Meet the Hackers Who Get Rich Selling Spies Zero-Day Exploits

← Back to Stories (view on slashdot.org)

Meet the Hackers Who Get Rich Selling Spies Zero-Day Exploits

Posted by samzenpus on Wednesday March 21, 2012 @08:00AM from the selling-to-the-man dept.

Sparrowvsrevolution writes "Forbes profiles Vupen, a French security firm that openly sells secret software exploits to spies and government agencies. Its customers pay a $100,000 annual fee simply for the privilege of paying extra fees for the exploits that Vupen's hackers develop, which the company says can penetrate every major browser, as well as other targets like iOS, Android, Adobe Reader and Microsoft Word. Those individual fees often cost much more than that six-figure subscription, and Vupen sells them non-exclusively to play its customers off each other in an espionage arms race. The company's CEO, Chaouki Bekrar, says Vupen only sells to NATO governments and 'NATO partners' but he admits 'if you sell weapons to someone, there's no way to ensure that they won't sell to another agency.'"

39 of 158 comments (clear)

Min score:

Reason:

Sort:

Damn... by cayenne8 · 2012-03-21 08:03 · Score: 5, Funny

That's serious money...
The question is...how do "I" get into that??!?
:)
Hacking stuff, and protected by 'NATO' government paying you handsomely for the 'service'.
sweet...

--
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
1. Re:Damn... by lennier · 2012-03-21 08:23 · Score: 4, Insightful
  
  The question is...how do "I" get into that??!?
  1. Write any sufficiently large piece of C++ code
  2. Wait
  3. Get rooted by the black hats
  4. Find out which trivially-detectable-if-you'd-used-a-decent-language error the black hats found in your code and sell it to NATO
  5. Profit!
  
  --
  You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
2. Re:Damn... by Anonymous Coward · 2012-03-21 08:28 · Score: 3, Insightful
  
  Because we all know that programs written in interpreted languages never have bugs nor do their VMs or interpreters.
3. Re:Damn... by morcego · 2012-03-21 09:08 · Score: 3, Insightful
  
  What's next ? My dog ate my boundary checking ?
  Seriously, blaming the language for the coding bug is one of the lamest things I've ever heard. Bugs (exploitable or not) will be found on any sufficiently large piece of code, written in any language. Heck, there were 1 or 2 cases of bugs introduced by the compiler.
  The real problem is that companies need to get the software out "fast". It is cheaper for the company to fix the code after it is released and payed for, and to keep developing out of it own pockets. It is that simple.
  
  --
  morcego
4. Re:Damn... by Anonymous Coward · 2012-03-21 16:14 · Score: 3, Informative
  
  Ugh.
  securityfocus.com
  select vendor microsoft
  framework .net
  whatever version you use
  there's about a dozen vulnerabilities in version 4.0 alone, including this one overrunning an array
  http://www.securityfocus.com/bid/48212/discuss
  Shithead fanboy. Understand the tools you use. Marketing theory is not implementation reality.
  Yes, they've been found. Yes, they're open. And your question reveals absolutely horrific ignorance and shows that you've drank the kool-aid instead of doing some research.
  Next time you choose a platform, ask yourself what the possible vulnerabilities are, and then do a google search for them. Had you done this, you'd realize that Java is one of the exploit platforms of choice, second only to flash -- and has been for years.
5. Re:Damn... by lightknight · 2012-03-21 16:57 · Score: 2
  
  True, but it's harder to cut yourself with a pair of safety scissors than it is a machete.
  
  --
  I am John Hurt.
6. Re:Damn... by lightknight · 2012-03-21 16:58 · Score: 2
  
  There is only one way to know whether or not what you are saying is the truth: Did it involve a god function and a lot of gotos?
  
