Windows Zero-Day Affecting All OS Versions On Sale For $90,000 (softpedia.com)

← Back to Stories (view on slashdot.org)

Windows Zero-Day Affecting All OS Versions On Sale For $90,000 (softpedia.com)

Posted by BeauHD on Wednesday June 1, 2016 @01:00AM from the going-once-going-twice-sold dept.

An anonymous reader writes: "A hacker going by the handle BuggiCorp is selling a zero-day vulnerability affecting all Windows OS versions that can allow an attacker to elevate privileges for software processes to the highest level available in Windows, known as SYSTEM," writes Softpedia. The zero-day is up for sale on a Russian underground hacking forum, and is currently available for $90,000 -- after it was initially up for $95,000. The hacker is saying he'll sell the zero-day to one person only, who'll receive its source code and a working demo. Two videos are available, one showing the hacker exploit Windows 10 with the May 2016 security patch, and another one bypassing all EMET features. While security experts think the zero-day may be overpriced, they think the hacker will find a buyer regardless.

114 of 187 comments (clear)

Min score:

Reason:

Sort:

Its not over priced by Anonymous Coward · 2016-06-01 01:05 · Score: 3, Insightful

if some one will pay it.
1. Re:Its not over priced by Junta · 2016-06-01 01:50 · Score: 1
  
  But the person said they are going to sell to *one* person. They don't want to sell to multiple people.
  
  --
  XML is like violence. If it doesn't solve the problem, use more.
2. Re:Its not over priced by NatasRevol · 2016-06-01 01:51 · Score: 2
  
  He only wants one customer, so I'd say it doesn't matter.
  
  --
  There are two types of people in the world: Those who crave closure
3. Re:Its not over priced by 110010001000 · 2016-06-01 02:39 · Score: 3, Funny
  
  I totally trust the guy when he says he only will sell it to one customer. Why would he want to sell it to many customers? To get more money? Never!
4. Re:Its not over priced by Opportunist · 2016-06-01 02:55 · Score: 5, Insightful
  
  Isn't it heartwarming how quickly those Commies embraced Capitalism?
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
5. Re:Its not over priced by JustAnotherOldGuy · 2016-06-01 02:59 · Score: 4, Insightful
  
  I totally trust the guy when he says he only will sell it to one customer. Why would he want to sell it to many customers? To get more money? Never!
  Exactly. Russian hackers are known for their unfailing honesty and fair dealings in their business practices.
  
  --
  Just cruising through this digital world at 33 1/3 rpm...
6. Re:Its not over priced by Anonymous Coward · 2016-06-01 03:06 · Score: 4, Funny
  
  Thank goodness Western hackers only do it for God and country
7. Re:Its not over priced by 110010001000 · 2016-06-01 03:17 · Score: 3, Funny
  
  You are right. People will never trust "BuggiCorp" again. And he can't change his handle, it is on his passport and his Mom would be upset too. Thanks for the tip.
8. Re:Its not over priced by Falos · 2016-06-01 04:28 · Score: 4, Insightful
  
  Offering a $100 water bottle to someone dying in the desert is overpriced. You people are deliberately spreading this bullshit about "There's no such thing as 'overpriced' we can charge anything for anything".
  
  Using the imaginary property racket to monopolize a $500 pill is overpriced. Oops, someone found a functional reprint and is giving it away, now your angry shareholders are gonna have you black bagged.
9. Re:Its not over priced by pr0fessor · 2016-06-01 05:08 · Score: 1
  
  That's about 6 million rubles is that enough to retire?
10. Re:Its not over priced by AlphaBro · 2016-06-01 06:47 · Score: 1
  
  The first two points are valid. That last, not so much. A vulnerability can be patched at any moment, intentionally or not. This is especially true if live 'spoits are in play.
11. Re:Its not over priced by sshir · 2016-06-01 07:26 · Score: 3, Insightful
  
  I'm not economist, but still, I think you are wrong. By saying "$100 water bottle to someone dying in the desert" you are intentionally conflating water's utility in that particular situation with water's _marginal_ utility and cost. Who knows how that particular bottle ended up in the desert, might be that the seller is dying from thirst himself, etc.
  BTW, marginal utility (and marginal cost) of that vulnerability is exactly zero. Do you expect getting it for free?
  
  And $500 pill might be an abuse of monopoly position, and might not be (e.g. massive R&D with small number of cases). And while government gives copyright protection it also has the power to rein on monopoly abuses. Blame your slow or corrupt or incompetent government for not slapping pharma's hand. Again - granted monopoly comes with price controls - pharma might self regulate if they wish but don't have to (they have shareholders to feed, risky R&D investments to make, etc).
12. Re:Its not over priced by JustAnotherOldGuy · 2016-06-01 09:09 · Score: 1
  
  That's about 6 million rubles is that enough to retire?
  No, not nearly enough unless you're already 75 years old, and maybe not even then. It works out to just under $90K ($89,413 according to google). You could live in style for a while but it's hardly retirement-level money.
  
  --
  Just cruising through this digital world at 33 1/3 rpm...
13. Re:Its not over priced by pr0fessor · 2016-06-01 10:40 · Score: 1
  
  I have no idea how the cost of living differs I have friends in countries where $90k USD would be about the same to them as it is to me and some countries where it would be more, of course $90k is a lot more in kansas than new york and that's the same country.
14. Re:Its not over priced by JustAnotherOldGuy · 2016-06-01 11:32 · Score: 1
  
  I have no idea how the cost of living differs
  It differs based on location and how old you are. No matter where you live you'll need more to retire at 50 than at 70, assuming you want to live to reach 80 (for example).
  
