The trade in security exploits: Free speech or weapons in need of

63
The trade in security exploits: Free speech or weapons in need of regulation? Christopher Soghoian Presentation to VB2012, Sept 26, 2012

Transcript of The trade in security exploits: Free speech or weapons in need of

Page 1: The trade in security exploits: Free speech or weapons in need of

The trade in security exploits:Free speech or weapons

in need of regulation?

Christopher Soghoian

Presentation to VB2012, Sept 26, 2012

Page 2: The trade in security exploits: Free speech or weapons in need of

First: a disclaimer

These opinions are my own, and do not reflect the official position of the ACLU.

(I've only been there 3 weeks)

Page 3: The trade in security exploits: Free speech or weapons in need of
Page 4: The trade in security exploits: Free speech or weapons in need of
Page 5: The trade in security exploits: Free speech or weapons in need of
Page 6: The trade in security exploits: Free speech or weapons in need of

“The government official said he was not allowed to name a price, but that I should make an offer.

And when I [set a price of $80k], he said OK, and I thought, 'Oh man, I could have gotten a lot more.

‘”

- Charlie Miller, Interview with SecurityFocus, 2007

Page 7: The trade in security exploits: Free speech or weapons in need of
Page 8: The trade in security exploits: Free speech or weapons in need of

“I don't think it fair that researchers don't have the information and contacts they need to sell

their research.”

- Charlie Miller, Interview with SecurityFocus, 2007

Page 9: The trade in security exploits: Free speech or weapons in need of

“Legit” bug sale options in ‘99: Vendor bounties

$500 $500-1337

Page 10: The trade in security exploits: Free speech or weapons in need of

“Legit” bug sale options in ‘99: subscription services

$500 – $20,000

Page 11: The trade in security exploits: Free speech or weapons in need of

Community debate:

Responsible disclosure vs. full disclosure

Page 12: The trade in security exploits: Free speech or weapons in need of

Alex Sotirov and Dino Dai Zovi, CanSecWest, 2009

Page 13: The trade in security exploits: Free speech or weapons in need of

“Vendors have been getting a freebie for a while, why would I want to sit down and volunteer to

find a bug in someone’s browser when it’s a nice, sunny day outside?”

- Dino Dai Zovi, Interview with SC Magazine, 2009

Page 14: The trade in security exploits: Free speech or weapons in need of
Page 15: The trade in security exploits: Free speech or weapons in need of
Page 16: The trade in security exploits: Free speech or weapons in need of
Page 17: The trade in security exploits: Free speech or weapons in need of

What was “No More Free Bugs” really about?

Google and Microsoft will never be able to outbid the US Government.

Page 18: The trade in security exploits: Free speech or weapons in need of

Fast forward: 2012

Page 19: The trade in security exploits: Free speech or weapons in need of
Page 20: The trade in security exploits: Free speech or weapons in need of
Page 21: The trade in security exploits: Free speech or weapons in need of
Page 22: The trade in security exploits: Free speech or weapons in need of
Page 23: The trade in security exploits: Free speech or weapons in need of

He says he takes a 15% commission on sales and is on track to earn more than $1 million from the

deals this year.

“I refuse to deal with anything below mid-five-figures these days,” he says.

- The Grugq, quoted in Forbes, March 2012

Page 24: The trade in security exploits: Free speech or weapons in need of

Chaouki Bekrar and the VUPEN team

Page 25: The trade in security exploits: Free speech or weapons in need of

“We wouldn’t share this with Google for even $1 million.

We don’t want to give them any knowledge that can help them in fixing this exploit or other similar exploits. We want to keep this for our customers.”

- Chaouki Bekrar, Interview with Forbes, Mar 2012

Page 26: The trade in security exploits: Free speech or weapons in need of

“We don’t work as hard as we do to help multibillion-dollar software companies make their code secure.”

“If we wanted to volunteer, we’d helpthe homeless.”

- Chaouki Bekrar, Interview with Forbes, Mar 2012

Page 27: The trade in security exploits: Free speech or weapons in need of
Page 28: The trade in security exploits: Free speech or weapons in need of
Page 29: The trade in security exploits: Free speech or weapons in need of

NATO Partners include:

Azerbaijan, Turkmenistan, Egypt, Morocco, Qatar and Pakistan.

ASEAN Members include:

Indonesia, Burma and Vietnam.

Page 30: The trade in security exploits: Free speech or weapons in need of
Page 31: The trade in security exploits: Free speech or weapons in need of

Simultaneous developments elsewhere

Page 32: The trade in security exploits: Free speech or weapons in need of

Martin J. Muench

Page 33: The trade in security exploits: Free speech or weapons in need of
Page 34: The trade in security exploits: Free speech or weapons in need of
Page 35: The trade in security exploits: Free speech or weapons in need of
Page 36: The trade in security exploits: Free speech or weapons in need of
Page 37: The trade in security exploits: Free speech or weapons in need of

Gamma Group sells FinSpy to governments only to monitor criminals and it is frequently used

“against pedophiles, terrorists, organized crime, kidnapping and human trafficking.”

