Meet the Hackers Who Get Rich Selling Spies Zero-Day Exploits 158
Sparrowvsrevolution writes "Forbes profiles Vupen, a French security firm that openly sells secret software exploits to spies and government agencies. Its customers pay a $100,000 annual fee simply for the privilege of paying extra fees for the exploits that Vupen's hackers develop, which the company says can penetrate every major browser, as well as other targets like iOS, Android, Adobe Reader and Microsoft Word. Those individual fees often cost much more than that six-figure subscription, and Vupen sells them non-exclusively to play its customers off each other in an espionage arms race. The company's CEO, Chaouki Bekrar, says Vupen only sells to NATO governments and 'NATO partners' but he admits 'if you sell weapons to someone, there's no way to ensure that they won't sell to another agency.'"
Damn... (Score:5, Funny)
The question is...how do "I" get into that??!?
Hacking stuff, and protected by 'NATO' government paying you handsomely for the 'service'.
sweet...
Re:Damn... (Score:5, Insightful)
The question is...how do "I" get into that??!?
1. Write any sufficiently large piece of C++ code
2. Wait
3. Get rooted by the black hats
4. Find out which trivially-detectable-if-you'd-used-a-decent-language error the black hats found in your code and sell it to NATO
5. Profit!
Re: (Score:3, Insightful)
Because we all know that programs written in interpreted languages never have bugs nor do their VMs or interpreters.
Re: (Score:3)
True, but it's harder to cut yourself with a pair of safety scissors than it is a machete.
Re:Damn... (Score:4, Insightful)
What's next ? My dog ate my boundary checking ?
Seriously, blaming the language for the coding bug is one of the lamest things I've ever heard. Bugs (exploitable or not) will be found on any sufficiently large piece of code, written in any language. Heck, there were 1 or 2 cases of bugs introduced by the compiler.
The real problem is that companies need to get the software out "fast". It is cheaper for the company to fix the code after it is released and payed for, and to keep developing out of it own pockets. It is that simple.
Re: (Score:2)
It is not a matter of cheap vs expensive. It is "cheapER". It is always comparative. That's free market for you.
What needs to change is the BUYING process. People would need to stop buying cheaper solutions. Yeah. For my next trick, I'm going to teleport myself to the moon and back.
Re: (Score:3, Informative)
Ugh.
securityfocus.com
select vendor microsoft .net
framework
whatever version you use
there's about a dozen vulnerabilities in version 4.0 alone, including this one overrunning an array
http://www.securityfocus.com/bid/48212/discuss [securityfocus.com]
Shithead fanboy. Understand the tools you use. Marketing theory is not implementation reality.
Yes, they've been found. Yes, they're open. And your question reveals absolutely horrific ignorance and shows that you've drank the kool-aid instead of doing some research.
Next time you c
Re: (Score:2)
There have been exploits in the past, but they have been fixed. Also, Java and flash are the most common because those are the main languages that run as plugins in your browser. Of course that's where everyone is going to look for these problems. It wouldn't be a big deal to find a similar bug in PHP or Python, because
Re: (Score:3)
There is only one way to know whether or not what you are saying is the truth: Did it involve a god function and a lot of gotos?
Re: (Score:2)
And all joking aside, I would add that supposedly they are still useful, even in good code.
Re: (Score:2)
'Erm' not to put ton fine a point on it but, management username password and an external log in are sufficient to get in on the act. Once in the world of organised crime, the simplest, most direct solutions are often the most effective.
So obtain access to and extract from, the holder of management user name and password and within the hour gain access to thousands of hours of cracking effort. You want to play you will always end up paying.
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
Not wasting your time posting on retarded news websites might be a good start
Re: (Score:1, Insightful)
Whereas you're clearly doing great things with your life.....
Re: (Score:1)
Whereas you're clearly doing great things with your life.....
Thanks AC. You've restored my "miserably failing" faith in the institution of AC posting by putting a smile right where it belongs: on my face!
Re: (Score:1)
What in God's name are you blathering about?
I'm not scared... (Score:5, Funny)
Re: (Score:1)
I keep seeing this, lolloplexing, scrolling down to read more... scrolling up, MORE lol; you gave the gift that keeps on giving.
Re: (Score:2)
Yes, but the extra 5 minutes it takes to copy a small text file from one location of your SATA-3 SSD to another is a bit of a deal breaker.
The war of the future (Score:1)
So basically... (Score:5, Funny)
Step 2. Sell digital goods that can be used by sovereign powers to wage war on each other to both sides.
Step 3. ???