  --
  Just cruising through this digital world at 33 1/3 rpm...
15. Re:Its not over priced by FilatovEV · 2016-06-02 00:46 · Score: 1
  
  That's about 6 million rubles is that enough to retire?
  It's a not-too-much-qualified programmer's wage during 4 years, assuming a domestic Russian employer (a monthly wage of 120k roubles is what pretty much any guy can get doing programming in a Russian company). But a person that qualified always has the option to work for a Western company, in which case it's about a year's wage, give or take.
16. Re:Its not over priced by FilatovEV · 2016-06-02 01:02 · Score: 1
  
  Isn't it heartwarming how quickly those Commies embraced Capitalism?
  It wouldn't harm to do a bit of reading to better appreciate the Russian culture since after the collapse of the Soviet Union. You could start with a popular 1997 sci-fi novel.
  Basically there was wild Capitalism since 1991, and it's not fun.
17. Re:Its not over priced by lsatenstein · 2016-06-02 06:50 · Score: 1
  
  NSA. Homeland Security, and other goodguys (sic) will do a joint purchase
  
  --
  Leslie Satenstein Montreal Quebec Canada
It is worth what somebody will pay for it by thue · 2016-06-01 01:07 · Score: 4, Insightful

> While security experts think the zero-day may be overpriced, they think the hacker will find a buyer regardless.
If they think there is a buyer who will pay $90,000 for it, then it is per definition not overpriced.
1. Re:It is worth what somebody will pay for it by Anonymous Coward · 2016-06-01 01:14 · Score: 5, Funny
  
  I got Windows 10, including all its vulnerabilities, for free. No way is anyone paying $90K for just one of them.
2. Re:It is worth what somebody will pay for it by mrchaotica · 2016-06-01 01:26 · Score: 1
  
  They failed to sell it at $95,000, so that amount was overpriced. Since it hasn't sold yet (or at least, Slashdot hasn't reported its sale yet), whether $90,000 is overpriced remains to be seen.
  
  --
  "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
3. Re:It is worth what somebody will pay for it by Anonymous Coward · 2016-06-01 01:33 · Score: 1
  
  I just woke up one morning, and it was fucking there. I assume it was free, but I really don't know for sure. I just woke up the computer from sleep mode and there was Windows 10 staring back at me. On top of that, it had uninstalled 3 of my apps because it said they were not certified to work with Windows 10. It didn't even ask, it just nuked them. Luckily they were things that I almost never use, but that was wrong. Fuck Windows 10.
4. Re:It is worth what somebody will pay for it by ripvlan · 2016-06-01 01:52 · Score: 1
  
  While I agree with your sentiment - something being overpriced means "I wouldn't pay that much" Just because some "idiot" would pay that much doesn't mean it was a fair price.
  I suppose it depends upon how many bidders there are. If there are 20 people who might want to buy it - but only 1 buys it - then it might have been too high a price.
  Years ago a friend told me - when discussing setting prices for a tag sale - go on eBay to determine the value of something. It is like a commodities market and shows the price that the market will bear.
5. Re:It is worth what somebody will pay for it by b0bby · 2016-06-01 02:01 · Score: 1
  
  something being overpriced means "I wouldn't pay that much" Just because some "idiot" would pay that much doesn't mean it was a fair price.
  Well, that's the market - all you need is one "idiot" in this case. A "fair" price can be influenced by a lot of things, but a market price should be the highest price the market will bear.
6. Re:It is worth what somebody will pay for it by bondsbw · 2016-06-01 02:08 · Score: 1
  
  In this case, due to supply vs. demand (where supply = 1) it is the same as literally the highest price anyone will pay for it.
  
  --
  All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
7. Re:It is worth what somebody will pay for it by geekmux · 2016-06-01 02:15 · Score: 2, Interesting
  
  > While security experts think the zero-day may be overpriced, they think the hacker will find a buyer regardless.
  If they think there is a buyer who will pay $90,000 for it, then it is per definition not overpriced.
  And if Microsoft themselves do not attempt to buy it, then they've shown how much they value their own product. Or the customer base. Or security in general.
  Of course, we knew the latter already...
8. Re:It is worth what somebody will pay for it by JcMorin · 2016-06-01 02:32 · Score: 1
  
  I tend to agree since the hacker said he will sold it only once, that seems to be a good deal for Microsoft.
9. Re:It is worth what somebody will pay for it by Flavianoep · 2016-06-01 02:32 · Score: 1
  
  They must be trying to figure out what the vulnerability is, or if it actually exist at all.
  
  --
  Linux is for people who don't mind RTFM.
10. Re:It is worth what somebody will pay for it by Dr_Barnowl · 2016-06-01 02:35 · Score: 4, Interesting
  
  Learning Linux is like learning to drive a stick shift.
  A few more skills, in exchange for more efficiency and better performance.
11. Re:It is worth what somebody will pay for it by Anonymous Coward · 2016-06-01 02:35 · Score: 1
  
  Windows. The cheapest, best option. If your time is worthless.
  I used to say this about Linux, but it's become better than Windows.
  Or you got a clue. That does tend to happen over time. Sometimes. Not all Linux users are noobs constantly making forum posts wondering why something doesn't work. Some of us know what we're doing. We set a thing up once and it continues to run smoothly while we do whatever it is we intended to do with the system.
  For the clueful it's always been better than Windows with the one exception of heavy gamers. Linux was rock solid stable back in the crashy Win 9x days, it has one hell of a lot less remotely exploitable vulnerabilities and plenty of ways to reduce your attack surface (don't run shit like Sendmail). It has no viruses in the wild despite the powerful high-bandwidth tempting targets that > 50% of all web servers would make. It has centralized package management instead of chaotically letting each application run its own updater like in Windows so it's easier to be sure things get patched. It also has options to mitigate threats like grsecurity, selinux, and building source with SSP.
  It also comes with the bonus of not dealing with Microsoft, and avoiding all the baggage attached to that. I know some of you love to hate that reason - maybe you must deal with Windows at work so you have to rationalize it. That's understandable, but no reason to disregard the long hostile history of MS and no reason to ignore the wisdom of those who have witnessed it personally. Their new thing is using a "free" upgrade to spy on their own customers - that's just the latest in a long line of abuses, some illegal, most not, all hostile. Some of us got tired of saying "ouch ... more!" because we're not into electronic S&M.
12. Re:It is worth what somebody will pay for it by bbelt16ag · 2016-06-01 02:38 · Score: 2
  
  you don't even got to learn to use a clutch anymore, how hard can it be? C is C, .net is .net whats the damn big deal? move people move! Microsoft is the Villain, always has been always will be.
  
