Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Microsoft Operating Systems Windows Communications Network Networking Software The Almighty Buck The Internet Build Hardware Technology

Windows Zero-Day Affecting All OS Versions On Sale For $90,000 (softpedia.com) 187

Posted by BeauHD from the going-once-going-twice-sold dept.
An anonymous reader writes: "A hacker going by the handle BuggiCorp is selling a zero-day vulnerability affecting all Windows OS versions that can allow an attacker to elevate privileges for software processes to the highest level available in Windows, known as SYSTEM," writes Softpedia. The zero-day is up for sale on a Russian underground hacking forum, and is currently available for $90,000 -- after it was initially up for $95,000. The hacker is saying he'll sell the zero-day to one person only, who'll receive its source code and a working demo. Two videos are available, one showing the hacker exploit Windows 10 with the May 2016 security patch, and another one bypassing all EMET features. While security experts think the zero-day may be overpriced, they think the hacker will find a buyer regardless.
This discussion has been archived. No new comments can be posted.

Windows Zero-Day Affecting All OS Versions On Sale For $90,000 More

Windows Zero-Day Affecting All OS Versions On Sale For $90,000

Comments Filter:

  • Its not over priced (Score:3, Insightful)

    by Anonymous Coward on Wednesday June 01, 2016 @08:05AM (#52224665)

    if some one will pay it.

    • Re:Its not over priced (Score:5, Insightful)

      by Opportunist ( 166417 ) on Wednesday June 01, 2016 @09:55AM (#52225237)

      Isn't it heartwarming how quickly those Commies embraced Capitalism?

    • Re:Its not over priced (Score:5, Insightful)

      by Falos ( 2905315 ) on Wednesday June 01, 2016 @11:28AM (#52225869)
      Offering a $100 water bottle to someone dying in the desert is overpriced. You people are deliberately spreading this bullshit about "There's no such thing as 'overpriced' we can charge anything for anything".

      Using the imaginary property racket to monopolize a $500 pill is overpriced. Oops, someone found a functional reprint and is giving it away, now your angry shareholders are gonna have you black bagged.

      • Re:Its not over priced (Score:4, Insightful)

        by sshir ( 623215 ) on Wednesday June 01, 2016 @02:26PM (#52227593)
        I'm not economist, but still, I think you are wrong. By saying "$100 water bottle to someone dying in the desert" you are intentionally conflating water's utility in that particular situation with water's _marginal_ utility and cost. Who knows how that particular bottle ended up in the desert, might be that the seller is dying from thirst himself, etc.
        BTW, marginal utility (and marginal cost) of that vulnerability is exactly zero. Do you expect getting it for free?

        And $500 pill might be an abuse of monopoly position, and might not be (e.g. massive R&D with small number of cases). And while government gives copyright protection it also has the power to rein on monopoly abuses. Blame your slow or corrupt or incompetent government for not slapping pharma's hand. Again - granted monopoly comes with price controls - pharma might self regulate if they wish but don't have to (they have shareholders to feed, risky R&D investments to make, etc).

    • NSA. Homeland Security, and other goodguys (sic) will do a joint purchase

  • It is worth what somebody will pay for it (Score:5, Insightful)

    by thue ( 121682 ) on Wednesday June 01, 2016 @08:07AM (#52224677) Homepage

    > While security experts think the zero-day may be overpriced, they think the hacker will find a buyer regardless.

    If they think there is a buyer who will pay $90,000 for it, then it is per definition not overpriced.

    • Re:It is worth what somebody will pay for it (Score:5, Funny)

      by Anonymous Coward on Wednesday June 01, 2016 @08:14AM (#52224711)

      I got Windows 10, including all its vulnerabilities, for free. No way is anyone paying $90K for just one of them.

      • Re: (Score:1)

        by Anonymous Coward
        I just woke up one morning, and it was fucking there. I assume it was free, but I really don't know for sure. I just woke up the computer from sleep mode and there was Windows 10 staring back at me. On top of that, it had uninstalled 3 of my apps because it said they were not certified to work with Windows 10. It didn't even ask, it just nuked them. Luckily they were things that I almost never use, but that was wrong. Fuck Windows 10.

      • Timeo Danaos et dona ferentes

        And considering the gift mentioned in this quote was the Trojan Horse, I can't think of a better phrase describing how I feel about Windows 10.

