Forgot your password?
typodupeerror
Security Software The Almighty Buck

How To Go Broke Selling Zero-Day Exploits 66

Posted by Soulskill
from the supply-and-demand dept.
Trailrunner7 writes "Despite all of the hand-wringing and moral posturing about the public sale of security vulnerabilities, it turns out that not many people are buying or selling vulns, and the ones who are aren't making much money at it. A new survey of security researchers who sell vulnerabilities either publicly or in private, directed sales found that the vast majority of the flaws sell for less than $5,000. Almost none of them sell for much more than $10,000. At those prices, there's little chance that this is going to turn into the chaotic Wild West marketplace that some people predicted. It's a small, mostly controlled market that isn't making anyone rich."
This discussion has been archived. No new comments can be posted.

How To Go Broke Selling Zero-Day Exploits

Comments Filter:
  • by 5pp000 (873881) * on Friday May 21, 2010 @06:14PM (#32299928)

    It means that supply is keeping up with demand.

    • by 5pp000 (873881) *

      Whoops, never mind... didn't RTFA...

    • Re: (Score:2, Interesting)

      by zephvark (1812804)
      $5,000-$10,000 per exploit, tax-free? This seems like nothing to you? Man... I think you need to get out of your parents' basement more often. Start slowly, or you're going to wind up with an ear-to-ear grin in an alleyway, minus your iPhone and Nikes.
      • Re: (Score:3, Interesting)

        $5,000-$10,000 per exploit, tax-free? This seems like nothing to you?

        Depends how much work and time you had to put into it. You won't come up with a new 0-day every day ...

        • Re: (Score:1, Insightful)

          LOL@"ZOMG BUT U WONT MAKE 5K PER DAY!"

          Spend two months per 0-day and you are mediocre. Spend a month and you're pretty comfortable.
    • by wanax (46819)

      No, it means that in one of the few examples of a laissez-faire market in the modern world, Veblen [wikipedia.org] was right. No matter what the economic system, the main engine of expanding commerce, inventors, get fucked.

      (For those interested in original text, I would note that all his major works were published in the late period of the public domain, including The Theory of the Leisure class (pdf). [psu.edu]

  • by Dan East (318230) on Friday May 21, 2010 @06:14PM (#32299936) Homepage Journal

    I would think that the "companies" doing lucrative business selling exploits would not be voluntarily participating in a survey of this sort.

    • Re: (Score:3, Insightful)

      by michaelhood (667393)

      I would think that the "companies" doing lucrative business selling exploits would not be voluntarily participating in a survey of this sort.

      This "journalist" has never heard of selection bias, obviously.

  • Selling vulnerabilities == little money
    Selling fully functional botnet time == probably a lot more

    It's unfortunate, but I don't see it changing in the near future.
    • by Yuan-Lung (582630) on Friday May 21, 2010 @06:38PM (#32300206)
      "Selling vulnerabilities == little money"

      Are you sure about that?

      I know of a certain company in Redmond that sold vulnerabilities in bulk packages. They seem to be doing alright.
    • Re: (Score:1, Funny)

      by Anonymous Coward
      That's why they have to start selling exploits for MacOS. Most likely, those will be also overpriced, and with limited functionality that will require to spend more in libraries or "apps".

      Maybe they will come up with the idea of the "Exploit Store" and a similar business model :)
      • Exploits for the smartphones probably have the potential to be quite lucrative. According to a previous Slashdot article, botnets only sell for about five cents per node. You can make a lot more than that from a compromised phone. Set up a few hundred shell companies, and have each one set up a few premium rate telephone lines. Have each compromised iPhone call one of the lines for five seconds every few months. The phone company will round it up to the nearest minute for billing. Most people won't ch
    • by khasim (1285) <brandioch.conner@gmail.com> on Friday May 21, 2010 @07:10PM (#32300534)

      Turn the idea into a product, turn the product into money.

      Sell a service providing the customer with the FINAL (or as close to the final) product as possible.

      Use your zero-day exploit to build a zombie army and sell spam services.
      Or collected credit card info.
      Or bank account info.
      Or access to corporate networks.

      The do-it-yourself customer isn't going to spend a lot of money for something that he might not be able to verify.

    • by Anonymous Coward

      Maybe in the US it's not much money, but in eastern Europe and most of Southeast Asia, $5000 is a shitload of money. Some places, that's more than people make in a year.

      Maybe you think it's small change, but if you're living in some parts of southeast Asia, $5000 every 3-4 months feeds, clothes and houses your entire family.

  • by Anonymous Coward on Friday May 21, 2010 @06:18PM (#32299982)

    Right now there's no way to have much confidence that you're actually getting what you're paying for. If the exploit doesn't work, what recourse do you have? This is a pretty common element in any underworld economy, but is exacerbated by the Internet's anonymity and the newness/smallness of this particular market.