  --
  NEVER NEVER NEVER NEVER NEVER NEVER NEVER NEVER GIVE UP! "No limitations, no boundaries, there is no reason for them."
13. Re:It is worth what somebody will pay for it by jo7hs2 · 2016-06-01 02:54 · Score: 3, Insightful
  
  Actually, EPA mileage estimates usually come out slightly *higher* for automatics now. Just saying.
14. Re:It is worth what somebody will pay for it by Opportunist · 2016-06-01 02:57 · Score: 2
  
  Timeo Danaos et dona ferentes
  And considering the gift mentioned in this quote was the Trojan Horse, I can't think of a better phrase describing how I feel about Windows 10.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
15. Re:It is worth what somebody will pay for it by Opportunist · 2016-06-01 02:58 · Score: 1
  
  Windows. Proof of the "you get what you pay for" proverb.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
16. Re:It is worth what somebody will pay for it by Opportunist · 2016-06-01 03:06 · Score: 2, Informative
  
  Sadly it ain't that easy. Yes, Linux has come a long way, but there are still a few areas where it is lacking. Notoriously most non-server related hardware.
  Yes, you can get drivers for even the most esoteric RAID 6+0 controller you could imagine, but there is little to no support for programmable mice (you know the kind, with the 20 buttons), programmable flight sticks, hell, it's a gamble with most advanced audio cards whether you get any kind of support for the features that elevate them above the sound that you could get out of your mainboard and it's even nontrivial for people without a decent Linux background to get their graphics acceleration working. And even games that allegedly have Linux support usually mean that "it should run in Mono, right?"
  In other words, Linux on a server? Any time. And probably better supported and faster than what you'll get on Windows.
  Linux on the desktop? Not if gaming is your goal and/or nonstandard non-server hardware is what you'll be using. This is not necessarily the fault of Linux itself, more one of hardware manufacturer delivering zero to little support for their hardware for use in Linux. Which in turn is mostly due to most people buying their hardware for Windows and only installing Linux as an afterthought, only to find out that their Hardware is not working as it should, blame Linux and switch back.
  And no, I don't have a solution ready for this.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
17. Re:It is worth what somebody will pay for it by Anonymous Coward · 2016-06-01 03:13 · Score: 1
  
  They must be trying to figure out what the vulnerability is, or if it actually exist at all.
  Or even Microsoft's billions aren't enough to keep playing whack-a-mole with all the vulnerabilities in Windows.
  That or they don't want to be in a position of rewarding this kind of research. Some companies do have bug-bounties because they want to openly attract white-hats but I've never heard of MS doing that. MS probably just wants the whole thing to go away. It won't, but when you have a monopoly you can afford to pretend.
18. Re:It is worth what somebody will pay for it by David_Hart · 2016-06-01 03:20 · Score: 1
  
  Learning Linux is like learning to drive a stick shift.
  A few more skills, in exchange for more efficiency and better performance.
  More like a model-T where you have to set the gas, choke, and then hand crank it. Some distributions are more user friendly than others, but if you want to do anything more than web browsing and document editing it requires a steeper learning curve than learning how to drive a stick.
19. Re:It is worth what somebody will pay for it by Gr8Apes · 2016-06-01 03:22 · Score: 1
  
  Windows. The cheapest, best option. If your time is worthless.
  Linux has never been an option when your time is worthless. Anyone thinking that there is no time commitment when learning how to use a tool has a broken valuation standard - they're also ignoring all the time they have spent learning and fighting with the O.S. they are currently using.
  This is what people don't understand. A LiveCD(DVD) will get you running on Linux with minimal fuss, much like the initial crappy windows install. Windows was alluring because it was simpler for many, and came pre-installed. Plus, Office ran on it. Office is now no longer as important (seriously, it isn't, you can live without it even in an Office oriented world) and the costs of keeping Windows running and not invading your privacy IMHO has now exceeded learning Mac OS or Linux. Hell, even learning how to build and install Gentoo might be simpler.
  
  Now if you'll excuse me I'll go back to grumbling about systemd, GNOME 3.x and other real problems . . . except we can route around the damage.
  Systemd is banned on any system I run. Any *service* that demands that POSIX compliant apps be rewritten to its non-POSIX standards is a massive FAIL. The sooner the various systemd pandering distros realize that, the better. Or maybe not. After all, NetBSD, or any BSD really, is rock solid and a better system in many ways. And no systemd there. :)
  
  --
  The cesspool just got a check and balance.
20. Re:It is worth what somebody will pay for it by olsmeister · 2016-06-01 03:41 · Score: 2
  
  Also, nobody asks to borrow your car (computer) because they cannot operate it.
21. Re:It is worth what somebody will pay for it by flyingfsck · 2016-06-01 03:44 · Score: 1
  
  No, Winston Churchill only said never 7 times in that speech, not 8.
  
  --
  Excuse me, but please get off my Pennisetum Clandestinum, eh!
22. Re:It is worth what somebody will pay for it by flyingfsck · 2016-06-01 03:45 · Score: 1, Funny
  
  Yes, yes, Linux doesn't work on toys, but it works on everything else. Windows only works on toys.
  
