Slashdot Log In
$16,000 Bounty for Sendmail, Apache Zero-Day Flaws
Posted by
Zonk
on Fri May 18, 2007 02:05 PM
from the step-right-up-rilly-big-shew dept.
from the step-right-up-rilly-big-shew dept.
Famestay writes "Verisign's iDefense is putting up a $16,000 prize for any hacker who can find a remotely exploitable vulnerability in six critical Internet infrastructure applications. The bounty is for a zero-day code execution hole on the following Internet infrastructure technologies: Apache httpd, Berkeley Internet Name Domain (BIND) daemon, Sendmail SMTP daemon, OpenSSH sshd, Microsoft Internet Information (IIS) Server and Microsoft Exchange Server. 'Immunity founder Dave Aitel, who also purchases flaws and exploits for use in the CANVAS pen testing tool, says its doubtful iDefense will get any submissions from hackers. "It's very hard to exploit [those listed applications]," Aitel said. "IIS 6 hasn't had a public remotely exploitable bug in it. Ever." Several other hackers I spoke to had very much the same message, arguing that $16,000 can never equate to the amount of work/expertise required to find and exploit a hole in the six targeted technologies.'"
Related Stories
[+]
Mac Developer Mulls Zero-day Security Response 94 comments
1.6 Beta writes "Landon Fuller, the Mac programmer/Darwin developer behind the 'month of Apple fixes' project, plans to expand the initiative to roll out zero-day patches for issues that put Mac OS X users at risk of code execution attacks. The former engineer in Apple's BSD Technology Group has already shipped a fix for a nasty flaw in Java's GIF image decoder and hints an an auto-updating mechanism for the third-party patches. The article quotes him as saying, 'Perhaps [it could be] the Mac OS equivalent to ZERT,' referring to the Zero-day Emergency Response Team."
[+]
News: $25M Bounty Offered for Global Warming Fix 766 comments
SaDan writes "Richard Branson is offering $25M as a bounty for a fix to global warming. The person or organization that can devise a method to remove at least a billion tons of carbon dioxide a year from the atmosphere will be able to claim the bounty. There are a few catches, of course. There can't be any negative impact on the environment, and the payment will come in chunks. A 5 million dollar payout will be paid when the system is put into place with the remainder of the bounty to be paid after 10 years of continuous use."
[+]
MacBook Hacked In Contest Via Zero-Day Hole in Safari 156 comments
EMB Numbers writes "Shane Macaulay just won a MacBook as a prize for successfully hacking OS X at CanSecWest conference in Vancouver, BC. The hack was based on a Safari vulnerability found by Dai Zovi and written in about 9 hours. CanSecWest organizers actually had to relax the contest rules to make the hack possible, because initially nobody at the event could breach the computers under the original restrictions. 'Dai Zovi plans to apply for a $10,000 bug bounty TippingPoint announced on Thursday if a previously unknown Apple bug was used. "Shane can have the laptop, I want the money," Dai Zovi said in a telephone interview from New York. TippingPoint runs the Zero Day Initiative bug bounty program.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
start here! (Score:2, Interesting)
Re: (Score:2)
Username bill
Password gates
$16,000 (Score:5, Insightful)
Re:$16,000 (Score:5, Insightful)
arguing that $16,000 can never equate to the amount of work/expertise required to find and exploit a hole in the six targeted technologies. Clearly, the so called experts aren't aware of the multitudes of enterprising folks living outside the inflated Western wage spectrum. For someone a little more eastbound, that's a nice chunk of change.
Not only that, but I'm assuming that claiming the prize and the advertising that goes with it - advertising your skills, that is - is the more valuable part. I'm imagining that the type of person who could claim the prize is interested in doing this sort of thing anyway. The prize would be a nice cash reward and a fantastic thing to put on a resume.
Parent
Re: (Score:3, Funny)
It is remote, and it is foolproof.
I want the money.
-nB
The exploit is to take the admins family hostage, demanding whatever code you want to be run in exchange for the family's safety.
Since you are using a phone to control the admin it is a remote exploit.
Have a nice day.
Bidding war. (Score:3, Interesting)
Do you sell it to those guys for $16K
Re:Bidding war. (Score:5, Insightful)
Neither. You auction it off to the highest bidding spamgang. Or so I've heard.
