I believe you. How are those bugs monetized by the buyers?

They generally enable AT LEAST full MITM access, so ad hijacking and espionage.

If you could hijack cookies you could run a ransom scheme. You take control of someone's email or some other equally important social service and then you demand a ransom to release the account.

Just yesterday there was a topic like that in here: https://news.ycombinator.com/item?id=9949444

Your Netgear router can't break TLS. Google Mail and Facebook are designed to assume that your Netgear router is already evil.

Both true - but once you own someone's router, one could (hypothetically) social engineer the target into downloading an alternative SSL cert (like you would do yourself when setting up a debugging proxy for HTTPS traffic). As soon as they do that, it's all cleartext. I've been able to convince various (non-technical) house guests and (technical) coworkers to do this in the past, so I imagine it'd be possible on a wider scale.

Isn't Facebook pinned? Google is.

Obviously, if you can trick someone into running an EXE, it's game over, but that's true whether or not your router is owned up (95%+ of the Internet sites people visit can be used to stage this kind of phishing attack.)

Someone who knows more about organized crime than I do can tell me whether or not people actually harvest logins from compromised routers. CSRF RCE definitely belongs to the class of attacks that can be deployed en masse with very little effort, so it's at least sort of plausible.

Their certs may be pinned, but from what I can tell there's nothing keeping me from introducing a new root cert to my system (IIRC there was a scary popup and that's it).

Here's a screenshot of Chrome giving me the "insecure" padlock, but still rendering Facebook while I debug the HTTPS traffic: http://puu.sh/jdGhc/128d35f793.png

Here's similar, showing Google HTTPS traffic being debugged while browsing in Safari (with nothing appearing out of the ordinary): http://puu.sh/jdGoW/3163db1e54.png

(the debugging proxy is Cellist, which I find to be a suitable replacement for mitmproxy, as long as I don't need rewrite/replay)

> if you can trick someone into running an EXE, it's game over

I suppose it is roughly equivalent (i.e. if you could get them to download a cert, you could probably get them to download an EXE so the point may be moot). I always figured you might have more luck with this sort of thing if you owned a Starbucks router or something, where people might be more accepting of having to jump through hoops to use the internet.

Have you never executed a binary you downloaded over http? (Live) Patching backdoors into existing binaries is not exactly difficult.

So far I've only seen one attack like this in the wild, but you need to understand that these exploit vendors primarily sell for targeted attacks (usually by various government actors)

Of course not. But, like I said, if all you need is to pop up a convincing looking page that gets someone to download an executable, you don't need to pop a router to do it. There are hundreds of ad networks you can inject stuff into to accomplish this.

My point is that the compromised router isn't a usefully privileged position to launch this attack from. Whether or not you have the router, you're relying on sending someone to a random convincing-looking web page. This is an "open redirect" level of difficulty, not an $80k RCE level.

> the compromised router isn't a usefully privileged position to launch this attack from.

I hadn't thought too deeply about it but you're absolutely right. Given the presence of encryption, the biggest advantage you can get from owning the router is being able to phish the user from a site they might normally trust but isn't encrypted (a group of sites that is, thankfully, getting smaller every day).

Key is that you don't need to phish, you can just wait until the user downloads an unencrypted executable.

A bunch of software and devices assumes (or can be configured to assume) anything on the local LAN is safe and can be trusted. So routers seem like a good place to look for unsecured file shares, security cameras, printers and whatever else is on that LAN. I have strong doubts most network protocols are properly secured against eavesdropping or MITM in a LAN either.

This is like the 'nickpsecurity comment downthread. The problem with it is, people don't buy vulnerabilities the way they buy power tools; they don't think of all the different things they might do with them. People who buy vulnerabilities (a) have a very specific thing they plan on doing with that bug and (b) plan on doing it in exactly the same way to a large number of targets.

At the point where you're futzing around on someone's LAN looking for unsecured file shares --- something that perhaps 1 in 20 people actually have in 2015 (file shares at all, I mean) --- you're breaking both of those criteria.

Attacks I heard of were MITM on vulnerable services, network monitoring to enumerate other attacks, malicious DNS activity, proxies, DDOS attacks, and shutdowns if it's eCommerce. Could be more. These are the one's I've seen happen or read in reporting on the subject.

You are suggesting here that someone might pay $80,000 for a Netgear RCE to help them run DDOS attacks?

No, Im suggesting that's one use of router compromises. Already told you that $80k is asking price, not selling price, for its likely application: cyberespionage. It will play a support role for beginning or maintaining attackers' presence in network.