Step 4. Profi--Error: Connection reset by peer
Thieves among thieves (Score:5, Insightful)
Oh, they only sell to NATO, right? You know, you can TRY to lie to us, but in the end, lying to the CIA is the same as lying to yourself. They know you sell to Iran, China, and every other regime out there.
You're on a shady enough business not to sell to the best offer.
Re: (Score:2, Insightful)
Even if they do only sell to NATO, NATO governments haven't exactly had a stellar history of respecting human rights in the past decade.
Re: (Score:3)
Even if they do only sell to NATO, NATO governments haven't exactly had a stellar history of respecting human rights in the past decade.
What government respects human rights?
If they don't sell their exploit to NATO who should they sell them to? The FBI?
Re: (Score:2)
What government respects human rights?
If they don't sell their exploit to NATO who should they sell them to? The FBI?
The FBI is part of NATO - it is an organization owned by the US government - which is part of NATO. The FBI is not an "alternative". North Korea, China, Al quaeda and organized crime are all "alternatives" to NATO though. The only ones to purchase such stuff are criminals and governments with enemies...
If they are only selling it to NATO governments and the FBI and US government are part of NATO then what is the problem? Isn't that what all the other contractors are doing anyway?
Re: (Score:3)
Even if they do only sell to NATO, NATO governments haven't exactly had a stellar history of respecting human rights in the past decade.
Compared to who? I'm pretty sure NATO collectively ranks at the very top of human rights respect on this planet.
Re:Thieves among thieves (Score:4, Insightful)
Compared to who? I'm pretty sure NATO collectively ranks at the very top of human rights respect on this planet.
Well put. Furthermore, Harold Shipman is my choice of Serial Killer of the Year, as he only ended the lives of the elderly and infirm, and in a humane fashion.
Re: (Score:2)
Well put. Furthermore, Harold Shipman is my choice of Serial Killer of the Year, as he only ended the lives of the elderly and infirm, and in a humane fashion.
And he is abominable as compared to the billions of people that don't murder anyone at all.
Re: (Score:2)
Well, compared to... pretty much everyone.
Every single NATO-organized operation has not only been a significant failure, but human rights violations have been atrocious. This is more true with the smaller operations involving soldiers from non-Western countries in other non-Western countries. Complete... cluster... fuck.
Re: (Score:1)
Of course they sell to Iran, China, et al.. And the CIA and MI5 *help* them with the code they write, especially the code they sell to others. Backdoors in the backdoors.
Re: (Score:2)
NATO, and out of the back of a white van, to people whose accents place them from various countries on the 'Naughty List.'
Kind of shady? (Score:5, Insightful)
Re:Kind of shady? (Score:5, Funny)
Your post is so cute. You actually think they care.
Re: (Score:3)
No, he'd rather post thought-out analysis of legal and possibly ethical implications of said company's business.that happens to take the snarky cynical form that you so wittily grasped
Re: (Score:1)
There are also laws against doing things like shooting an unarmed person in the head, aka assassination, but if a soldier hears his superior yell "fire", he shoots, no questions asked. In theory, the govt. abides by its own laws, in practice, 'national security' trumps all laws, and even the courts have agreed, allowing the govt. to withhold evidence on the basis of national security. Govt: "He's guilty!" Judge: "why?" Govt: "We'd like to tell you why, but that harms national security." Judge: "oh, oka
Re:Kind of shady? (Score:5, Insightful)
if a soldier hears his superior yell "fire", he shoots, no questions asked.
As a soldier, I can only note your lack of insight in how the military works.
Re: (Score:2)
Re:Kind of shady? (Score:5, Informative)
At least with regards to the US Military. I don't know about other countries.
you are only required to follow lawful orders (Score:4, Insightful)
Re: (Score:3)
Re: (Score:2)
Possible, but what protects me from the bullet in the officer's gun?
Re:Kind of shady? (Score:5, Informative)
Summary executions by officers for anything are of extremely doubtful legality today, at least in the US. If an officer simply executed you for some cause and expected that to hold, he would face a guaranteed court-martial. If he tried to pretend that he merely apprehended you and you "escaped", there would still be an investigation at the very least. Unless the whole unit was on the side of the officer, it is unlikely that an officer would get away with it.
As far as "friendly fire" incidents... those are always possible, but the shooter could still get found out.
In short, if you turned the officer in for an offense that they might get execution, or life, or 20 years for, you may want to watch your back. Otherwise, no one is going to shoot you unless they are also unbalanced. In which case, you're pretty fucked anyway.