  --
  I am John Hurt.
I'm not scared... by asdbffg · 2012-03-21 08:05 · Score: 5, Funny

Norton keeps me safe.
So basically... by girlintraining · 2012-03-21 08:06 · Score: 5, Funny

Step 1. Paint giant bullseye on the top of your corporate office. Write "Insert bomb here," repeatedlty around the edge.
Step 2. Sell digital goods that can be used by sovereign powers to wage war on each other to both sides.
Step 3. ???
Step 4. Profi--Error: Connection reset by peer

--
#fuckbeta #iamslashdot #dicemustdie
Thieves among thieves by hjf · 2012-03-21 08:07 · Score: 5, Insightful

Oh, they only sell to NATO, right? You know, you can TRY to lie to us, but in the end, lying to the CIA is the same as lying to yourself. They know you sell to Iran, China, and every other regime out there.
You're on a shady enough business not to sell to the best offer.
1. Re:Thieves among thieves by Anonymous Coward · 2012-03-21 08:20 · Score: 2, Insightful
  
  Even if they do only sell to NATO, NATO governments haven't exactly had a stellar history of respecting human rights in the past decade.
2. Re:Thieves among thieves by elucido · 2012-03-21 09:22 · Score: 2
  
  Even if they do only sell to NATO, NATO governments haven't exactly had a stellar history of respecting human rights in the past decade.
  What government respects human rights?
  If they don't sell their exploit to NATO who should they sell them to? The FBI?
3. Re:Thieves among thieves by Wrath0fb0b · 2012-03-21 12:19 · Score: 2
  
  Even if they do only sell to NATO, NATO governments haven't exactly had a stellar history of respecting human rights in the past decade.
  Compared to who? I'm pretty sure NATO collectively ranks at the very top of human rights respect on this planet.
4. Re:Thieves among thieves by L4t3r4lu5 · 2012-03-21 21:02 · Score: 3, Insightful
  
  Compared to who? I'm pretty sure NATO collectively ranks at the very top of human rights respect on this planet.
  Well put. Furthermore, Harold Shipman is my choice of Serial Killer of the Year, as he only ended the lives of the elderly and infirm, and in a humane fashion.
  
  --
  Finally had enough. Come see us over at https://soylentnews.org/
Kind of shady? by K.+S.+Kyosuke · 2012-03-21 08:07 · Score: 5, Insightful

I mean, aren't there laws against doing things like hacking into computers you don't own? Isn't this aiding in a crime? The last time I checked, even government agencies were obliged not to break laws.

--
Ezekiel 23:20
1. Re:Kind of shady? by Desler · 2012-03-21 08:11 · Score: 5, Funny
  
  Your post is so cute. You actually think they care.
2. Re:Kind of shady? by Iniamyen · 2012-03-21 08:16 · Score: 2
  
  The laws only apply if you are hacking into computers you don't own in order to download The Hurt Locker.
3. Re:Kind of shady? by PPH · 2012-03-21 08:20 · Score: 4, Insightful
  
  even government agencies were obliged not to break laws.
  Unless we're at war.
  We're always at war.
  
  --
  Have gnu, will travel.
4. Re:Kind of shady? by Real_Reddox · 2012-03-21 08:22 · Score: 5, Insightful
  
  if a soldier hears his superior yell "fire", he shoots, no questions asked.
  
  As a soldier, I can only note your lack of insight in how the military works.
  
  --
  I spent five minutes stealing cool sigs and all I got was this.
5. Re:Kind of shady? by Sir_Sri · 2012-03-21 08:37 · Score: 3, Informative
  
  Espionage agencies are lawfully chartered. The activities they undertake in other countries are usually illegal in those countries, but so what, you do it to us, we do it to you, when you catch one of ours, we catch one of yours, trade, and back to business.
  In the case of the french bombing a ship in new zealand that was illegal, even though New Zealand would be a "NATO Partner" in the parlance of TFA. Two of the agents were caught, and charged.
  Of course had they got back to france (like the rest of the team) likely nothing would have happened to them, although with a more valuable ally like the UK that may not hold true. Countries act in their own interests, and if they're smart they are under no illusion about having any friends.
  The reason people still remember the rainbow warrior incident is because it was a major scandal in france, and might not even have been legal in france. Depends on the agreements they had with New Zealand.
6. Re:Kind of shady? by meerling · 2012-03-21 08:40 · Score: 4, Informative
  