  --
  Excuse me, but please get off my Pennisetum Clandestinum, eh!
23. Re:It is worth what somebody will pay for it by Opportunist · 2016-06-01 03:57 · Score: 5, Insightful
  
  The problem is, most of the Joe Randomusers out there use their computer primarily as a toy.
  What Joe wants is to look at his Facebook, read his mail, chat with friends and play some games. And that's it. Yes, we up here in our beautiful ivory tower, we might have some lofty ideas what our computers should or should not do, but that matters little to the 99% of Joes out there. They don't care about spyware in their OS. They don't care about only being allowed to install software from the walled garden (because that's all THEY want). And they don't give a shit that we rant and rave against it.
  And neither do hardware makers. They care about sales numbers. If that means to offer locked down hardware that is to the liking of governments and corporations, they will offer locked down hardware. Not because they are "evil", because they hate free speech or because they don't want us to actually own the machines we pay for, but simply because that means more sales.
  So yes, if you want freedom, you have to cater to that Joe out there who wants to play with his toys. Because we are few and the Joes are many. So we need those Joes that want their toys in our boat to get the hardware (and software) makers to do what we want.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
24. Re: It is worth what somebody will pay for it by Type44Q · 2016-06-01 04:06 · Score: 1
  
  Notoriously most non-server related hardware.
  You're years out of date.
25. Re:It is worth what somebody will pay for it by Anonymous Coward · 2016-06-01 04:19 · Score: 1
  
  It's an estimate. It's probably a good one too- most stick drivers aren't going for efficiency all the time, and automatics have gotten smarter at this than in the past. But if you drive a manual for gas mileage, you'll beat the robot still, for sure.
26. Re:It is worth what somebody will pay for it by Opportunist · 2016-06-01 04:25 · Score: 1
  
  The problem is not just me. The problem is Joe who gets fed up with Windows and eventually gets off his butt and tries something else. Joe will invariably have hardware in his system that will not work well with Linux. Yes, it's a problem of the hardware manufacturers, but in the end, it's ours. Because Joe doesn't care WHY his hardware isn't supported, he cares THAT it isn't supported.
  And I could think of quite a few games that refused to work for me in Linux. KSP being maybe the one that most people here would know best.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
27. Re:It is worth what somebody will pay for it by thegarbz · 2016-06-01 04:35 · Score: 1
  
  A few more skills, in exchange for more efficiency and better performance.
  That is actually a very awesome and relevant comparison given that these days you get better efficiency and better performance out of a variety of the modern automatic transmissions and the only thing that stick shift drivers still have to boast about is more control over their engine.
28. Re:It is worth what somebody will pay for it by fahrbot-bot · 2016-06-01 04:36 · Score: 2
  
  but there is little to no support for programmable mice (you know the kind, with the 20 buttons)
  Twenty buttons on a mouse? At point, wouldn't it just be easier to mount an LED on the bottom of your keyboard and use *that* as your mouse?
  
  --
  It must have been something you assimilated. . . .
29. Re: It is worth what somebody will pay for it by Opportunist · 2016-06-01 04:36 · Score: 1
  
  Ok, then. Since I could not locate them and you're obviously far more knowledgeable, I'm really sure you could point me to the Linux drivers for the Asus Xonar Essence STX so I could actually use it for more than the built-in sound card on the mainboard (for which I also have no drivers, but then again, I don't use it, so...) and tell me how to make a Mad Catz R.A.T. 7 Gaming mouse work (not even talking about drivers for the special tidbits, I'd be happy if all my clicks were noticed already) in XWindow? And while you're at it, please point me to the Linux version of the configuration tool for the Thrustmaster Warthog HOTAS. And please point me to the Linux drivers for the USB soundcard that comes with the Sennheiser D363 headset, that would be great.
  Thank you!
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
30. Re:It is worth what somebody will pay for it by Minupla · 2016-06-01 04:37 · Score: 1
  
  It can't be that good an exploit. M$ pays up to 100KUSD for bug bounties. If it was that good, they'd just sell it to M$, instead of discounting to 90K.
  Expect it'll get discounted again before sale. Although they have to be happy about the PR, might help them get a sale.
  
  --
  On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
31. Re:It is worth what somebody will pay for it by thegarbz · 2016-06-01 04:38 · Score: 1
  
  Also, it's easy as hell to beat the EPA estimates while still driving fast with most manuals I've driven.
  Lol nice try. But not only are the EPA estimates gamed in a way that unless you drive downhill both ways you're not going to beat them, but manufacturers have in the past year come out of the woodworks showing how they themselves game the system to achieve even lower mileage than the car would in any ordinary situation.
32. Re:It is worth what somebody will pay for it by Opportunist · 2016-06-01 04:39 · Score: 1
  
  C'mon, you're not that aspie that you don't understand the concept of exaggerations.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
33. Re:It is worth what somebody will pay for it by Mashiki · 2016-06-01 04:45 · Score: 1
  
  Learning Linux is like learning to drive a stick shift.
  A few more skills, in exchange for more efficiency and better performance.
  The only downside is that for gaming in general, 'nix is pretty shitty. I know some idiot will go, blahblah,gaming,blahblah,nicheshit. Keep in mind that most of what people use 'nix for would also be considered niche shit. That's changing at last though, especially with vulkan and the number of developers that are on board with it vs DX12 and that all video card manufacturers are on board with it. With any luck it'll finally put the nail in the coffin of OpenGL and that giant clusterfuck it has yet to recover from back ~5 years ago. They get it worked out, and we'll finally see "year of the 'nix desktop" ... finally... after almost 20 years of people claiming it so.
  
