Slashdot Mirror

← Back to Stories (view on slashdot.org)

Windows Zero-Day Affecting All OS Versions On Sale For $90,000 (softpedia.com)

Posted by BeauHD on from the going-once-going-twice-sold dept.

An anonymous reader writes: "A hacker going by the handle BuggiCorp is selling a zero-day vulnerability affecting all Windows OS versions that can allow an attacker to elevate privileges for software processes to the highest level available in Windows, known as SYSTEM," writes Softpedia. The zero-day is up for sale on a Russian underground hacking forum, and is currently available for $90,000 -- after it was initially up for $95,000. The hacker is saying he'll sell the zero-day to one person only, who'll receive its source code and a working demo. Two videos are available, one showing the hacker exploit Windows 10 with the May 2016 security patch, and another one bypassing all EMET features. While security experts think the zero-day may be overpriced, they think the hacker will find a buyer regardless.

5 of 187 comments (clear)

  1. Not overpriced at $90K by xxxJonBoyxxx · · Score: 5, Interesting

    >> While security experts think the ($90K) zero-day may be overpriced

    As a security expert and occasional entrepreneur, let me tell you why this isn't overpriced. Let's say you could deliver 10,000 phishing emails that lead to installation of $70/unlock ransomware screens, of which 50% of victims usually pay. That's $350K of revenue, minus costs of the initial phishing campaign ($5K-ish), bitcoin exchange fees (maybe $10K) and the $90K for your zero day. That leaves a profit of about $250K - not bad for a few days of work.

  2. priv esc by Robert+Goatse · · Score: 3, Interesting

    So it's a privilege escalator not necessarily an exploit to initially get into a host. For a 'real' Windows exploit, 90K is super-duper cheap, but for something like this 90K may be a tad overpriced for what you get.

  3. Re:It is worth what somebody will pay for it by Anonymous Coward · · Score: 0, Interesting

    Windows. The cheapest, best option. If your time is worthless.

    I used to say this about Linux, but it's become better than Windows.

  4. Re:It is worth what somebody will pay for it by geekmux · · Score: 2, Interesting

    > While security experts think the zero-day may be overpriced, they think the hacker will find a buyer regardless.

    If they think there is a buyer who will pay $90,000 for it, then it is per definition not overpriced.

    And if Microsoft themselves do not attempt to buy it, then they've shown how much they value their own product. Or the customer base. Or security in general.

    Of course, we knew the latter already...

  5. Re:It is worth what somebody will pay for it by Dr_Barnowl · · Score: 4, Interesting

    Learning Linux is like learning to drive a stick shift.

    A few more skills, in exchange for more efficiency and better performance.