  The military has very strict rules, and you are only required to follow lawful orders. In fact, if you are given an unlawful order, you are, by military law, required to refuse to follow it and report it to the appropriate military authority. Nobody is protected by "I was just following orders" for performing an unlawful action.
  At least with regards to the US Military. I don't know about other countries.
7. Re:Kind of shady? by HungryMonkey · 2012-03-21 09:47 · Score: 2
  
  I mean, aren't there laws against doing things like hacking into computers you don't own? Isn't this aiding in a crime? The last time I checked, even government agencies were obliged not to break laws.
  You've got it all wrong. I'm sure they hack into their own computers, nothing illegal there. Then they sell the knowledge of these exploits to their customers in order to protect them from these weaknesses. Now, if someone in one of those agencies "goes against policy" and uses these exploits against someone else, how is it their fault?
8. Re:Kind of shady? by Opportunist · 2012-03-21 10:20 · Score: 3, Insightful
  
  If you go by logic, committing the war crime is the logical conclusion.
  Imagine you're ordered to shoot civilians, or having the option to get shot by your superior. What are your options?
  1. Refusing. You're dead.
  2. Shooting your superior. Chances for a trial: Almost certain. Chances for a conviction: Rather high.
  3. Shooting the civilian. Chances for a trial: Almost zero, as long as every witness is an accomplice. Chances for conviction: Close to zero unless a reporter somehow finds out about it.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
9. Re:Kind of shady? by tnk1 · 2012-03-21 10:43 · Score: 4, Informative
  
  Summary executions by officers for anything are of extremely doubtful legality today, at least in the US. If an officer simply executed you for some cause and expected that to hold, he would face a guaranteed court-martial. If he tried to pretend that he merely apprehended you and you "escaped", there would still be an investigation at the very least. Unless the whole unit was on the side of the officer, it is unlikely that an officer would get away with it.
  As far as "friendly fire" incidents... those are always possible, but the shooter could still get found out.
  In short, if you turned the officer in for an offense that they might get execution, or life, or 20 years for, you may want to watch your back. Otherwise, no one is going to shoot you unless they are also unbalanced. In which case, you're pretty fucked anyway.
  That said, while it is actually required to refuse an unlawful order, you will still likely have to prove that at court-martial. So, you might well simply obey the officer ordering you to do something technically illegal, but petty. But, if he wants you to start shooting people, I'd suggest taking the court-martial.
10. Re:Kind of shady? by mapkinase · 2012-03-21 21:18 · Score: 2
  
  No, he'd rather post thought-out analysis of legal and possibly ethical implications of said company's business.that happens to take the snarky cynical form that you so wittily grasped
  
  --
  I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
Exploit to exploit by WinstonWolfIT · 2012-03-21 08:10 · Score: 5, Insightful

Wow. That puts huge incentive on planting moles in projects with wide distribution simply for the aim of writing exploitable code.
1. Re:Exploit to exploit by ihatewinXP · 2012-03-22 04:28 · Score: 2
  
  That is what I have been wondering.
  How many open source projects / commercial products are compromised by 3 letter agency insiders? Yeah we can 'look at the source' for some software but I have no pretenses on most anyone being able to find a backdoor left in by the best of the best that MIT / NSA etc have to offer. And with an unlimited budget to boot...
  I know if I was in charge id just make sure to get my code into Flash installers, Webkit, MS Office, and a few of the most popular linux packages and call it a day. I mean, what computer worth looking at isnt going to have an office suite, a browser, or flash?
  By the looks of Stuxtnet apparently routers are also a good thing to throw backdoors into as well....
  