That said, while it is actually required to refuse an unlawful order, you will still likely have to prove that at court-martial. So, you might well simply obey the officer ordering you to do something technically illegal, but petty. But, if he wants you to start shooting people, I'd suggest taking the court-martial.
Re: (Score:2)
An officer doesn't have to shoot you to kill you in a war. He can easily put you in a position where the enemy does that unpleasant work for him.
Re:Kind of shady? (Score:4, Insightful)
If you go by logic, committing the war crime is the logical conclusion.
Imagine you're ordered to shoot civilians, or having the option to get shot by your superior. What are your options?
1. Refusing. You're dead.
2. Shooting your superior. Chances for a trial: Almost certain. Chances for a conviction: Rather high.
3. Shooting the civilian. Chances for a trial: Almost zero, as long as every witness is an accomplice. Chances for conviction: Close to zero unless a reporter somehow finds out about it.
Re: (Score:2)
In fact, if you are given an unlawful order, you are, by military law, required to refuse to follow it and report it to the appropriate military authority.
What do you think actually happens when one does that?
Re: (Score:2)
If the officer thinks he can get away with it, you will be subjected to non-judicial punishment or he might just send you straight to a court martial. If he tries to punish you non-judicially, you have a right to insist on a court-martial. The fact that the order was unlawful is your defense. If it is proven, the officer will get dinged himself, based on what the order was.
If he doesn't think he can get away with it, he'll accept your refusal and move on.
Re: (Score:1)
Just do what the rednecks to, and use 'yer' - nobody questions 'yer'.
Re: (Score:2)
There are also laws against doing things like shooting an unarmed person in the head, aka assassination, but if a soldier hears his superior yell "fire", he shoots, no questions asked.
And that's precisely why I don't "support the troops" qua troops. Cyber or otherwise. If you aren't allowed to question orders to harm and kill, you're not allowed to be a free and ethical human being. Why are we (why are Republicans of all people!) still glorifying an institution which practices slavery in the 21st century?
Re: (Score:2)
Re: (Score:2)
Silly citizen, gov't agents are above the law.
Re:Kind of shady? (Score:5, Insightful)
even government agencies were obliged not to break laws.
Unless we're at war.
We're always at war.
Re: (Score:2)
This is the problem with the "war or terror". There is no end, the US government will never be able to declare a victory over this enemy. This plays right into their grand scheme of things, they have a free pass to do whatever they want anywhere in the world and the perfect terrorist attack to justify it.
This is why you will never see a real investigation into the events of September 11th, if there were ever any highly publicized cracks in the story of what happened that day it would bri
Re: (Score:2)
even government agencies were obliged not to break laws.
Unless we're at war.
We're always at war.
We've always been at war.
Re: (Score:2)
How do you prove it?
Re: (Score:1)
Who said anything about hacking into someone else's computer? Discovering exploits is not a crime.
Re: (Score:1)
Are they not in some sense selling knowledge? Since when is that illegal? (State secrets and whatnot aside).
I don't agree with it, but I'm just saying.
Re: (Score:2)
Re: (Score:2)
I mean, aren't there laws against doing things like hacking into computers you don't own? Isn't this aiding in a crime? The last time I checked, even government agencies were obliged not to break laws.
Government agencies don't believe in any laws besides the law of might. If they want to do it they do it just as long as they have the force to get away with it.
Re: (Score:2)
I mean, aren't there laws against doing things like hacking into computers you don't own? Isn't this aiding in a crime? The last time I checked, even government agencies were obliged not to break laws.
You've got it all wrong. I'm sure they hack into their own computers, nothing illegal there. Then they sell the knowledge of these exploits to their customers in order to protect them from these weaknesses. Now, if someone in one of those agencies "goes against policy" and uses these exploits against someone else, how is it their fault?
Re: (Score:2)
Re: (Score:1)
Spies act outside of legality. You think it was legal for french agents to place bombs inside the rainbow warrior in new zeland ?
Sure it was! It was a warrior right? That means it was a warship!
If you don't agree with this, the hippies... Er.... I mean... terrorists win!
Re:Kind of shady? (Score:4, Informative)
Espionage agencies are lawfully chartered. The activities they undertake in other countries are usually illegal in those countries, but so what, you do it to us, we do it to you, when you catch one of ours, we catch one of yours, trade, and back to business.
In the case of the french bombing a ship in new zealand that was illegal, even though New Zealand would be a "NATO Partner" in the parlance of TFA. Two of the agents were caught, and charged.
