$36k Google App Engine RCE

Re:$36k Google App Engine RCE by tptacek on Tuesday May 22, 2018 @07:07AM (#17125063)

Also, if you look at the Zerodium payout chart --- again, I'm skeptical of it, but not of this observation --- you'll notice the serverside RCE stuff is at the bottom of the rate sheet. What buyers really want are clients, not servers. This despite the fact that clients are more efficiently patched than servers (the software targets that command the highest payouts are all auto-updated).

[ Parent | on HN ]

Re:$36k Google App Engine RCE by alexeldeib on Tuesday May 22, 2018 @01:49PM (#17127927)

This also seems backwards to me? If you can get RCE or privilege escalation on a server, isn't that much worse? Or is it the difference in purpose between targets/adversaries? E.g., a server side vulnerability maybe you get to dump a companies records but something like no-click jailbreak + a high value individual => all their personal information?

Or else, why do buyers want clients?

[ Parent | on HN ]

Re:$36k Google App Engine RCE by tptacek on Tuesday May 22, 2018 @02:44PM (#17128380)

It should now be starting to click that the extant markets for vulnerabilities don't value "severity" (or any other abstract scale message board nerds want to apply to vulnerabilities), but merely utility.

The hypothesis I like to come back to --- I'm pretty sure it's true --- is that vulnerabilities have value on the black market only if they fit into an existing business model, such that they can be dropped in and immediately be used to make money. People have to already be using some other vulnerability to do the exact same thing, and reliably making money with it.

People on HN like to tell stories about how a master criminal could make money with everything from Facebook CSRFs to serverside RCEs. But none of those kinds of exploits support current ongoing business concerns; they're all one-of-a-kind. Nobody buys a vulnerability speculatively to see if they might make a go of it --- they especially don't do that for a vulnerability that could be extinguished universally in moments by Google or Facebook's security team.

[ Parent | on HN ]

Re:$36k Google App Engine RCE by alexeldeib on Tuesday May 22, 2018 @05:15PM (#17129474)

Aren't we seeing lots instances of the server-side model playing out? e.g., Company XYZ announces they've been breached and leaked XXX million user's data?

I could see an argument here towards the market price of the information -- breaching a company in the above scenario might get you zilch. Breaking an iOS device of an individual of interest gets you a lot of value.

Circling back though -- you're saying that this model isn't one in use. Do you agree with my real-life counterpoint? If so, why wouldn't there be a market? Or, is the market there and the low payouts from the likes of Zerodium reflect the actual low value of the product (and by extension, business model)?

[ Parent | on HN ]

Re:$36k Google App Engine RCE by tptacek on Tuesday May 22, 2018 @05:37PM (#17129623)

There isn't a "low" payout on Zerodium for these bugs; there is no payout for them. Zerodium explicitly will not buy bugs in individual websites. Every vulnerability Zerodium will buy has a half-life.

[ Parent | on HN ]