Windows Zero-Day Affecting All OS Versions On Sale For $90,000 (softpedia.com)

An anonymous reader writes: "A hacker going by the handle BuggiCorp is selling a zero-day vulnerability affecting all Windows OS versions that can allow an attacker to elevate privileges for software processes to the highest level available in Windows, known as SYSTEM," writes Softpedia. The zero-day is up for sale on a Russian underground hacking forum, and is currently available for $90,000 -- after it was initially up for $95,000. The hacker is saying he'll sell the zero-day to one person only, who'll receive its source code and a working demo. Two videos are available, one showing the hacker exploit Windows 10 with the May 2016 security patch, and another one bypassing all EMET features. While security experts think the zero-day may be overpriced, they think the hacker will find a buyer regardless.

Comments

Its not over priced

[Anonymous Coward]

if some one will pay it.

Re:Its not over priced

[110010001000]

I totally trust the guy when he says he only will sell it to one customer. Why would he want to sell it to many customers? To get more money? Never!

Re:Its not over priced

[Opportunist]

Isn't it heartwarming how quickly those Commies embraced Capitalism?

Re:Its not over priced

[JustAnotherOldGuy]

I totally trust the guy when he says he only will sell it to one customer. Why would he want to sell it to many customers? To get more money? Never!

Exactly. Russian hackers are known for their unfailing honesty and fair dealings in their business practices.

Re:Its not over priced

[Anonymous Coward]

Thank goodness Western hackers only do it for God and country

Re:Its not over priced

[110010001000]

You are right. People will never trust "BuggiCorp" again. And he can't change his handle, it is on his passport and his Mom would be upset too. Thanks for the tip.

Re:Its not over priced

[Falos]

Offering a $100 water bottle to someone dying in the desert is overpriced. You people are deliberately spreading this bullshit about "There's no such thing as 'overpriced' we can charge anything for anything".

Using the imaginary property racket to monopolize a $500 pill is overpriced. Oops, someone found a functional reprint and is giving it away, now your angry shareholders are gonna have you black bagged.

Re:Its not over priced

[sshir]

I'm not economist, but still, I think you are wrong. By saying "$100 water bottle to someone dying in the desert" you are intentionally conflating water's utility in that particular situation with water's _marginal_ utility and cost. Who knows how that particular bottle ended up in the desert, might be that the seller is dying from thirst himself, etc.
BTW, marginal utility (and marginal cost) of that vulnerability is exactly zero. Do you expect getting it for free?

And $500 pill might be an abuse of monopoly position, and might not be (e.g. massive R&D with small number of cases). And while government gives copyright protection it also has the power to rein on monopoly abuses. Blame your slow or corrupt or incompetent government for not slapping pharma's hand. Again - granted monopoly comes with price controls - pharma might self regulate if they wish but don't have to (they have shareholders to feed, risky R&D investments to make, etc).

It is worth what somebody will pay for it

[thue]

> While security experts think the zero-day may be overpriced, they think the hacker will find a buyer regardless.

If they think there is a buyer who will pay $90,000 for it, then it is per definition not overpriced.

Re:It is worth what somebody will pay for it

[Anonymous Coward]

I got Windows 10, including all its vulnerabilities, for free. No way is anyone paying $90K for just one of them.

Re:It is worth what somebody will pay for it

[Dr_Barnowl]

Learning Linux is like learning to drive a stick shift.

A few more skills, in exchange for more efficiency and better performance.

Re:It is worth what somebody will pay for it

[jo7hs2]

Actually, EPA mileage estimates usually come out slightly *higher* for automatics now. Just saying.

Re:It is worth what somebody will pay for it

[Opportunist]

The problem is, most of the Joe Randomusers out there use their computer primarily as a toy.

What Joe wants is to look at his Facebook, read his mail, chat with friends and play some games. And that's it. Yes, we up here in our beautiful ivory tower, we might have some lofty ideas what our computers should or should not do, but that matters little to the 99% of Joes out there. They don't care about spyware in their OS. They don't care about only being allowed to install software from the walled garden (because that's all THEY want). And they don't give a shit that we rant and rave against it.

And neither do hardware makers. They care about sales numbers. If that means to offer locked down hardware that is to the liking of governments and corporations, they will offer locked down hardware. Not because they are "evil", because they hate free speech or because they don't want us to actually own the machines we pay for, but simply because that means more sales.

So yes, if you want freedom, you have to cater to that Joe out there who wants to play with his toys. Because we are few and the Joes are many. So we need those Joes that want their toys in our boat to get the hardware (and software) makers to do what we want.

Re:It is worth what somebody will pay for it

[clarkn0va]

And if Microsoft themselves do not attempt to buy it, then they've shown how much they value their own product. Or the customer base. Or security in general.

Of course, we knew the latter already...

While I agree that MS cares nothing for security or their customers so long as they retain the ability to take people's money, there are good reasons for them not to pay this ransom. To do so would be to promote this type of black hat activity, and they have no substantial assurance that they will get what they paid for.

Not overpriced at $90K

[xxxJonBoyxxx]

>> While security experts think the ($90K) zero-day may be overpriced

As a security expert and occasional entrepreneur, let me tell you why this isn't overpriced. Let's say you could deliver 10,000 phishing emails that lead to installation of $70/unlock ransomware screens, of which 50% of victims usually pay. That's $350K of revenue, minus costs of the initial phishing campaign ($5K-ish), bitcoin exchange fees (maybe $10K) and the $90K for your zero day. That leaves a profit of about $250K - not bad for a few days of work.

Re:ALL Windows versions?

[Phydeaux]

Win 3.11 was an operating environment, so technically not the Win 3.x family. The real question is, will it work on WinME, because even officially authorized software was unable to work with it...

priv esc

[Robert Goatse]

So it's a privilege escalator not necessarily an exploit to initially get into a host. For a 'real' Windows exploit, 90K is super-duper cheap, but for something like this 90K may be a tad overpriced for what you get.

Pfffft

[JustAnotherOldGuy]

That's nothing. I've got a zero-day bug called "Norton Anti-Virus" that pwns all versions of Windows and it's only $49.99.