  --
  Om, nomnomnom...
34. Re:It is worth what somebody will pay for it by fahrbot-bot · 2016-06-01 04:48 · Score: 1
  
  C'mon, you're not that aspie that you don't understand the concept of exaggerations.
  Nope. I've just been around long enough to know how ridiculous some hardware can be and am not assuming you're joking. I'm *sure* someone out there actually has a mouse with 20 buttons on it -- probably that they custom built -- or will want one after reading your post. Just you wait. Someone is going to ask where you got it. :-)
  
  --
  It must have been something you assimilated. . . .
35. Re:It is worth what somebody will pay for it by drinkypoo · 2016-06-01 04:57 · Score: 1
  
  EPA can't drive stick. And, they drive slow as all hell in automatics. No one gets the EPA mileage in an automatic unless they drive like a total asshole on the road (total slow fuck).
  I have no trouble getting the EPA estimated mileage in my 1997 Audi A8 Quattro, and that was back in the day when the EPA mileage estimates were invented from dreams and unicorn jism. It's got 230,000 miles on it, and still gets over 19 MPG combined. The window sticker estimate is 17/25; the 3.7 liter FWD model has an 18 combined estimate and I have the 4.2 liter AWD version. (The EPA has not published a combined mileage estimate for my vehicle.) And here's a couple on Fuelly getting over 21, they must be doing pretty much all-highway. And I make pretty good time, I don't hesitate to pass, etc. I just don't waste fuel. Enjoying it isn't wasting it, but if you're on the brakes all the time, that is. And mind you, it has a fairly old-school automatic... clutch packs and not bands, but still triple-planetary.
  
  Also, it's easy as hell to beat the EPA estimates while still driving fast with most manuals I've driven.
  Most people don't downshift soon enough on flat, and/or downshift too soon on a hill, and they fail to get good mileage.
  
  --
  "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
36. Re:It is worth what somebody will pay for it by tlhIngan · 2016-06-01 05:13 · Score: 1
  
  Sadly it ain't that easy. Yes, Linux has come a long way, but there are still a few areas where it is lacking. Notoriously most non-server related hardware.
  Yes, you can get drivers for even the most esoteric RAID 6+0 controller you could imagine, but there is little to no support for programmable mice (you know the kind, with the 20 buttons), programmable flight sticks, hell, it's a gamble with most advanced audio cards whether you get any kind of support for the features that elevate them above the sound that you could get out of your mainboard and it's even nontrivial for people without a decent Linux background to get their graphics acceleration working. And even games that allegedly have Linux support usually mean that "it should run in Mono, right?"
  In other words, Linux on a server? Any time. And probably better supported and faster than what you'll get on Windows.
  Linux on the desktop? Not if gaming is your goal and/or nonstandard non-server hardware is what you'll be using. This is not necessarily the fault of Linux itself, more one of hardware manufacturer delivering zero to little support for their hardware for use in Linux. Which in turn is mostly due to most people buying their hardware for Windows and only installing Linux as an afterthought, only to find out that their Hardware is not working as it should, blame Linux and switch back.
  And no, I don't have a solution ready for this.
  It's not the esoteric hardware that's the problem, it's the whole Linux development philosophy needs to change for Linux on the desktop.
  Server use cases are completely different from desktop use cases, and much conflict has occurred over stuff to get Linux on the desktop.
  Things like NetworkManager, PulseAudio, SystemD are required on the desktop because they enable operations that users expect from a decent desktop OS. And yet if you listen to the Linux communities at large, you'd think each one was the devil for being large, monolithic and completely "not Unix".
  And that's ignoring the need to standardize on a desktop environment.
  NetworkManager is completely necessary even though it doesn't seem to do much - because mobile computers will connect to multiple networks with multiple requirements all the time - /etc/network/interfaces was just not designed to handle scenarios where WiFi may attach to a home network, a work network, and multiple public networks, each with a varying configuration of static/dynamic IPs, firewall, VPN, and other settings. Heck, most OSes note the MAC address of the gateway router to figure out what network they're on to make life easier (i.e., if the gateway is the one you marked "Home", then the network manager stack will configure the network for your home).
  PulseAudio is another one, something necessary because sound cards will appear and disappear constantly. (I.e., stuff like Bluetooth headsets, USB DACs, etc). Again, in a mobile use case, a user may dock their PC which has a USB DAC associated with it, and the moment they do, audio should seamlessly switch to it. (Granted, some application can use "exclusive" mode and they may need restarting in order to associate with the proper hardware. But in the general use case, most users will use the default system mixer which should intelligently move the music from internal sound to the external sound card without skipping a beat. Plus, they want to be able to watch their YouTube video and such so everything should be mixed in. And when they get a VoIP call, it would use their speakers and micropones until the user plugs in their headset (USB based, or Bluetooth) at which point the OS should systematically route just the communications audio to the VoIP program to the headset, even while music or other thing is running, without skipping a beat.
  All these require big monolithic blocks and completely destroy "the unix way" because there is no way solve the complexity of these operations without big monolithic services.
37. Re:It is worth what somebody will pay for it by clarkn0va · 2016-06-01 05:32 · Score: 3, Insightful
  
  And if Microsoft themselves do not attempt to buy it, then they've shown how much they value their own product. Or the customer base. Or security in general.
  Of course, we knew the latter already...
  While I agree that MS cares nothing for security or their customers so long as they retain the ability to take people's money, there are good reasons for them not to pay this ransom. To do so would be to promote this type of black hat activity, and they have no substantial assurance that they will get what they paid for.
  
  --
  I am literally 3000 tokens away from the chaotic crossbow --Stephen
38. Re: It is worth what somebody will pay for it by Bing+Tsher+E · 2016-06-01 05:36 · Score: 1
  
  The 'non-server related hardware' Linux supports is out of date, too. Moving target, dude.
39. Re:It is worth what somebody will pay for it by mink · 2016-06-01 05:42 · Score: 1
  
  I own a gen 1 Prius (296K miles) and even when it was new the best way to improve mileage to near sticker (highway) was to use cruise control as much as possible.
  
