Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Dark Web Market Is Selling Zero-Day Exploits

Posted by samzenpus on from the finest-crime dept.

Sparrowvsrevolution writes Over the last month, a marketplace calling itself TheRealDeal Market has emerged on the dark web, with a focus on sales of hackers' zero-day attack methods. Like the Silk Road and its online black market successors like Agora and the recently defunct Evolution, TheRealDeal runs as a Tor hidden service and uses bitcoin to hide the identities of its buyers, sellers, and administrators. But while some other sites have sold only basic, low-level hacking tools and stolen financial details, TheRealDeal's creators say they're looking to broker premium hacker data like zero-days, source code, and hacking services, often offered on an exclusive, one-time sale basis.

Currently an iCloud exploit is being offered for sale on the site with a price tag of $17,000 in bitcoin, claiming to be a new method of hacking Apple iCloud accounts. "Any account can be accessed with a malicious request from a proxy account," reads the description. "Please arrange a demonstration using my service listing to hack an account of your choice." Others include a technique to hack WordPress' multisite configuration, an exploit against Android's Webview stock browser, and an Internet Explorer attack that claims to work on Windows XP, Windows Vista and Windows 7, available for around $8,000 in bitcoin. None of these zero days have yet been proven to be real, but an escrow system on the site using bitcoin's multisignature transaction feature is designed to prevent scammers from selling fake exploits.

30 comments

  1. first by bigger · · Score: 2

    This sounds like a honeypot to me..

    1. Re:first by monkeyzoo · · Score: 3, Insightful

      Perhaps the vendors themselves should buy the exploits. Perhaps, it's not that different than a bounty program except for the fact that market pricing would determine the value of a vulnerability (and the lack of nobility in the mercernary nature of the process).

    2. Re:first by Anonymous Coward · · Score: 1

      Really! 'Dark Web'... Hollywood invades the Internet! It's not like I'm sexist or anything, but how come guys have to keep proving how dumb they are? Broken Beer Bottles here too...

    3. Re:first by jeffmeden · · Score: 2

      This sounds like a honeypot to me..

      Especially when selling 0-days isn't actually illegal in most circumstances, only rather shady. Researchers do deals all the time. Total anonymity on one or both sides doesn't really help anyone. Hell, it's so commonplace they have discussed it on NPR: http://www.npr.org/blogs/money...

      If anything this is just a new way to scam people out of money or to ferret out security researchers for further recruitment/waterboarding by the CIA.

    4. Re: first by Anonymous Coward · · Score: 0

      This seems reasonable at the first glance, but this shouldn't be made a law. Youll realize fast that its only a continuation of the "don't put your cat into the microwave" principle. Yes, the prices scale with adoption of the software, but revenue doesnt have to scale with adoption. Open source software is the most extreme example.

      It would be a good start though to require companies by law to react to reports of exploits, and to give at least a small reward in return.

      It will generate a true market for exploits, which is very good, as companies which have a great focus in security of their software, can buy those exploits, and dry the market.

    5. Re:first by Anonymous Coward · · Score: 0

      "Please arrange a demonstration using my service listing to hack an account of your choice."

      They could at least ask for a demo and monitor that account. Maybe they could figure out what the hacker is doing.

    6. Re:first by Anonymous Coward · · Score: 0

      In related news, 'They have Internet on computers now'

    7. Re:first by Anonymous Coward · · Score: 0

      "but how come guys have to keep proving how dumb they are?"

      I might just be dense, but I legitimately am missing what you are referring to. Please explain.

    8. Re:first by Anonymous Coward · · Score: 0

      I am referring to the dumbasses out there who think their little 'dark net' is hiding them from anybody. Poor little fools they are.

  2. Who cares by Anonymous Coward · · Score: 0

    The NSA already has all of the exploits. I fear them a lot more than some random hacker in China or Romania who's willing to buy one from this site.

    Also, WordPress doesn't have vulnerabilities, WordPress *is* a vulnerability. It will not touch any servers I'm responsible for.

    1. Re:Who cares by jythie · · Score: 4, Insightful

      The danger the NSA presents is largely symbolic and philosophical.

      The danger presented by script kitties and hackers is much more likely to actually effect your life and property.

    2. Re:Who cares by Anonymous Coward · · Score: 1

      script kitties

      I'm in ur boxen h4xxin ur scripts.

          |\_/|
          `o.o'
          =(_)=
            U

    3. Re:Who cares by slashmydots · · Score: 2

      Or it might even AFFECT it as well.

