News for hackers. Stuff that matters.
Re:Windows Update Restored: Fix Windows Update on Windows 95... by hospitalJail on Friday July 07, 2023 @01:49PM (#36635543)
I hate windows, like I'm trying to get off it because of the ads/ragebait news. I hate edge. Microsoft is basically a never buy anymore, but according to this:

https://zerodium.com/program.html

Getting a Windows exploit is higher value than any linux exploit. Given how many servers use Linux, it makes me wonder if Linux 0 click are easier than windows.

There are a bunch of counters like 'there are too many distros', or 'a personal computer of a VIP is higher value than some corporations'. But I'm not sure its fair to include your point number 1.

I like to give people credit where its due, I imagine it took lots of work to make windows as secure as it is. (Giving Android OS the most credit for their 2.5M payout)

Re:Windows Update Restored: Fix Windows Update on Windows 95... by mnahkies on Friday July 07, 2023 @02:18PM (#36636057)
Linux servers generally aren't being used interactively though and expose a fairly limited attack surface to the internet, and so I feel like the value in Linux server exploits is more in the openssl/Apache/etc vulnerabilities
Re:Windows Update Restored: Fix Windows Update on Windows 95... by weare138 on Friday July 07, 2023 @02:40PM (#36636461)
Linux is the just kernel. Everything else in a distro is software running on top of it. Kernel bugs are generally hard to exploit remotely and typically have to be chained with other exploits. That's why there's so many specific payouts for common enterprise apps. Windows is a complete, highly integrated OS with a wide array of attack vectors baked right into it.

Plus sketchy companies like Zerodium major customers are nation-state actors who are primarily interested in data exfiltration and the application data stores themselves.

Re:Windows Update Restored: Fix Windows Update on Windows 95... by hospitalJail on Friday July 07, 2023 @04:18PM (#36637752)
>Kernel bugs are generally hard to exploit remotely and typically have to be chained with other exploits.

This is why its so valuable though.

Re:Windows Update Restored: Fix Windows Update on Windows 95... by unilynx on Friday July 07, 2023 @04:52PM (#36638143)
But what’s the point ? Most vulnerable Linux servers are hosting blogs or dns servers. They’re only useful to run a crypto miner or host a phishing page, and for that you probably don’t need to go further than exploit a wordpress bug. No need to go for the kernel or even root.

Whereas a desktop often has users on it who enter banking details or corporate login credentials. Much juicier targets.

Re:Windows Update Restored: Fix Windows Update on Windows 95... by toast0 on Friday July 07, 2023 @11:53PM (#36641214)
Can be a good DDoS source, lots of bandwidth often. Bonus if they can spoof packets, which needs root.
Re:Windows Update Restored: Fix Windows Update on Windows 95... by weare138 on Friday July 07, 2023 @05:09PM (#36638332)
The payouts are based on what their 'clients' are willing to pay in turn for the exploits. There's just less of a market for Linux kernel exploits. If nation-state actors are involved in deep APT style attacks where they would leverage low level kernel exploits they are going to either develop the exploits themselves or acquire them through their own clandestine channels. Purchasing that stuff from a publicly facing company that could potentially be compromised themselves is high risk and leaves too obvious of a trail.
Re:Windows Update Restored: Fix Windows Update on Windows 95... by MuffinFlavored on Friday July 07, 2023 @02:24PM (#36636174)
> I hate edge.

It's a thin wrapper around Blink just like Chrome/Chromium. What is there to "hate"?

Re:Windows Update Restored: Fix Windows Update on Windows 95... by WarOnPrivacy on Friday July 07, 2023 @02:32PM (#36636316)
> What is there to "hate"?

The endless fluff and clutter to clean up (Search bar appearing on desktop, sidebar foistware). The relentless marketing and push of adjacent services (Bing AI).

The passive-aggressive IE compatibility mode (unremovable nag banner to stop using IECM, your Legacy App URLs expire after 30 days for no good reason).

Re:Windows Update Restored: Fix Windows Update on Windows 95... by yjftsjthsd-h on Friday July 07, 2023 @03:31PM (#36637151)
Edge allegedly manages to be worse at privacy than Chrome: https://apple.slashdot.org/story/20/03/07/0054219/edge-brows...
Re:Windows Update Restored: Fix Windows Update on Windows 95... by hospitalJail on Friday July 07, 2023 @04:18PM (#36637743)
So many ads on the home page.

'turn it off'

I did. But its not intuitive, its some settings button that is semi-transparent. I literally had to google/bing it.

The inital setup was awful.

Then it opening all my links in edge was not okay. I'm signed in on firefox, I don't want things opening in edge.

I can't remember, I gave up after the whole BingGPT thing was a let down.

Re:Windows Update Restored: Fix Windows Update on Windows 95... by morpheuskafka on Friday July 07, 2023 @01:57PM (#36635668)
It's strange to me that Thunderbird is even on their chart. Surely only a few free software enthusiasts use that anymore? Most of the population doesn't even use a desktop email client and if they do its work-provided Outlook to connect to Exchange/Office365.
Re:Windows Update Restored: Fix Windows Update on Windows 95... by Dwedit on Friday July 07, 2023 @02:16PM (#36636030)
Desktop Email Clients are good for downloading all your Gmail before Google randomly decides to nuke your account.
Re:Windows Update Restored: Fix Windows Update on Windows 95... by delfinom on Friday July 07, 2023 @02:00PM (#36635717)
https://zerodium.com/faq.html

>Zerodium reviews, tests, validates, and documents all acquired vulnerability research then provides it to institutional clients as part of the

Zerodium only cares about shit their own customers want to target. They aren't trying to fund the entire world of software security.

Their customers in particular are select governments wanting exploits for their own use. You can sure as shit bet they already have specific targets in mind and what they use.

EDIT: For example, the forum software noted on Zerodium's list are popular for "blackhat" and "darkweb" forums from everything from card dump selling to malware. Many governments would love to get themselves a database dump with some user IPs. Conversely, this is why Discourse which is a major BB these days is missing as it's not popular in those circles.

Re:Windows Update Restored: Fix Windows Update on Windows 95... by laserdancepony on Friday July 07, 2023 @05:31PM (#36638614)
I'm sure 99% of the population does not use email personally anymore, except for delivery of their Amazon invoices.
Re:Windows Update Restored: Fix Windows Update on Windows 95... by bdavbdav on Friday July 07, 2023 @05:41PM (#36638690)
Yep. Receipts and notifications. It’s a bad means for communications.
Re:Windows Update Restored: Fix Windows Update on Windows 95... by Jiocus on Saturday July 08, 2023 @11:02AM (#36645059)
Two reasons I think Windows exploits would pay higher than 'Linux':

1. The Windows (end-)user base is much larger than Linux (not counting Android), so a Windows exploit enables more potential victims.

2. Windows has been the de-facto corporate OS for a long time, so a Windows exploit offers more high-value targets.