  --
  Well I've wrestled with reality for thirty five years doctor, and I'm happy to say I finally won out over it.
40. Re:It is worth what somebody will pay for it by geekmux · 2016-06-01 05:43 · Score: 1
  
  And if Microsoft themselves do not attempt to buy it, then they've shown how much they value their own product. Or the customer base. Or security in general.
  Of course, we knew the latter already...
  While I agree that MS cares nothing for security or their customers so long as they retain the ability to take people's money, there are good reasons for them not to pay this ransom. To do so would be to promote this type of black hat activity, and they have no substantial assurance that they will get what they paid for.
  Since you've kindly labeled this as a "ransom", please feel free to tell me how this is really that different from a bug bounty program.
  You can label this "activity" any way you want. At the end of the day, it's Microsoft paying someone to help make their own damn product secure. One would think that would be worth it to them. The only real difference is Microsoft is being forced to pay more than a pathetic pittance for the solution.
41. Re:It is worth what somebody will pay for it by KingMotley · 2016-06-01 06:11 · Score: 1
  
  Not much of an exaggeration. Mine has 19.
42. Re:It is worth what somebody will pay for it by negRo_slim · 2016-06-01 07:05 · Score: 1
  
  It has no viruses in the wild despite the powerful high-bandwidth tempting targets that > 50% of all web servers would make.
  I'm glad someone brought some humour into this discussion. Good show!
  
  --
  On the Oregon Cost born and raised, On the beach is where I spent most of my days
43. Re: It is worth what somebody will pay for it by haruchai · 2016-06-01 07:11 · Score: 1
  
  Have you tried asking the vendor to write a driver? They wrote the ones for Windows, didn't they?
  
  --
  Pain is merely failure leaving the body
44. Re:It is worth what somebody will pay for it by Lord+Crc · 2016-06-01 07:19 · Score: 1
  
  Windows only works on toys.
  Linux on desktop is a toy.
  I use Windows on my desktop PC because I prefer to get shit done.
45. Re: It is worth what somebody will pay for it by Opportunist · 2016-06-01 07:52 · Score: 1
  
  Yes. There is a market for that in Windows, ya know? Linux gaming is still a rather insignificant portion of the cake.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
46. Re:It is worth what somebody will pay for it by HiThere · 2016-06-01 08:21 · Score: 1
  
  Sorry, but that's not true. Microsoft is *A* villain. There are plenty of others. In fact, just about every group is a villain in some area. Apple is notorious for binding users to its hardware, and has been since the Apple ][ variable density disk drives. Google slurps up user information. Red Hat pushes systemd. Etc.
  There are plenty of villains to go around. Microsoft is just an unusually wide spectrum villain. But they used to sell good keyboards.
  
  --
  
  I think we've pushed this "anyone can grow up to be president" thing too far.
47. Re:It is worth what somebody will pay for it by HiThere · 2016-06-01 08:24 · Score: 1
  
  I'd like to say "that's Greek to me", but I know it's Latin...Virgil if I recall correctly.
  
  --
  
  I think we've pushed this "anyone can grow up to be president" thing too far.
48. Re:It is worth what somebody will pay for it by TeknoHog · 2016-06-01 09:51 · Score: 1
  
  Learning Linux is like learning to drive a stick shift.
  That's a nice comparison, because here in Finland everyone who learns to drive, does so with stick shift and clutch. Automatic transmissions are only used by disabled people. This is obviously why Linux comes from Finland and Windows comes from the USA.
  
  --
  Escher was the first MC and Giger invented the HR department.
49. Re:It is worth what somebody will pay for it by Copid · 2016-06-01 10:35 · Score: 1
  
  The difference between paying for this and paying a ransom is that paying a ransom encourages people to do damage that otherwise wouldn't have occurred. In this case, the bug clearly exists already (assuming this isn't fraud), so somebody is going to find it and use it sooner or later, even if this guy doesn't sell the exploit. If it's real, $90K sounds like a sweet deal for Microsoft. A serious incident involving an exploit like that would cause way more than $90K in damage, and it would cost a team of engineers way more than $90K to figure out what this bug is and fix it.
  
  --
  An interesting anagram of "BANACH TARSKI" is "BANACH TARSKI BANACH TARSKI"
50. Re:It is worth what somebody will pay for it by mtxmorph · 2016-06-01 13:37 · Score: 1
  
  Linux on desktop is a toy.
  Is it now?
  
  Hmm, then I must have been playing instead of working here in the office - it's been two years since I switched my laptop over. Thanks for letting me know; it's a good thing they haven't fired me.
51. Re: It is worth what somebody will pay for it by Opportunist · 2016-06-01 20:20 · Score: 1
  
  One out of four. And it's from an AC. And it's something that I'd not really trust Joe Randomuser with.
  But hey, it's a start. Out of curiosity, dear AC, how long did you search for it when you needed it?
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
52. Re:It is worth what somebody will pay for it by Reziac · 2016-06-02 06:34 · Score: 1
  
  Small potatoes. Did you see Tom Scott's emoji keyboard??!
  https://www.youtube.com/watch?...
  
  --
  ~REZ~ #43301. Who'd fake being me anyway?
Headline by rossdee · 2016-06-01 01:12 · Score: 1

:All OS Versions On Sale For $90,000"
What OS versions reetail for $90,000 ?
Maybe some punctuation in the headline might help.
Perspective by Psicopatico · 2016-06-01 01:12 · Score: 1

You shouldn't worry about known exploits.
You should worry about unknown exploits.

--
Mastering the English language is fucking easy: all you have to do is to put an f* word in every fucking sentence.
1. Re:Perspective by Dr_Barnowl · 2016-06-01 02:36 · Score: 1
  
  It's unknown though. It's just a known unknown instead of an unknown unknown.
2. Re:Perspective by Opportunist · 2016-06-01 03:09 · Score: 1
  
  I wouldn't know.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Not overpriced at $90K by xxxJonBoyxxx · 2016-06-01 01:15 · Score: 5, Interesting

>> While security experts think the ($90K) zero-day may be overpriced

As a security expert and occasional entrepreneur, let me tell you why this isn't overpriced. Let's say you could deliver 10,000 phishing emails that lead to installation of $70/unlock ransomware screens, of which 50% of victims usually pay. That's $350K of revenue, minus costs of the initial phishing campaign ($5K-ish), bitcoin exchange fees (maybe $10K) and the $90K for your zero day. That leaves a profit of about $250K - not bad for a few days of work.
1. Re:Not overpriced at $90K by Anonymous Coward · 2016-06-01 01:26 · Score: 1
  