    4. Re:Who cares by Gravis+Zero · · Score: 1

      The danger the NSA presents is largely symbolic and philosophical.

      this is not quite true. the NSA is a HUGE threat while they are currently focused on hacking/spying on Pakistan, they have undermined many technologies that leave everyone vulnerable.

      --
      Anons need not reply. Questions end with a question mark.
    5. Re:Who cares by jythie · · Score: 1

      That is a good point, though even within that, the threat passes right through hackers again.

    6. Re: Who cares by Anonymous Coward · · Score: 0

      You mean in mine, as I'm reading this, or in GP's one?

    7. Re:Who cares by Gravis+Zero · · Score: 1

      even within that, the threat passes right through hackers again.

      when someone shoves you into a pit of snakes, are you angry at the snake that bites you?

      --
      Anons need not reply. Questions end with a question mark.
    8. Re:Who cares by Anonymous Coward · · Score: 0

      You really do not understand how the movement functions, do you?

    9. Re: Who cares by Anonymous Coward · · Score: 0

      apparently in one's with mod points

    10. Re:Who cares by Anonymous Coward · · Score: 0

      The NSA will likely be a major buyer on this market.

  3. First thoughts... by Anonymous Coward · · Score: 2, Interesting

    At first I realized even on the darknet, and for exploits, Apple commands a price premium. Hopefully the exploit is well polished and deserves this premium. Second, the site uses a multiple signature escrow system to assure an exploit is real. The presumption being the site is real and is not itself a means to pirate Bitcoin by them being put in escrow.

    1. Re:First thoughts... by Anonymous Coward · · Score: 0

      At first I realized even on the darknet, and for exploits, Apple commands a price premium. Hopefully the exploit is well polished and deserves this premium.

      I highly doubt it has to do with the quality of the exploit as much as it has to do with the intended target. There are a LOT of high-profile users in iCloud, as recent hacks have shown us. This is where the real value comes in.

      Second, the site uses a multiple signature escrow system to assure an exploit is real. The presumption being the site is real and is not itself a means to pirate Bitcoin by them being put in escrow.

      Yes, it's kind of a bitch when the pirates ask the thieves for trust.

    2. Re:First thoughts... by penguinoid · · Score: 1

      Second, the site uses a multiple signature escrow system to assure an exploit is real. The presumption being the site is real and is not itself a means to pirate Bitcoin by them being put in escrow.

      Any idea how that works? The only way I know of to produce partial keys has one person entirely in charge, which wouldn't work for an untrusted escrow service.

      And unlike most Dark Web markets, it allows only so-called multisignature transactions. That means the bitcoins are held at an address jointly controlled by the buyer, the seller, and the market’s admins. For the money to be moved to the seller’s account, two out of three of those parties must sign off on the deal, giving the administrators the tie-breaking vote to resolve disputes.

      --
      Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
    3. Re:First thoughts... by codebonobo · · Score: 1

      Any idea how that works? The only way I know of to produce partial keys has one person entirely in charge, which wouldn't work for an untrusted escrow service.

      Bitcoin allows for escrow and arbitration where you can select any arbitrator both parties trust and agree to and thus eliminates counterparty risk. The keys are split with either multi-sig or shamir's secret sharing.. here is one example amongst many:

      https://www.bitrated.com/

  4. its funny how people think and ask why my website. by Anonymous Coward · · Score: 0

    is down

    before0day.com

    is it really? i2p hmmmmm =]

  5. make Zero Day a National Holiday by turkeydance · · Score: 1

    you can celebrate any day all day.

  6. This action is played out by Anonymous Coward · · Score: 0

    All the researchers worth a damn already have the big customer's phone numbers in their cell phones.

  7. dem haxxorz havenin a sael by Anonymous Coward · · Score: 0

    many haxx
    such pricez
    w0w

  8. This is News? by Anonymous Coward · · Score: 0

    I am pretty sure there have been sales of tools of all flavors on the "dark net" for some years. The fact that this has come to light just now is shocking. Botnets have been for sale for some time. Exploration Tools have been for sale for some time. Why not 0 Day exploits?

    DRTFA, but then again, the way the subby pitched this, I don't care to. If your are going to tell me something new, put it in the description. If you are going to tell me something that has already known, don't bother telling me. I know the New York Times might not be aware of this, but this is SlashDot. We are not talking about people completely in the dark. Just don't go publish this in some political rag because we don't need Obama firing another half cocked executive order.