Of course had they got back to france (like the rest of the team) likely nothing would have happened to them, although with a more valuable ally like the UK that may not hold true. Countries act in their own interests, and if they're smart they are under no illusion about having any friends.
The reason people still remember the rainbow warrior incident is because it was a major scandal in france, and might not even have been legal in france. Depends on the agreements they had with New Zealand.
Re: (Score:2)
Espionage agencies are lawfully chartered. The activities they undertake in other countries are usually illegal in those countries, but so what, you do it to us, we do it to you, when you catch one of ours, we catch one of yours, trade, and back to business.
In the case of the french bombing a ship in new zealand that was illegal, even though New Zealand would be a "NATO Partner" in the parlance of TFA. Two of the agents were caught, and charged.
Of course had they got back to france (like the rest of the team) likely nothing would have happened to them, although with a more valuable ally like the UK that may not hold true. Countries act in their own interests, and if they're smart they are under no illusion about having any friends.
The reason people still remember the rainbow warrior incident is because it was a major scandal in france, and might not even have been legal in france. Depends on the agreements they had with New Zealand.
You're forgetting that spies don't get "traded', officers get traded back and forth and only the officers with official cover. Officers are spy handlers, the spies are the people who if caught get killed.
Re: (Score:2)
You're forgetting that spies don't get "traded', officers get traded back and forth and only the officers with official cover. Officers are spy handlers, the spies are the people who if caught get killed.
Yup! Just like Anna Chapman! Oh, wait...she got on the cover of Maxim magazine after being sent home instead...
Re: (Score:2)
Re: (Score:2)
Nonsense. More than 50% of ELF is made up of intelligence agents, trying to stir up some business.
It's not illegal... (Score:1, Redundant)
... if the government (or a private firm working for the government) does it.
Please remember this the next time a cop kicks you in the face.
Exploit to exploit (Score:5, Insightful)
Wow. That puts huge incentive on planting moles in projects with wide distribution simply for the aim of writing exploitable code.
Re: (Score:2)
Wow. That puts huge incentive on planting moles in projects with wide distribution simply for the aim of writing exploitable code.
Agencies probably already do that to save money having to pay these guys.
Re: (Score:3)
That is what I have been wondering.
How many open source projects / commercial products are compromised by 3 letter agency insiders? Yeah we can 'look at the source' for some software but I have no pretenses on most anyone being able to find a backdoor left in by the best of the best that MIT / NSA etc have to offer. And with an unlimited budget to boot...
I know if I was in charge id just make sure to get my code into Flash installers, Webkit, MS Office, and a few of the most popular linux packages and call
The true faith of an armorer (Score:5, Insightful)
"To give arms to all men who offer an honest price for them, without respect of persons or principles: to aristocrat and republican, to Nihilist and Tsar, to Capitalist and Socialist, to Protestant and Catholic, to burglar and policeman, to black man white man and yellow man, to all sorts and conditions, all nationalities, all faiths, all follies, all causes and all crimes." - Undershaft
Re:The true faith of an armorer (Score:4, Informative)
Scope of Work (Score:2)
violation of the DMCA? (Score:2, Redundant)
Re: (Score:1)
They're a French company...
Re: (Score:3)
Re: (Score:2)
No.
Re: (Score:1)
I hope their physical security is top notch (Score:3, Insightful)
And not just for their offices, but for their homes and the homes, schools and offices of their families, friends and anyone else they might care about.
It strikes me that these are people you don't want to try to play around with and that some might try to influence you to give a better deal to their side than another side, perhaps using things like pictures of your kids walking to school or your wife gardening.
Yeah but thats where the money is. (Score:2)
And not just for their offices, but for their homes and the homes, schools and offices of their families, friends and anyone else they might care about.
It strikes me that these are people you don't want to try to play around with and that some might try to influence you to give a better deal to their side than another side, perhaps using things like pictures of your kids walking to school or your wife gardening.
There is no easy way for hackers to make money. You'll have to sell to the spies or you don't make money at all because the spies are the ones with the money to pay for security researchers.
As far as them trying to influence for a better deal or exclusive deal this much is obvious.
Re: (Score:1)
Why is this modded redundant? I am in ITSec yet am valued more for my knowledge about physical security and it's deep implications. Go ahead go take a look at a light primer: Locks, Safes, and Security by Marc Weber Tobias; then come back and say it is redundant.
Re: (Score:3)
Why is this modded redundant? I am in ITSec yet am valued more for my knowledge about physical security and it's deep implications. Go ahead go take a look at a light primer: Locks, Safes, and Security by Marc Weber Tobias; then come back and say it is redundant.