  It can be wrapped in any number of games and applications, and stuffed onto torrent sites, or even shiteware sites like cnet's. Every week a new mega-game is coming out, suckers are waiting. With the holiday season new CoD, BF, et al looming, millions will grab the latest without a thought.
2. Re:Not overpriced at $90K by Anonymous Coward · 2016-06-01 03:29 · Score: 1
  
  If a competitor is selling theirs for half the price, is yours still not overpriced because your buyer can still make a profit?
ALL Windows versions? by U2xhc2hkb3QgU3Vja3M · 2016-06-01 01:16 · Score: 1

It works on Windows XP? Windows 98SE? Windows 3.11?
1. Re:ALL Windows versions? by nullCRC · 2016-06-01 01:19 · Score: 1
  
  just not Windows 2.0
  
  --
  Vescere bracis meis.
2. Re:ALL Windows versions? by Phydeaux · 2016-06-01 01:22 · Score: 3, Informative
  
  Win 3.11 was an operating environment, so technically not the Win 3.x family. The real question is, will it work on WinME, because even officially authorized software was unable to work with it...
3. Re:ALL Windows versions? by TeknoHog · 2016-06-01 01:49 · Score: 1
  
  The real question is, will it work on WinME
  I first read that as "Wine", and a good exploit should be portable in that way. Although I guess technically that would count as a mere operating environment.
  
  --
  Escher was the first MC and Giger invented the HR department.
MS Goes Black by TFlan91 · 2016-06-01 01:20 · Score: 1

If you thought gwx.exe was a bitch, just wait until MS gets their hands on this exploit!
"But... it was the Russians! They thought they could brick all US PC's by forcing Win10 upgrade!"
Not *all* Windows versions by Junta · 2016-06-01 01:21 · Score: 1

exists in all OS [versions], starting from Windows 2000.

And people mock me for running NT4!

--
XML is like violence. If it doesn't solve the problem, use more.
1. Re:Not *all* Windows versions by Anonymous Coward · 2016-06-01 02:48 · Score: 1
  
  At least the last time he saw a vagina in person wasn't when being birthed by his mom. You on the other hand...
2. Re:Not *all* Windows versions by TemporalBeing · 2016-06-01 04:05 · Score: 1
  
  Ahh, so the claim of M$ that Win10 had a different code base compared to all the previous versions is false.
  When did they make that claim? Never that I'm aware of.
  
  Historically, Microsoft had two code bases: Win9x line, and NT line. With WinME and WIn2k/XP, the two lines merged. Then between Win2k/XP and Win2k3/Vista, there was a major refactor of the codebase, removing cyclic dependencies, user-kernel-user dependencies (so it was only user->kernel, no kernel->user), reducing headers so you could actually include simple headers instead of the entire Windows API all the time, and more. Every version of Windows since Vista has been an incremental change building off of that refactor.
  
  --
  Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
3. Re:Not *all* Windows versions by Bing+Tsher+E · 2016-06-01 05:55 · Score: 2
  
  I would say that 'With WinME and Win2K the differences became pronounced' then the last desktop-consumer related missing features were rolled into WinXP.
  The release of Win2K really set back Linux on the desktop. For a long time it was the better-than-linux option for the desktop. For years linux advocates carped and whined about 'Windows problems' that were bound to the old Win9x codebase, because they couldn't afford to compare desktop linux to W2k.
4. Re:Not *all* Windows versions by TemporalBeing · 2016-06-01 08:03 · Score: 1
  
  I would say that 'With WinME and Win2K the differences became pronounced' then the last desktop-consumer related missing features were rolled into WinXP.
  True, though I really didn't like XP's interface (eX-Professional - due to all the bubbles, etc - really made it seem childish to me). Between it and cost I jumped over to Linux for Desktop more quickly; though my employers stuck with Windows.
  
  The release of Win2K really set back Linux on the desktop. For a long time it was the better-than-linux option for the desktop. For years linux advocates carped and whined about 'Windows problems' that were bound to the old Win9x codebase, because they couldn't afford to compare desktop linux to W2k.
  Kind of. Win9x/Me and Win2k were pretty close in many respects as far as usability went from a user perspective. The jump from that to the Linux DE's was pretty significant so yes it made it harder especially since XP brought a good bit of compatibility with software written for the 9x line so people could move easily from 9x/Me to XP.
  
  I don't really recall much complaining about issues other than Microsoft doing things like rewriting boot records to use their boot loader (which stopped with Vista, but if I'm not mistaken started again with Win8 and SecureBoot), effectively making dual booting a real chore to install correctly, not to mention (which still happens) manufacturers putting in the BIOS/EFI/UEFI configurations only for Windows and skipping any alternative - making use of power management features extremely difficult, and typically leaving the Linux devs to ignore the BIOS/EFI/UEFI as much as possible.
  
  Overall yes, the usability of Win2k and even WinXP was high enough that it did keep people on Windows longer, thereby depressing the numbers that would have migrated to a Linux DE. Even Vista and Win7 have done that. Win8 was blessing to Linux DE since its complicated tile-based interface (Metro, aka Modern) pushed people away; and Win10 (with metrics, etc) isn't really a complete solution to that (it did resolve the Metro issue, but introduced others).
  
  --
  Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
5. Re:Not *all* Windows versions by Desler · 2016-06-01 10:23 · Score: 1
  
  They never made any such claim. So, yes, your strawman claim is false.
6. Re:Not *all* Windows versions by CanadianMacFan · 2016-06-02 04:19 · Score: 1
  
  Bah, you need to be running NT 3.5! After that they moved the video drivers into the kernel and you got a lot more blue screens of death.
priv esc by Robert+Goatse · 2016-06-01 01:22 · Score: 3, Interesting

So it's a privilege escalator not necessarily an exploit to initially get into a host. For a 'real' Windows exploit, 90K is super-duper cheap, but for something like this 90K may be a tad overpriced for what you get.
Re:Well,it's too late! by omnichad · 2016-06-01 01:33 · Score: 1

Wrong zero. It's still -29 days until the Zeroth of July
the free market by Toonol · 2016-06-01 01:33 · Score: 2

If he can find a buyer, it's not overpriced. Items don't have an innate value; their worth is whatever someone is willing to pay at that moment.
Scam? by Roodvlees · 2016-06-01 01:46 · Score: 1

Can't he make much more money by selling it to Microsoft? It seems this is priced way too low.

