Slashdot Mirror
Meet the Hackers Who Get Rich Selling Spies Zero-Day Exploits
Sparrowvsrevolution writes "Forbes profiles Vupen, a French security firm that openly sells secret software exploits to spies and government agencies. Its customers pay a $100,000 annual fee simply for the privilege of paying extra fees for the exploits that Vupen's hackers develop, which the company says can penetrate every major browser, as well as other targets like iOS, Android, Adobe Reader and Microsoft Word. Those individual fees often cost much more than that six-figure subscription, and Vupen sells them non-exclusively to play its customers off each other in an espionage arms race. The company's CEO, Chaouki Bekrar, says Vupen only sells to NATO governments and 'NATO partners' but he admits 'if you sell weapons to someone, there's no way to ensure that they won't sell to another agency.'"
The question is...how do "I" get into that??!?
Hacking stuff, and protected by 'NATO' government paying you handsomely for the 'service'.
sweet...
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Norton keeps me safe.
I think it will be interesting to see how the governments of the world start to evolve around this new threat.
Step 1. Paint giant bullseye on the top of your corporate office. Write "Insert bomb here," repeatedlty around the edge.
Step 2. Sell digital goods that can be used by sovereign powers to wage war on each other to both sides.
Step 3. ???
Step 4. Profi--Error: Connection reset by peer
#fuckbeta #iamslashdot #dicemustdie
Oh, they only sell to NATO, right? You know, you can TRY to lie to us, but in the end, lying to the CIA is the same as lying to yourself. They know you sell to Iran, China, and every other regime out there.
You're on a shady enough business not to sell to the best offer.
I mean, aren't there laws against doing things like hacking into computers you don't own? Isn't this aiding in a crime? The last time I checked, even government agencies were obliged not to break laws.
Ezekiel 23:20
Wow. That puts huge incentive on planting moles in projects with wide distribution simply for the aim of writing exploitable code.
"To give arms to all men who offer an honest price for them, without respect of persons or principles: to aristocrat and republican, to Nihilist and Tsar, to Capitalist and Socialist, to Protestant and Catholic, to burglar and policeman, to black man white man and yellow man, to all sorts and conditions, all nationalities, all faiths, all follies, all causes and all crimes." - Undershaft
I wonder if they ever go from providing exploits to "remote controlled product support".
Isn't this a violation of the DMCA?
And not just for their offices, but for their homes and the homes, schools and offices of their families, friends and anyone else they might care about.
It strikes me that these are people you don't want to try to play around with and that some might try to influence you to give a better deal to their side than another side, perhaps using things like pictures of your kids walking to school or your wife gardening.
"'if you sell weapons to someone, there's no way to ensure that they won't sell to another agency.'""
Or worse!
Zorg: I hate warriors, too narrow-minded. I'll tell you what I do like though: a killer, a dyed-in-the-wool killer. Cold blooded, clean, methodical and thorough. Now a real killer, when he picked up the ZF-1, would've immediately asked about the little red button on the bottom of the gun.
[Scene shifts to Aknot, who is staring in confusion at the little red button. He shrugs and pushes it]
Zorg: [Casually smokes a cigarette as the room with the Mangalores blows up] Bring me the priest.
the company says can penetrate every major browser, as well as other targets like iOS, Android, Adobe Reader and Microsoft Word.
NUUU not my slash!fic!! No touching my pr0n!
Oh wait, Microsoft Word required my first-born for payment, so I downloaded OpenOffice. Not on the list, MY PR0N IS SAFE.
You want to know how to help your kids? LEAVE THEM THE F*&K ALONE. --George Carlin
As long as the government agencies don't use them within their own territories against their own citizens then it's fine.
Perspective: Inside Cisco's eavesdropping apparatus
By Declan McCullagh | April 21, 2003 4:00 AM PDT
- http://news.cnet.com/2010-1071-997528.html?tag=fd_nc_1
"Cisco Systems has created a more efficient and targeted way for police and intelligence agencies to eavesdrop on people whose Internet service provider uses their company's routers.
The company recently published a proposal that describes how it plans to embed "lawful interception" capability into its products. Among the highlights: Eavesdropping "must be undetectable," and multiple police agencies conducting simultaneous wiretaps must not learn of one another. If an Internet provider uses encryption to preserve its customers' privacy and has access to the encryption keys, it must turn over the intercepted communications to police in a descrambled form.
Cisco's decision to begin offering "lawful interception" capability as an option to its customers could turn out to be either good or bad news for privacy.
