot by your superior. What are your options?
  1. Refusing. You're dead.
  2. Shooting your superior. Chances for a trial: Almost certain. Chances for a conviction: Rather high.
  3. Shooting the civilian. Chances for a trial: Almost zero, as long as every witness is an accomplice. Chances for conviction: Close to zero unless a reporter somehow finds out about it.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Exploit to exploit by WinstonWolfIT · 2012-03-21 08:10 · Score: 5, Insightful

Wow. That puts huge incentive on planting moles in projects with wide distribution simply for the aim of writing exploitable code.
The true faith of an armorer by Animats · 2012-03-21 08:10 · Score: 4, Insightful

"To give arms to all men who offer an honest price for them, without respect of persons or principles: to aristocrat and republican, to Nihilist and Tsar, to Capitalist and Socialist, to Protestant and Catholic, to burglar and policeman, to black man white man and yellow man, to all sorts and conditions, all nationalities, all faiths, all follies, all causes and all crimes." - Undershaft
Re:Damn... by lennier · 2012-03-21 08:23 · Score: 4, Insightful

The question is...how do "I" get into that??!?
1. Write any sufficiently large piece of C++ code
2. Wait
3. Get rooted by the black hats
4. Find out which trivially-detectable-if-you'd-used-a-decent-language error the black hats found in your code and sell it to NATO
5. Profit!

--
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
Re:Damn... by Anonymous Coward · 2012-03-21 08:28 · Score: 3, Insightful

Because we all know that programs written in interpreted languages never have bugs nor do their VMs or interpreters.
Re:Damn... by morcego · 2012-03-21 09:08 · Score: 3, Insightful

What's next ? My dog ate my boundary checking ?
Seriously, blaming the language for the coding bug is one of the lamest things I've ever heard. Bugs (exploitable or not) will be found on any sufficiently large piece of code, written in any language. Heck, there were 1 or 2 cases of bugs introduced by the compiler.
The real problem is that companies need to get the software out "fast". It is cheaper for the company to fix the code after it is released and payed for, and to keep developing out of it own pockets. It is that simple.

--
morcego
Just a reminder by Opportunist · 2012-03-21 09:11 · Score: 3, Insightful

When you're extorting, don't get greedy. At some point it's cheaper to just get rid of you than to pay you.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
you are only required to follow lawful orders by rabenja · 2012-03-21 09:19 · Score: 4, Insightful

This is true, but "report[ing] it to the appropriate military authority" will nearly always land the reporting person in deep doo doo. I know that from experience. A junior person's word against the CO and the system that is designed to protect the CO.