Words Of War And Weakness: The Zero-Day Exploit Market

Remember the final battle scene in Star Wars: A New Hope? Remember how Luke Skywalker slotted a bomb from his X-Wing down the Death Star’s exhaust port to blow the spherical space-station apart? Well that port is much like a zero-day vulnerability, and the rebel force’s attack was a carefully constructed zero-day exploit.

Despite the Force being so strong in him, Darth Vader managed to commission a ship with a glaring flaw in it.  In the same way, developers often create, and proudly deliver, software covered in holes. When they are exploited, and attackers fire malware or some other nasty code through them, owners of that software can be blown apart too.

Intelligence on such weaknesses, and the tools needed to exploit them, now sell for considerable sums. That’s because of what can be achieved with zero-days. As seen with super-virus Stuxnet, which took advantage of four zero-day flaws, weaponised vulnerabilities can have a major real-world impact. In that case, the malware disrupted Iran’s uranium enrichment project by sending centrifuges potty. It was said to have set the process back by two years.

Governments of both east and west, and large private businesses, are thought to be spending vast portions of their budgets on acquiring zero-day exploits. Meanwhile, vendors and users of their wares never learn of them. It’s bad news for Internet security, many argue.

Regardless of their quarrels, a bustling market has emerged, and it is one that has caused ruptures in the security community.

The good old days?

Yet it’s a far cry from what researchers had hoped it would become. Back in 2002, industry experts felt Internet security was in desperate need of a shot in the arm. They thought the best way to get companies and software vendors interested in improving the security of their estates was to make vulnerability hunting a more prosperous activity. They started talking openly about a more formal approach to introducing market incentives for security flaws.

Just after the turn of the Millenium, Jean Camp from Harvard University and Catherine Wolfrom from Berkeley wrote a paper entitled ‘Pricing Security’. In it, they argued that the Internet and “the larger information infrastructure” was awash with easily exploitable flaws. “The only ubiquitous testing of Internet security is done by egocentric hackers,” they said.

Camp and Wolfrom argued that security should be viewed as an “externality”, where if one party is hit, another can be affected either positively or negatively, but without compensation. To counter this, they suggested looking at vulnerabilities as goods, items to be bought and sold. Those who discovered vulnerabilities would effectively own them.

The researchers had a vision of a credit system, where each Internet-connected machine would be given vulnerability credits by a government body. When a machine was compromised by known flaws, the owner of the machine would relinquish their credits, or pay out in cash if they had no credits left. Those who discovered vulnerabilities, whether exploited or not, could “demand  some form of payment or validation of credit ownership”. Perhaps because of the somewhat inchoate ideas put forward by Camp and Wolfrom, their vision never became a reality.

At what cost?

But start-ups did emerge in the early 2000s who did treat vulnerabilities as commodities. The most notable one was TippingPoint, which founded the Zero-Day Initiative (ZDI), a program that rewarded researchers for responsibly disclosing vulnerabilities, which were reported to vendors as soon as the flaw was validated. TippingPoint was subsequently bought by HP, but ZDI still operates today, as do many other bug bounty programmes, run by the likes of Google and Facebook.

They offer decent money – usually between $1,000 and $10,000 for each flaw found. Researchers get both monetary and reputational rewards, meaning they fill their pockets and bolster their CV for future consulting gigs.

Yet some believe they can and should make much more money from selling zero-days. Even back in 2002, this publication understands an iTunes vulnerability was sold for $13,000. But now much more is up for grabs.

On the one side, private firms are willing to pay significant fees because they want to gain an advantage over rivals, either by being better protected or by launching attacks themselves. On the other, governments want to buy in preparation for cyber warfare. Now they have seen the damage cyber tools can do, from Stuxnet to the super-sophisticated spy tool Flame, governments know what is at stake.

One industry insider, who preferred to remain anonymous, told TechWeekEurope a single zero-day can sell for anything between $5,000 and $500,000. Often, the higher-cost vulnerabilities can be bought as a package with the tools and services needed to exploit them, the insider added.

“It depends on the quality. They sell for what they are worth,” the source said. “The growing need, coupled with the shrinking availability and the time it takes to find and write, sets the price for exploits. Its just basic supply and demand.”

‘Security for the one percent’

Zero-day merchants take a variety of forms. Major government contractors such as Lockheed Martin, Harris Corporation, Northrop Grumman and Raytheon are thought to be involved, but a host of specialised firms have emerged over the last decade, including Netragard, Errata Security and Vupen. It is the latter group who have been involved in a vituperative war of words with Internet activists and the more vocal members of the security industry.

The main criticism of zero-day sellers is an obvious one. By not sharing their information with the wider community, a flaw is known to a select few, often government bodies and big businesses, whilst the majority go unprotected.

This lack of what is widely-known as “responsible disclosure” is what perturbs many. “It’s security for the one percent and it makes the rest of us less safe,” the Electronic Frontier Foundation said in an essay earlier this year. “These companies are basically selling burglary tools,” claims Professor Ross Anderson, of the University of Cambridge.

When Vupen decided not to tell Google about a zero-day in the Chrome browser, even though it claimed $60,000 in CanSecWest prize money for finding it, it became the bete noire of an industry that had already attracted a lot of bad publicity. Chrome users would be placed at risk, all because one company wanted to keep its handful of customers happy, onlookers moaned.

Even though he said he would only sell to NATO governments and partners, Chaouki Bekrar, CEO of Vupen, told Forbes magazine that he wouldn’t share the information with Google, even for $1 million. “We don’t want to give them any knowledge that can help them in fixing this zero-day exploit or other similar exploits. We want to keep this for our customers.”

Open source troubles?

But there may be an even more pernicious side-effect of the market’s growth. Anderson believes open source projects are now threatened by people wanting to profit from weaknesses.

Researchers are purposefully placing bugs in open source software during the development stages, so that when code appears in completed products,  those same researchers can highlight the flaws and profit from them where companies are willing to pay, Anderson has told TechWeekEurope. He claimed to know of several projects where this has happened, but declined to name names.