    The bad news is, other underworld markets eventually overcame this problem.

  • Developers (Score:3, Insightful)

    by Threni (635302) on Friday May 21, 2010 @06:19PM (#32299990)

    Probably companies buying exploits on their own apps - cheaper and more reliable than whatever pidgin-English speaking offshore muppets currently do QA/testing for them.

  • In the unlikely event I get a computer-killing virus, trojan, or exploit (hasn't happened since 1985), I figure I'll just trash the thing and buy another one for $300-400. Computers have become disposable just like other appliances.

  • But, but, it's an unregulated market!!! Evil, evil, evil!!! Soon there will be derivatives!!! And speculators!!! And high-frequency trading!!! The economies of nations will destroyed if this is not brought under government control now!!! (and taxed, of course)
  • by ShaunC (203807) on Friday May 21, 2010 @06:25PM (#32300060)

    ...are the ones who aren't selling the exploits they find.

  • by hAckz0r (989977) on Friday May 21, 2010 @06:28PM (#32300088)
    All the agencies/Governments that want that kind of information invest far more time, money, and energy doing the same thing, and they have all their own experts. In fact, the 'sellers' of this kind of information may be 'giving it away for free' and not even know they have been 'visited'. Why pay for what you can get for free?
  • Well, duh. (Score:5, Funny)

    by selven (1556643) on Friday May 21, 2010 @06:30PM (#32300108)

    Guy: Hi, I have a security vulnerability, I'll tell you the details for $10k.

    Software Company: Ok, show us the vulnerability.

    Guy: Ok, I'll come over and demonstrate on my computer.

    Software Company: Oh no, not on your computer, you could have set your computer up to be vulnerable. Do it to our computer, so we know you're not tricking us.

    Guy: Ok, fine (launches attack on company computer)

    Security Researcher A: Ok, the attack's coming in. Let's see what it's doing.

    Security Researcher B: Ok, looks like a buffer overflow in the third step of the authentication process. Let's go tell our developers.

    Guy: Guess what, it worked. Looks like I'm not tricking you after all. So, will you buy the vulnerability from me for the $10k we agreed on now?

    Guy: ...

    Guy: Guys?

    • Re:Well, duh. (Score:4, Insightful)

      by Vellmont (569020) on Friday May 21, 2010 @07:04PM (#32300472)

      I might not be the best idea to stiff someone who's highly skilled at finding security vulnerabilities in software. Especially if you ARE a software company.

    • by 1000101 (584896)
      This post is a perfect example why many developers who start their own businesses fail: The developer wants to prove, outright, that their work is valid. The businessman (whom the developer should have partnered with) will make the customer-to-be sign a contract before the tests were run prior to demonstrating to said customer.
      • by Vellmont (569020)

        You're assuming that people willing to buy and sell exploits, something at the very edge of legality and ethics, is going to obey a contract?

        These kind of relationships are enforced through fear, and the desire to maintain the relationship. Do you think drug dealers try to sue someone when a drug deal goes bad?

  • by ralphdaugherty (225648) <ralph@ee.net> on Friday May 21, 2010 @07:59PM (#32301016) Homepage

    $10,000 is a chunk of change in former Soviet Union. For that matter, it's a chunk of change for me too even being in the States but not as enriching as former USSR.

    In any event my understanding from info I read (mostly here on /.) is that the big money is made from herding botnets to sell time on for spam, phishing, etc. activities. The same people who put together these exploits in packages to sell are already using them to build gigantic botnets.

    I would not be surprised if they are able to tap into the botnets built with exploit packages they sell.

    FWIW, the range of IP addresses my web site has been targeted from for phpBB spamming is truly awesome, I haven't seen anything like it before in the eight years I've had the site up. Also the amount of money reported in news as stolen from bank accounts is staggering.

    I don't know what kind of happy talk article this is, but botnets are alive and well and thriving, and someone is getting rich at the expense of lots of victims who also unknowingly supply bots for the net. Whether $10,000 from an exploit package sale, or for a multi-billion spam run, or transferred out of a bank account, it adds up.

      rd

  • If the black hats share resources by selling one another exploits, or cloaking packages it just takes less work for the the white hats to patch the problem or break the cloak.

  • $10K might not be chump change, but it won't make anyone rich. Putting together botnets using said attacks and selling time on them is a much easier way to good money and requires less genius time And buying time on the botnets and using them for decent spam attacks probably makes the most money of all, for the least amount of genius time.
  • I heard IBM is giving them away free with a USB key in Australia

"Our reruns are better than theirs." -- Nick at Nite

Working...