But if you know about physical security then you know in most workplaces it barely exists. You've got to secure the entire electromagnetic spectrum, worry about biological attacks, chemical attacks, psychological, and social engineering attacks on top of the technical exploits, lock picking, etc.
These individuals in this company wouldn't be in the business they are in if they didn't have physical security of some sort. They have as little physical security as everyone else has, but perhaps they are aware of
From the desk of Zorg (Score:1)
"'if you sell weapons to someone, there's no way to ensure that they won't sell to another agency.'""
Or worse!
Zorg: I hate warriors, too narrow-minded. I'll tell you what I do like though: a killer, a dyed-in-the-wool killer. Cold blooded, clean, methodical and thorough. Now a real killer, when he picked up the ZF-1, would've immediately asked about the little red button on the bottom of the gun.
[Scene shifts to Aknot, who is staring in confusion at the little red button. He shrugs and pushes it]
Zorg: [Casu
But my orgies! (Score:1)
the company says can penetrate every major browser, as well as other targets like iOS, Android, Adobe Reader and Microsoft Word.
NUUU not my slash!fic!! No touching my pr0n!
Oh wait, Microsoft Word required my first-born for payment, so I downloaded OpenOffice. Not on the list, MY PR0N IS SAFE.
Re: (Score:3)
You have porn on Microsoft Word? Wouldn't LaTeX be safer? Just don't use a petroleum-based editor.
whom are they using these exploits against? (Score:1)
Re: (Score:2)
Oh, so it's allright if I use it?
Care to share your IP address?
Perspective:Inside Cisco's eavesdropping apparatus (Score:1)
Perspective: Inside Cisco's eavesdropping apparatus
By Declan McCullagh | April 21, 2003 4:00 AM PDT
- http://news.cnet.com/2010-1071-997528.html?tag=fd_nc_1 [cnet.com]
"Cisco Systems has created a more efficient and targeted way for police and intelligence agencies to eavesdrop on people whose Internet service provider uses their company's routers.
The company recently published a proposal that describes how it plans to embed "lawful interception" capability into its products. Among the highlights: Eavesdropping "must be
Can't Help But Wonder... (Score:1)
$100,000 is not rich. (Score:2)
I admit it's good enough for one security researcher, or maybe 1.5, but it's not rich.
If we are talking about millions of dollars then we are talking rich.
Re: (Score:2)
100k per customer. Multiply by x, with x being everyone and anyone willing and able to join the cyber arms race.
Plus, those 100k are the admission ticket, not the ride fee. Actually getting informed about an exploit and how it works costs extra, and then you WISH it was just 100k...
Re: (Score:2)
100k per customer. Multiply by x, with x being everyone and anyone willing and able to join the cyber arms race.
Plus, those 100k are the admission ticket, not the ride fee. Actually getting informed about an exploit and how it works costs extra, and then you WISH it was just 100k...
If it's profitable to do things this way then this might be the beginning of a new industry.
Re:$100,000 is not rich. (Score:4, Informative)
That's just the membership fee. How much is the actual product?
Just a reminder (Score:4, Insightful)
When you're extorting, don't get greedy. At some point it's cheaper to just get rid of you than to pay you.
Re: (Score:3)
When you're extorting, don't get greedy. At some point it's cheaper to just get rid of you than to pay you.
So who is going to do the getting rid of? Google?
Also it's not extortion. Bug testing is Googles job not ours. Finally you have all these agencies that want to buy exploits so it's more like weapons trading but thats basically what the defense industry does anyway. I don't see how this would be extortion but selling missiles to a NATO country isn't?
There are companies in the U.S. doing this! (Score:3, Informative)
Check out this company: Siege Technologies (http://www.siegetechnologies.com/). I had never heard of them before and have no idea how big they are. But they openly advertise that they have a "Vulnerability Discovery Incentive Plan" in their benefit package (http://www.siegetechnologies.com/careers).
They claim to do work for private companies and the U.S. government. They advertise a "Five year contract awarded to provide DoD with training material on Offensive/Defensive Windows Kernel Security and Development" and are advertising for jobs looking for Reverse Engineers.
France, huh? (Score:2)
Figures, they're surrendering before it even becomes an issue.
Re: (Score:2)
You make plenty of good points. You need to be modded up.
Re: (Score:2)
Nonsense. Steve Ballmer had unilaterally decided that the .Net languages are far too safe (gotta give the Security Services division something to do / the increased revenue should help prop up that stock price...), and has decided that mandating C++ development is the way to go.