Because Cisco's routers currently aren't designed to target an individual, it's easy for an Internet service provider (ISP) to comply with a police request today by turning over all the traffic that flows through a router or switch. Cisco's "lawful interception" capability thus might help limit the amount of data that gets scooped up in the process.
On the other hand, the argument that it hinders privacy goes like this: By making wiretapping more efficient, Cisco will permit governments in other countries--where court oversight of police eavesdropping is even more limited than in the United States--snoop on far more communications than they could have otherwise.
Marc Rotenberg, head of the Electronic Privacy Information Center, says: "I don't see why the technical community should hardwire surveillance standards and not also hardwire accountability standards like audit logs and public reporting. The laws that permit 'lawful interception' typically incorporate both components--the (interception) authority and the means of oversight--but the (Cisco) implementation seems to have only the surveillance component. That is no guarantee that the authority will be used in a 'lawful' manner."
U.S. history provides many examples of government and police agencies conducting illegal wiretaps. The FBI unlawfully spied on Eleanor Roosevelt, Martin Luther King Jr., feminists, gay rights leaders and Catholic priests. During its dark days, the bureau used secret files and hidden microphones to blackmail the Kennedy brothers, sway the Supreme Court and influence presidential elections. Cisco's Internet draft may be titled "lawful interception," but there's no guarantee that the capability will always be used legally.
Still, if you don't like Cisco's decision, remember that they're not the ones doing the snooping. Cisco is responding to its customers' requests, and if they don't, other hardware vendors will.
If you're looking for someone to blame, consider Attorney General John Ashcroft, who asked for and received sweeping surveillance powers in the USA Patriot Act, along with your elected representatives in Congress, who gave those powers to him with virtually no debate.
I talked with Fred Baker, a Cisco fellow and former chairman of the Internet Engineering Task Force (IETF), about his work on the "lawful interception" draft.
Q: Why did Cisco decide to build "lawful interception" into its products? What prompted this?
A: Cisco's customers, not just in United States but in many countries, are finding themselves served with subpoenas to mandate lawful intercept functionality. Cisco received requests from its customers for this capability.
When I found out about the project, I asked to be involved because I wanted to ensure that it was done in a manner that was as close to balanced as I could get. From an engineering perspective, the easiest thing is to give everything to law enforcement and let them sort it out. But I wanted to d
Might Vupen have been the ones that discovered the exploits used by Duqu & Stuxnet? If they were, then they might know who created Duqu & Stux.
I admit it's good enough for one security researcher, or maybe 1.5, but it's not rich.
If we are talking about millions of dollars then we are talking rich.
And not just for their offices, but for their homes and the homes, schools and offices of their families, friends and anyone else they might care about.
It strikes me that these are people you don't want to try to play around with and that some might try to influence you to give a better deal to their side than another side, perhaps using things like pictures of your kids walking to school or your wife gardening.
There is no easy way for hackers to make money. You'll have to sell to the spies or you don't make money at all because the spies are the ones with the money to pay for security researchers.
As far as them trying to influence for a better deal or exclusive deal this much is obvious.
When you're extorting, don't get greedy. At some point it's cheaper to just get rid of you than to pay you.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
This is true, but "report[ing] it to the appropriate military authority" will nearly always land the reporting person in deep doo doo. I know that from experience. A junior person's word against the CO and the system that is designed to protect the CO.
You make plenty of good points. You need to be modded up.
Check out this company: Siege Technologies (http://www.siegetechnologies.com/). I had never heard of them before and have no idea how big they are. But they openly advertise that they have a "Vulnerability Discovery Incentive Plan" in their benefit package (http://www.siegetechnologies.com/careers).
They claim to do work for private companies and the U.S. government. They advertise a "Five year contract awarded to provide DoD with training material on Offensive/Defensive Windows Kernel Security and Development" and are advertising for jobs looking for Reverse Engineers.
Sounds like a good reason for the existence of Napalm to me. I wonder how their browser exploits would work against that?
I'm the COO of Netragard, one of the companies mentioned in this article. I recommend reading http://pentest.netragard.com/netragards-eap/, and if there's interest, I'd be happy to go into as much detail as I can about how EAP functions, and what to expect from the program.
Nonsense. Steve Ballmer had unilaterally decided that the .Net languages are far too safe (gotta give the Security Services division something to do / the increased revenue should help prop up that stock price...), and has decided that mandating C++ development is the way to go.
I am John Hurt.
Figures, they're surrendering before it even becomes an issue.
Vote monkeys into Congress. They are cheaper and more trustworthy.
Thanks for pointing that out. We recently removed the snosoft.com domain from service, and there's still some stale links that we're purging out.