Parent
Re:$16,000 (Score:4, Informative)
Parent
Re: (Score:3, Informative)
Must be nice.. I live in Pa and I'd love to have a extra $16k
hMMM (Score:3, Funny)
From the FA (Score:2)
So, it would be reasonable to assume that any development branch stuff including current CVS snapshot would be inadmissible.
Re: (Score:2)
No, but... (Score:4, Interesting)
Not to mention ability to convert O2 to CO2... (Score:5, Funny)
True
Parent
Re: (Score:3, Funny)
I didn't sign an NDA when i started working for the..... Oh high Vladmir, what are you doing he.....
Re:No, but... (Score:5, Funny)
Yeah, but pimpin' ain't easy.
Parent
IIS 6 (Score:5, Funny)
IIS 6 hasn't had a public remotely exploitable bug in it. Ever.
How can that be? IIS is crap! Slashdot tells me so!
Re:IIS 6 (Score:5, Funny)
Parent
Re: (Score:2, Interesting)
IIS6 is very good and new IIS7 is even better, also to note on all the 11 Suse dedicated servers i run i switched from Apache 2 to a lighter, less resource hoging alternative
Btw IIS6 has less unpatched vulnerabilities [secunia.com] than apache [secunia.com]
so there
Re:IIS 6 (Score:4, Interesting)
Parent
Re:IIS 6 (Score:5, Interesting)
Parent
Re: (Score:3, Informative)
"Microsoft Internet Information Services ASP Code Buffer Overflow"
http://secunia.com/advisories/21006/ [secunia.com]
Software:
- Microsoft Internet Information Services (IIS) 5.x
- Microsoft Internet Information Services (IIS) 6
Impact:
- System access
- Security Bypass
Where:
- From remote
"hasn't had a public remotely exploitable bug"? Ever? Yes, of course - ever
Re:IIS 6 (Score:5, Informative)
This is not a remotely exploitable bug. Nice try though.
Parent
Re: (Score:3, Interesting)
You're correct about the application cache not surviving config changes, though typically this shouldn't be an issue as cache is only for convenience: users won't feel the difference if there's a cache mi
Look at me, I'm a hacker (Score:5, Funny)
Re: (Score:3, Insightful)
Entrapment? (Score:5, Insightful)
Free money (Score:5, Interesting)
1. Leave subtle flaw in your code
2. Share information with distant acquaintance
3. Profit!
Already in real life. (Score:2, Informative)
Somewhere, I believe in one of Scott Adam's (the Dilbert creator) books he has a (purportedly) true story about a company where the testers were paid $100 per bug they found. According to him, the program was scrapped after a week, but not before quite a few expensive gifts went from testers to programmers.
It seemed like the an urban legend ala the Woz getting $100 for each chip he got off a board, but I've heard that that one is actually true, so maybe both are??
Yes, it's the fallacy of assuming the who
Re: (Score:3, Interesting)
Along a similar vein one of the companies I worked for had an idea for spurring innovation and lateral thinking. The program was
Re:Already in real life. (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
From Anton Chuvakin's Blog [blogspot.com]:
...most scary cyber-criminal of the future is not a spammer, a scammer, a phisher or a pharmer, and not even a good ole "cracker" - it is an unethical software engineer, who changes the code slightly to introduce a weakness (or a full-blown backdoor or a logic bomb) and later uses or sells this knowledge
Internet infrastructure technologies? (Score:2)
Since when are we using marketing speak here? Can we please call them programs or program systems?
maybe someone has already done the work (Score:3, Insightful)
Maybe there are people out there who already have more than one exploit for these and wouldn't mind trading one in for a legal source of quick cash. Who knows? 16k buys very a nice chunk of electronics for people who don't need the money for anything else.
Bragging All the Way to the Poor House (Score:3, Insightful)
Here are the terms of the challenge -
* The vulnerability must be remotely exploitable and must allow arbitrary code execution in a typical installation of one of the technologies listed above
Ok, so you pick some of the oldest and most robust technologies around - things that have had a LOT of the bugs worked out of them already and things are you're not that likely to have to pay out on.