        • Re: (Score:2)

          by HiThere ( 15173 )

          I'd like to say "that's Greek to me", but I know it's Latin...Virgil if I recall correctly.

    • They failed to sell it at $95,000, so that amount was overpriced. Since it hasn't sold yet (or at least, Slashdot hasn't reported its sale yet), whether $90,000 is overpriced remains to be seen.

    • While I agree with your sentiment - something being overpriced means "I wouldn't pay that much" Just because some "idiot" would pay that much doesn't mean it was a fair price.

      I suppose it depends upon how many bidders there are. If there are 20 people who might want to buy it - but only 1 buys it - then it might have been too high a price.

      Years ago a friend told me - when discussing setting prices for a tag sale - go on eBay to determine the value of something. It is like a commodities market and shows

      • Re: (Score:2)

        by b0bby ( 201198 )

        something being overpriced means "I wouldn't pay that much" Just because some "idiot" would pay that much doesn't mean it was a fair price.

        Well, that's the market - all you need is one "idiot" in this case. A "fair" price can be influenced by a lot of things, but a market price should be the highest price the market will bear.

        • Re: (Score:2)

          by bondsbw ( 888959 )

          In this case, due to supply vs. demand (where supply = 1) it is the same as literally the highest price anyone will pay for it.

    • Re: (Score:3, Interesting)

      by geekmux ( 1040042 )

      > While security experts think the zero-day may be overpriced, they think the hacker will find a buyer regardless.

      If they think there is a buyer who will pay $90,000 for it, then it is per definition not overpriced.

      And if Microsoft themselves do not attempt to buy it, then they've shown how much they value their own product. Or the customer base. Or security in general.

      Of course, we knew the latter already...

      • Re: (Score:2)

        by JcMorin ( 930466 )
        I tend to agree since the hacker said he will sold it only once, that seems to be a good deal for Microsoft.
      • They must be trying to figure out what the vulnerability is, or if it actually exist at all.

      • And if Microsoft themselves do not attempt to buy it, then they've shown how much they value their own product. Or the customer base. Or security in general.

        Of course, we knew the latter already...

        While I agree that MS cares nothing for security or their customers so long as they retain the ability to take people's money, there are good reasons for them not to pay this ransom. To do so would be to promote this type of black hat activity, and they have no substantial assurance that they will get what they paid for.

        • And if Microsoft themselves do not attempt to buy it, then they've shown how much they value their own product. Or the customer base. Or security in general.

          Of course, we knew the latter already...

          While I agree that MS cares nothing for security or their customers so long as they retain the ability to take people's money, there are good reasons for them not to pay this ransom. To do so would be to promote this type of black hat activity, and they have no substantial assurance that they will get what they paid for.

          Since you've kindly labeled this as a "ransom", please feel free to tell me how this is really that different from a bug bounty program.

          You can label this "activity" any way you want. At the end of the day, it's Microsoft paying someone to help make their own damn product secure. One would think that would be worth it to them. The only real difference is Microsoft is being forced to pay more than a pathetic pittance for the solution.

        • Re: (Score:2)

          by Copid ( 137416 )
          The difference between paying for this and paying a ransom is that paying a ransom encourages people to do damage that otherwise wouldn't have occurred. In this case, the bug clearly exists already (assuming this isn't fraud), so somebody is going to find it and use it sooner or later, even if this guy doesn't sell the exploit. If it's real, $90K sounds like a sweet deal for Microsoft. A serious incident involving an exploit like that would cause way more than $90K in damage, and it would cost a team of

    • Re: (Score:2)

      by Minupla ( 62455 )

      It can't be that good an exploit. M$ pays up to 100KUSD for bug bounties. If it was that good, they'd just sell it to M$, instead of discounting to 90K.

      Expect it'll get discounted again before sale. Although they have to be happy about the PR, might help them get a sale.

  • :All OS Versions On Sale For $90,000"

    What OS versions reetail for $90,000 ?

    Maybe some punctuation in the headline might help.

  • You shouldn't worry about known exploits.
    You should worry about unknown exploits.