--
Thank you, Bradley Manning, Edward Snowden and so many others, for courageously defending humanity, my freedom and more!
Re:From TFA by NatasRevol · 2016-06-01 01:54 · Score: 1

Approaches, possibly.
Implementation, not fucking close.

--
There are two types of people in the world: Those who crave closure
Security experts, but not financial experts... by Afty0r · 2016-06-01 01:56 · Score: 1

While security experts think the zero-day may be overpriced, they think the hacker will find a buyer regardless.
So by definition they do not think it's overpriced.
Why even care about privilege exploit? by Anonymous Coward · 2016-06-01 01:59 · Score: 1

Does most malware even need admin or SYSTEM access anymore? Once you have a malicious process running as the local user you can steal their data or encrypt it and extract money that way.
Pfffft by JustAnotherOldGuy · 2016-06-01 02:57 · Score: 4, Funny

That's nothing. I've got a zero-day bug called "Norton Anti-Virus" that pwns all versions of Windows and it's only $49.99.

--
Just cruising through this digital world at 33 1/3 rpm...
Another Good Reason by Anonymous Coward · 2016-06-01 03:05 · Score: 1

Another good reason not to use Windows.
Whew! by Barefoot+Monkey · 2016-06-01 03:07 · Score: 1

Windows Zero-Day Affecting All OS Versions On Sale For $90,000

Thankfully the OS version I'm using isn't on sale for $90,000 so it isn't affected by this zero-day.
Re:Windows 10, the most secure version of Windows by Opportunist · 2016-06-01 03:09 · Score: 2

That's about as good as being the best Aussie Rules Football player in the whole Vatican. I'd dare say it might even be the Pope.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Videos, you say? by wonkey_monkey · 2016-06-01 03:19 · Score: 1

Two videos are available, one showing the hacker exploit Windows 10 with the May 2016 security patch, and another one bypassing all EMET features
Videos, eh? Good job they can't be faked.

--
systemd is Roko's Basilisk.
Re:in soviet russia we overprice you! by RabidReindeer · 2016-06-01 03:29 · Score: 1

Ha! I'm waiting for the Bangalore version. $95.
WMF bug? by TemporalBeing · 2016-06-01 04:06 · Score: 1

It keeps rearing its ugly head...did they reintroduce it again?

--
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
Re: Windows 10, the most secure version of Windows by Type44Q · 2016-06-01 04:08 · Score: 1

I'd say the priest have got the advantage if that's touch football...
5 minutes later the buyer gets an NSL from the FBI by schwit1 · 2016-06-01 04:25 · Score: 1

Hand over the vulnerability and you are gagged.
Re:Well,it's too late! by sexconker · 2016-06-01 06:35 · Score: 1

That's not how any of this works.
NSA Will Buy It by wasteoid · 2016-06-01 07:15 · Score: 1

The NSA will buy it, or some other Three-Letter-Acronym organization. And by "buy it" I mean abduct him, steal it, and dissolve him in a bathtub.
1. Re:NSA Will Buy It by mnemotronic · 2016-06-01 10:41 · Score: 1
  
  The NSA will buy it
  If it doesn't sell immediately for any price then I suspect that either
  1. It's bogus
  or
  2. The TLAs already have the vuln
  
  --
  The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.
2. Re:NSA Will Buy It by ebvwfbw · 2016-06-02 13:17 · Score: 1
  
  The NSA will buy it, or some other Three-Letter-Acronym organization. And by "buy it" I mean abduct him, steal it, and dissolve him in a bathtub.
  That's funny. Watching breaking bad or something? State nations don't have to do something like that. They can make people disappear and never get found a lot cheaper than the bathtub trick.
  Besides, they probably had the hack years ago.
Re:5 minutes later the buyer gets an NSL from the by Gavagai80 · 2016-06-01 07:44 · Score: 1

Somehow I doubt someone buying exploits on the black market is going to charge it to their mastercard and provide their address. Maybe to a victim's.

--
This space intentionally left blank
Is this a new one? by dwywit · 2016-06-01 09:44 · Score: 1

Or is it the same old exploit?
Task scheduler - create task
Run as user SYSTEM
trigger - whenever
run cmd.exe or vbscript host with parameters/payload of choice
Profit!
There ya go. Saved you $90K
I use that one to kill anti-virus/anti-malware programs whenever I need to run combofix, because the programs have failed in their primary purpose. If anti-malware programs can't guarantee to stop attacks, they shouldn't be allowed to run in the SYSTEM context. Require a password or SMS code to stop them temporarily, sure, but don't run them in a context where they CAN'T be stopped by a user. Some of them can be suspended temporarily, but that's not enough sometimes.
Back in the NT days, you could even get a CMD window to pop up on the desktop, running in the SYSTEM account. That's how you could get access to the SAM hive of the registry. The passwords were still encrypted, but still......

--
They sentenced me to twenty years of boredom
Re:in soviet russia we overprice you! by phrostie · 2016-06-01 11:45 · Score: 1

But GWX is free until July
Shouldn't Microshaft buy it?! by monkeyzoo · 2016-06-02 02:38 · Score: 1

Shouldn't Microsoft buy this so they can patch it?!?!??!
How does the price compare to their bug bounty, if they have one? In any case, seems it would be good in the long-term for them to snatch it up before criminals do and in the long run would be better PR for Windows than having more hacking cases attributed to them. Or, maybe it's a bad precedent to set for them to pay more and pay outside the official bug bounty channels (again, if they have one)?