Slashdot Mirror
Business Is Booming In the 'Zero-Day' Game
HonorPoncaCityDotCom writes "Nicole Perlroth and David E. Sanger write in the NY Times that all over the world, from South Africa to South Korea, business is booming in zero days. The average attack persists for almost a year before it is detected, according to Symantec, the maker of antivirus software. Until then it can be exploited or 'weaponized' by both criminals and governments to spy on, steal from, or attack their targets. Ten years ago, hackers would hand knowledge of such flaws to Microsoft and Google free in exchange for a T-shirt, but increasingly the market for 0-day exploits has begun to migrate into the commercial space (PDF) as the market for information about computer vulnerabilities has turned into a gold rush. Companies like Vupen charge customers an annual $100,000 subscription fee to shop through its catalog, and then charges per sale to countries who want to use the flaws in pursuit of the kind of success that the United States and Israel achieved three summers ago when they attacked Iran's nuclear enrichment program with a computer worm that became known as 'Stuxnet.' Israel, Britain, Russia, India and Brazil are some of the biggest spenders but North Korea is also in the market, as are some Middle Eastern intelligence services."
....when do we start treating these folks like arms dealers? It's not a stretch, ITAR classified cryptography as munitions....
(* cyber 'war' is a ridiculous term for something we already have words for - espionage and sabotage, both of which have been achieved using only information, for centuries now).
Source
So all I have to do is register a corp called "Highly Trusted Security Vendor", subscribe, and profit?!
They would trade mutated virus strains (specially the successful ones) without worrying about an incoming pandemy.
Snakso-A
... shall I go on?
42
Arches
Alaeda - Virus.Linux.Alaeda
Bad Bunny - Perl.Badbunny
Binom - Linux/Binom
Brundle
Bukowski
Sometimes I think that using the Internet for anything other than publicly available static HTML (e.g. Wikipedia) is a mistake. Nice idea, but not every good idea works out well.
There is no disclosure to these vulns, disclosing them would remove the value in them. These orgs aren't paying big money for vulns to have them /fixed/ people...the exact opposite.
In a way this is proof that the existing approaches to computer security have gone completely bust. They're big business so there's money in keeping it that way, not so much in actually fixing anything. Besides, patching does not fundamentally improve the software. All it does is wipe away visible blemishes.
This fits well with the blind leading the blind approach to reporting about computer security, where everybody and his dog is a "hacker" even if he's really a rent-a-cop trying to defraud his employer by sticking a usb keylogger stick into some machines*.
There is nothing new going on here. Whether you're styling yourself a "white" or a "black" or even, superfluously, a "green" hat, you're no hacker. Green hats? Yes, they're in it for the money. Get it, green? Only both the white and the black hats are in it for the money too. Have been for a while. So that is a superfluous distinction.
Doesn't matter that there are laws against "hacking", as they are equally vague. I'd say needlessly, but that isn't quite the word for it. Laws need to be precise, and using vague terms like "hacking" in the popularly uninformed "anything potentially bad vaguely involving something computer-y somehow" meaning, implies that the law can be applied inconsistently, at the attorney general's whim. And random justice is not justice. The Aaron Schwarz case is a clear case of AG bullying by piling up the accusations. Now imagine that enshrined in law. It usually doesn't go too spectactularly wrong, but if the law was a car it'd be neither street legal nor safe to drive.
There's irony here. Originally "hacking" had strong connotations of doing new and interesting things. Things that had you go "I didn't know it could do that!?!" -- bonus points if the original creator of the thing made to do new things had that reaction. Thus the first buffer overflow, the first SQL injection, the first remote code injection and succesful execution were "hacks". But the nine thousanth? Not so much.
Yet what we're seeing here is a veritable industry with a thriving market on both sides of the legality fence. Plenty of people doing their often quite specialised thing and making money, somethimes quite a lot of money, out of it. That's not "hacking", and so nobody doing that is a "hacker". Worse, even the white hats are not meaningfully pushing the state of the art of computer security forward. It's all patching holes in the notional swiss cheese. No fundamental research, like research into model checking (which appears to be "strictly harder than NP", quite the intellectual challenge foregone), no nothing, Just churning, grinding, more of the same.
That this is a confused field is clear from the "ethical hacker" term. No, if you need a prefix you're no hacker. Hacking is not inherently unethical, or ethical. If you need a prefix (or a hat) to defend what you're doing, you're doing it wrong.
The black hats are doing us a disservice by exploiting us for their monetary gain. And the white hats? Likewise, plus they're not meaningfully contributing to research thwarting the black hats. Everyone is a green hat now. None are hackers.
Semantics are important, and the semantics of the IT security industry mean that it's a racket dressed up in fancy words it hasn't earned. It's a racket full of FUD, that you can see in most every press release and blog. And until we understand the semantics, until we stop using the wrong words, and start recognising what is really going on, we can't even begin fixing the problem because we can't see it, we can't talk about it, we can't identify just what is bugging us. Semantics are important, and so far we have been doing it wrong.