  • Not overpriced at $90K (Score:5, Interesting)

    by xxxJonBoyxxx ( 565205 ) on Wednesday June 01, 2016 @08:15AM (#52224715)
    >> While security experts think the ($90K) zero-day may be overpriced

    As a security expert and occasional entrepreneur, let me tell you why this isn't overpriced. Let's say you could deliver 10,000 phishing emails that lead to installation of $70/unlock ransomware screens, of which 50% of victims usually pay. That's $350K of revenue, minus costs of the initial phishing campaign ($5K-ish), bitcoin exchange fees (maybe $10K) and the $90K for your zero day. That leaves a profit of about $250K - not bad for a few days of work.

  • It works on Windows XP? Windows 98SE? Windows 3.11?

    • Re: (Score:1)

      by nullCRC ( 320940 )

      just not Windows 2.0

    • Re: (Score:3, Informative)

      by Phydeaux ( 82550 )

      Win 3.11 was an operating environment, so technically not the Win 3.x family. The real question is, will it work on WinME, because even officially authorized software was unable to work with it...

      • The real question is, will it work on WinME

        I first read that as "Wine", and a good exploit should be portable in that way. Although I guess technically that would count as a mere operating environment.

  • If you thought gwx.exe was a bitch, just wait until MS gets their hands on this exploit!

    "But... it was the Russians! They thought they could brick all US PC's by forcing Win10 upgrade!"

  • exists in all OS [versions], starting from Windows 2000.

    And people mock me for running NT4!

    • Bah, you need to be running NT 3.5! After that they moved the video drivers into the kernel and you got a lot more blue screens of death.

  • priv esc (Score:3, Interesting)

    by Robert Goatse ( 984232 ) on Wednesday June 01, 2016 @08:22AM (#52224767)
    So it's a privilege escalator not necessarily an exploit to initially get into a host. For a 'real' Windows exploit, 90K is super-duper cheap, but for something like this 90K may be a tad overpriced for what you get.

  • the free market (Score:3)

    by Toonol ( 1057698 ) on Wednesday June 01, 2016 @08:33AM (#52224835)
    If he can find a buyer, it's not overpriced. Items don't have an innate value; their worth is whatever someone is willing to pay at that moment.
  • Can't he make much more money by selling it to Microsoft? It seems this is priced way too low.

  • While security experts think the zero-day may be overpriced, they think the hacker will find a buyer regardless.

    So by definition they do not think it's overpriced.

  • Why even care about privilege exploit? (Score:1)

    by Anonymous Coward

    Does most malware even need admin or SYSTEM access anymore? Once you have a malicious process running as the local user you can steal their data or encrypt it and extract money that way.

  • Pfffft (Score:5, Funny)

    by JustAnotherOldGuy ( 4145623 ) on Wednesday June 01, 2016 @09:57AM (#52225261) Journal

    That's nothing. I've got a zero-day bug called "Norton Anti-Virus" that pwns all versions of Windows and it's only $49.99.

  • Windows Zero-Day Affecting All OS Versions On Sale For $90,000

    Thankfully the OS version I'm using isn't on sale for $90,000 so it isn't affected by this zero-day.

  • Two videos are available, one showing the hacker exploit Windows 10 with the May 2016 security patch, and another one bypassing all EMET features

    Videos, eh? Good job they can't be faked.

  • It keeps rearing its ugly head...did they reintroduce it again?
  • Hand over the vulnerability and you are gagged.

    • Somehow I doubt someone buying exploits on the black market is going to charge it to their mastercard and provide their address. Maybe to a victim's.

  • The NSA will buy it, or some other Three-Letter-Acronym organization. And by "buy it" I mean abduct him, steal it, and dissolve him in a bathtub.

    • The NSA will buy it

      If it doesn't sell immediately for any price then I suspect that either
      1. It's bogus
      or
      2. The TLAs already have the vuln

  • Or is it the same old exploit?

    Task scheduler - create task
    Run as user SYSTEM
    trigger - whenever
    run cmd.exe or vbscript host with parameters/payload of choice
    Profit!

    There ya go. Saved you $90K

    I use that one to kill anti-virus/anti-malware programs whenever I need to run combofix, because the programs have failed in their primary purpose. If anti-malware programs can't guarantee to stop attacks, they shouldn't be allowed to run in the SYSTEM context. Require a password or SMS code to stop them temporarily, sur

Slashdot Top Deals

"Confound these ancestors.... They've stolen our best ideas!" - Ben Jonson

Close