  --
  ---- The real Slashdot is still here. You just have to browse at -1 to read the comments.
The true faith of an armorer by Animats · 2012-03-21 08:10 · Score: 4, Insightful

"To give arms to all men who offer an honest price for them, without respect of persons or principles: to aristocrat and republican, to Nihilist and Tsar, to Capitalist and Socialist, to Protestant and Catholic, to burglar and policeman, to black man white man and yellow man, to all sorts and conditions, all nationalities, all faiths, all follies, all causes and all crimes." - Undershaft
1. Re:The true faith of an armorer by forand · 2012-03-21 09:14 · Score: 3, Informative
  
  Anyone wondering where this is from it is from the play Major Barbara by George Bernard Shaw. You can find the full script on Gutenberg.
I hope their physical security is top notch by swb · 2012-03-21 08:22 · Score: 2, Insightful

And not just for their offices, but for their homes and the homes, schools and offices of their families, friends and anyone else they might care about.
It strikes me that these are people you don't want to try to play around with and that some might try to influence you to give a better deal to their side than another side, perhaps using things like pictures of your kids walking to school or your wife gardening.
1. Re:I hope their physical security is top notch by elucido · 2012-03-21 09:37 · Score: 2
  
  Why is this modded redundant? I am in ITSec yet am valued more for my knowledge about physical security and it's deep implications. Go ahead go take a look at a light primer: Locks, Safes, and Security by Marc Weber Tobias; then come back and say it is redundant.
  But if you know about physical security then you know in most workplaces it barely exists. You've got to secure the entire electromagnetic spectrum, worry about biological attacks, chemical attacks, psychological, and social engineering attacks on top of the technical exploits, lock picking, etc.
  These individuals in this company wouldn't be in the business they are in if they didn't have physical security of some sort. They have as little physical security as everyone else has, but perhaps they are aware of the fact that they aren't completely safe.
  But you're right, if they aren't locked down like a fort someone will still their exploits and then sell them to their clients.
Re:violation of the DMCA? by cjonslashdot · 2012-03-21 08:43 · Score: 2

Still, if the US can extradite Vladimir Zdorovenin and Gary McKinnon (let alone, Julian Assange) for their purported violation of US laws while outside the US, then the US should be able to extradite the execs of this company. Right?
Just a reminder by Opportunist · 2012-03-21 09:11 · Score: 3, Insightful

When you're extorting, don't get greedy. At some point it's cheaper to just get rid of you than to pay you.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
1. Re:Just a reminder by elucido · 2012-03-21 09:28 · Score: 2
  
  When you're extorting, don't get greedy. At some point it's cheaper to just get rid of you than to pay you.
  So who is going to do the getting rid of? Google?
  Also it's not extortion. Bug testing is Googles job not ours. Finally you have all these agencies that want to buy exploits so it's more like weapons trading but thats basically what the defense industry does anyway. I don't see how this would be extortion but selling missiles to a NATO country isn't?
Re:$100,000 is not rich. by Khashishi · 2012-03-21 09:17 · Score: 3, Informative

That's just the membership fee. How much is the actual product?
you are only required to follow lawful orders by rabenja · 2012-03-21 09:19 · Score: 4, Insightful

This is true, but "report[ing] it to the appropriate military authority" will nearly always land the reporting person in deep doo doo. I know that from experience. A junior person's word against the CO and the system that is designed to protect the CO.
1. Re:you are only required to follow lawful orders by El+Torico · 2012-03-22 02:01 · Score: 2
  
  Courage comes in many forms, as does cowardice. It sounds as though you did the right thing and got burned by it. Nonetheless, you did what you thought was right, so I commend you for it (whatever that's worth).
  
  --
  In the land of the blind, the one-eyed man is usually crucified.
Re:But my orgies! by colinrichardday · 2012-03-21 09:23 · Score: 2

You have porn on Microsoft Word? Wouldn't LaTeX be safer? Just don't use a petroleum-based editor.
There are companies in the U.S. doing this! by Anonymous Coward · 2012-03-21 10:14 · Score: 3, Informative

Check out this company: Siege Technologies (http://www.siegetechnologies.com/). I had never heard of them before and have no idea how big they are. But they openly advertise that they have a "Vulnerability Discovery Incentive Plan" in their benefit package (http://www.siegetechnologies.com/careers).
They claim to do work for private companies and the U.S. government. They advertise a "Five year contract awarded to provide DoD with training material on Offensive/Defensive Windows Kernel Security and Development" and are advertising for jobs looking for Reverse Engineers.