* Actual tech-rag reporting, indeed using the "hacker" moniker for describing exactly that.
Any AV is a waste of money and of CPU cycles, there are no viruses on GNU/Linux.
Then why does rkhunter exist?
"Once we've identified and embraced our sickness, we'll have strength...and that's when we get dangerous." - John Waters
But my 18th birthday rolled around, and I decided to clean up my ethics, and only program for legitimate purposes.
You turned down the job offer from the NSA?
If these developers are so good at consciously creating vulns, you'd think they'd be better at NOT creating them too, now wouldn't you? After all, software shouldn't require /hundreds/ of these backdoors, just a handful that were constructed carefully enough.. They certainly shouldn't be getting discovered by independent researchers without all these necessary criminal and Military Industrial connections you describe.
Reality does not support your hypothesis here I'm afraid, I think your tinfoil hat might have been backdoored...
Oh yes, please do continue cherry-picking from a Wikipedia article you clearly don't understand. Did you see the disclaimer immediately before that list?
[qoute]The following is a partial list of known Linux malware. However, few if any are in the wild, and most have been rendered obsolete by Linux updates or were never a threat.[/quote]
Yeah, the definition and implications of the term "virus" has evolved over the last couple of decades, but nothing you listed is actually an initial attack vector. At best, they're trojans. They all require a previously compromised system, generally by an admin installing shady packages to begin with. You might have looked a little smarter if you had listed some of the worms further down, but even those were patched over a DECADE ago.
Seriously, fuck off. There's no comparison.
certainly, if a government does it, it's not unlawful... and there's the rub. If interference and espionage with another nation's information systems are acts of aggression, will be ever see some updating of geneva/hague convention notions towards this? They both mention spies, but largely in the protection and treatment of them in habeus corpus situations... Do we even need such an updating? there is plenty of material on the legality of peacetime espionage, yet the sabotage issue remains murky as ever.
Welcome to the self-hatred that is working in the infosec business - any illusions we held about trying to improve the state of things for the greater good fell away many years ago when people started realizing that there was no profit in working towards making ourselves obsolete - casualties be damned. When it comes to computers, you're either responsible for your own OPSEC 24/7, or you accept that your systems will be interfered with in perpetuity. Nobody is looking out for you, least of all the infosec business.
Such ignorant posts like the grandparents truly scare me.
I would mod you higher if I had points.
I have seen Linux servers compromised and admins throwing a fit saying it is impossible because they run Linux! No such as a rootkit could possible exist. This was a major bank too.
http://saveie6.com/
"Linux is the least secure modern kernel out there. It offers no heap, stack, ASLR, or even DEP (It may offer this as of 3.0?)"
..
That's because only the Windows kernel really needs heap, stack, ASLR and DEP. Putting user-mode application in the kernel (to speed up graphical rendering) was the dumbest thing Microsoft ever did
AccountKiller
SSH over PPP.
Because I like transmitting and receiving at .56kbits/sec.
MS has not done this since Windows 98/ME. Even IE is in userspace and has been for a long time. The graphical drivers are in kernel space because you can not talk to a highspeed video device without it and expect good performance. Linux too has nvidia and framebuffer drives in the kernel as well. No different.
All modern kernels need the above if they are expected to be on the internet. I think the Android kernels include some of these in patches.
http://saveie6.com/
All the more reason to consider using new programming languages like Rust which are built with memory safety in mind. Better programming languages are by no means a silver bullet for security problems, but they help.
Android, it is linux by many standards, loads of incompetent users, loads of malware.
Or at least the sort of computer design that deliberately walked away from having security built into all levels.
With that said, the Web acquired some customs that are hostile to security: Routine execution of automatically retrieved code, coding pages as composites from many third party sites, and the ad industry's negligent attitude toward malware are a few.
Also, neither PC nor Web architecture attempted to make certificates and keys into palpable first-class entities that users could more easily understand and manipulate, so the potential for verification and privacy were not realized.
Right now, some of the best stopgaps against this miserable history are projects like Qubes, Tor and I2P. Qubes lets me handle each thing I do in separate hardware-and-GUI enforced domains. Tor enables privacy for web and is familiar to many people. I2P gives me more than web connectivity, and the expectation that sites I connect to won't need Javascript (hardly ever) and is more future-proof than Tor.
Windows shill. You may stop talking now.
Also, when can there be a physical response to a non-physical attack?
http://soylentnews.org/~tibman
geez, i updated this thing last year! how much maintenance does this thing need?!
http://soylentnews.org/~tibman
When legal hackers get prosecuted it's no wonder they flock to the black markets.
I only use one time pads, flown by camouflaged carrier pigeons. Might be slow, but it's secure dammit!
~S