* The vulnerability must exist in the latest version of the affected technology with all available patches and/or upgrades applied
* 'RC' (Release candidate), 'Beta', 'Technology Preview' and similar versions of the listed technologies are not included in this challenge
So you eliminate any upcoming versions, but you forget to exclude the previous versions....
* The vulnerability must be original and not previously disclosed to any party
So if I've already informed the software maker, it's out, further reducing the likelihood of any kind of a payment having to be made.
* The vulnerability cannot be caused by or require any additional third party software installed on the target system
Reasonable, but...and this is a big but....many things are quite secure on their own, but not so much so when you actually start using them. Prime example, Apache. Apache on it's own is fine. Install one of the open source PHP web apps and then see how secure it is. How many people run Apache serving up hand coded HTML?
* The vulnerability must not require any social engineering
This is because we all know that there is no patch for human stupidity...though I've never seen it admitted quite so blatantly.
PHOOEY ON YOUR CHALLENGE
It would take me a lot of man hours to come up with something, more to code an exploit for it and by the time I'm done...I'd be better off financially if I had worked at Wal-Mart for those hours. $16,000 divided by 4 (people on my team) = $4000 each. Let's say we spend 5 weeks on this. That's 200 hours each. That works out to having a chance to get $20/hr. And frankly, I think that 200 hours each is pretty optimistic. We're talking about pouring over their code base, becoming familiar with it, and looking for places that we can try to break it. That's in excess of 89,000 lines of code just for Apache and more than another 70,000 for Sendmail. Then we have to load it up, write some code to test the exploit, and run it to see if works. If it doesn't on the first try, it's rinse and repeat until we give up on that possible exploit and try a different one.
I'm guessing that this is more of a publicity stunt than anything else. Anyone in the industry should know better. This has to be something that the marketing poohbah's have dreamed up. Just more marketing hype so that they can say, "We're more secure than those other guys. We ran our challenge and we didn't get anything. These apps are safe to use."
2 cents,
Queen B.
Tried Google? (Score:3, Informative)
Re:Tried Google? (Score:4, Funny)
Just to narrow it down, I redid your search with quotes and found 67. But the first one's a blast. It goes to the "w4ck1ng" forum where the thread goes...
"Hello found this exploit: http://www.derkeiler.com/Mailing-Lis...5-04/0436....and the response goes:
"you can not use exe files under unix y0u have to compile it with GCC..."
I *think* IIS is safe from *this* guy...
Parent
Re: (Score:3, Informative)
Ok, now a clarification: the code [derkeiler.com] I think you meant to link to is not an exploit for IIS, it deletes the 1337 h4x0r's files. The exchange is a good way to run out the clock on a Friday, at least through:
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
If this had hit one of our servers, it wouldn't have worked because the "classic" ASP ISAPI handler is disabled by default, and that's how we leave it. And even if that were not true, you'd end up with the same privileges as the NETWORK SERVICE account, which on 2003 is basically useless. AND you still would need to have configured the roo
Heh (Score:2)
$16k? Peanuts... (Score:2)
If you're after fame, you report it through the proper channels (CERT or the vendor directly). You get credited in the bugfix, but gain no money at all.
Selling to one of these guys just goes into the pockets of these zero-day vendors, who then get more customers paying them $$$ to be a few days ahead of everyone else (but they'll get the patches at the same
Is that legal? (Score:3, Interesting)
Anyone can discover them, so it's plausible that two people can know the same flaw. So one party gets the flaw and gives the $16,000, then communicates the exploit to a third party who hacks in and gets trade secrets (or teh g0ld) and sells those, or whatever.
FYI (Score:5, Funny)
OpenSSH - A service you can install on a Unix system to enable remote admin access for known users.
Sendmail - A service you can install on a Unix system to enable remote admin access for complete strangers.
Hope this helps.....
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
BTW -- TFA says that IIS 6 hasn't had a single public remotely-exploitable hole. That means essentially nothing to me, because most serious 'hackers' aren't using public exploits.
Re:IIS and Exchange (Score:4, Insightful)
I think it does means a lot to many people when a piece of software has never had a publicly exploitable hole.
Parent
Alrighty Then (Score:3, Informative)
Re: (Score:3, Insightful)
The article summary itself states:
I laughed. From there...