- Martin Muench, New York Times interview, Aug 2012

Page 38: The trade in security exploits: Free speech or weapons in need of
Page 39: The trade in security exploits: Free speech or weapons in need of
Page 40: The trade in security exploits: Free speech or weapons in need of
Page 41: The trade in security exploits: Free speech or weapons in need of
Page 42: The trade in security exploits: Free speech or weapons in need of
Page 43: The trade in security exploits: Free speech or weapons in need of

Australia, Bahrain, Brunei, Czech Republic, Estonia, Ethiopia, Indonesia, Qatar, Latvia,

Mongolia, the Netherlands, Turkmenistan, United Arab Emirates and United States.

Page 44: The trade in security exploits: Free speech or weapons in need of
Page 45: The trade in security exploits: Free speech or weapons in need of
Page 46: The trade in security exploits: Free speech or weapons in need of
Page 47: The trade in security exploits: Free speech or weapons in need of

The exploit and surveillance industry has a bit of an image problem.

Page 48: The trade in security exploits: Free speech or weapons in need of
Page 49: The trade in security exploits: Free speech or weapons in need of
Page 50: The trade in security exploits: Free speech or weapons in need of

The first rule of exploit selling is:

Page 51: The trade in security exploits: Free speech or weapons in need of

Others keep talking though.

Page 52: The trade in security exploits: Free speech or weapons in need of

“I do it for money, because I like it, and because most of the time I don't need to wear pants. I spend approximately no seconds of any day

worrying about the imaginary ethical implications of every little thing I do, and I am not particularly

unique.”

- Ben Nagy, post to ‘dailydave’, 2012

Page 53: The trade in security exploits: Free speech or weapons in need of

“Given that a can of fizzy drink or a car battery can be abused and used as an implement of torture it is of no surprise to anyone if our

products can be abused too.”

- Martin Muench, email interview with ABC Radio (Australia), September 2012.

Page 54: The trade in security exploits: Free speech or weapons in need of
Page 55: The trade in security exploits: Free speech or weapons in need of

Regulate sales of exploits =Limit freedoms

Page 56: The trade in security exploits: Free speech or weapons in need of
Page 57: The trade in security exploits: Free speech or weapons in need of

Politicians will take an interest in exploit sales and call for regulation

Page 58: The trade in security exploits: Free speech or weapons in need of

“I think that the zero-day exploit market should be regulated. We're selling bullets and computers

are the guns, there's no doubting that.”

- Adriel Desautels, post to ‘dailydave’, August 2012

Page 59: The trade in security exploits: Free speech or weapons in need of

If the industry wants to avoid regulation, it needs to regulate itself.

Page 60: The trade in security exploits: Free speech or weapons in need of
Page 61: The trade in security exploits: Free speech or weapons in need of
Page 62: The trade in security exploits: Free speech or weapons in need of

If the Grugq remains the poster child for the industry, the response from Washington DC

and Brussels will not be pretty.

Page 63: The trade in security exploits: Free speech or weapons in need of

Thank you

[email protected]


EXPLOITS Magazine August 2014

EXPLOITS Magazine August 2014

Master Semminar Injection Exploits

Master Semminar Injection Exploits

How Hamas Exploits Children

How Hamas Exploits Children

Anoiting for Exploits

Anoiting for Exploits

Software Exploits for ILP

Software Exploits for ILP

Anointed to do exploits

Anointed to do exploits

Better Delivery. Better Exploits.

Better Delivery. Better Exploits.

WHEN WORDS WERE WEAPONS - Internews...When words were weapons: Kenya’s media turn the tide on hate speech and conflict ix. Foreword ... Uhuru Kenyatta and their Deputy President,

WHEN WORDS WERE WEAPONS - Internews...When words were weapons: Kenya’s media turn the tide on hate speech and conflict ix. Foreword ... Uhuru Kenyatta and their Deputy President,

The Ether Wars: Exploits, counter-exploits and honeypots ... CON 27/DEF CON 27... · ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum 2 About

The Ether Wars: Exploits, counter-exploits and honeypots ... CON 27/DEF CON 27... · ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum 2 About

Lessons learned writing exploits LESSONS LEARNED WRITING EXPLOITS Gerardo Richarte Iván Arce

Lessons learned writing exploits LESSONS LEARNED WRITING EXPLOITS Gerardo Richarte Iván Arce

Common Exploits

Common Exploits

Healing Exploits in Evangelism

Healing Exploits in Evangelism

m86 Web Exploits Report

m86 Web Exploits Report

Free speech or weapons in need of regulation? · Free speech or weapons in need of regulation? Christopher Soghoian . First: a disclaimer ^The government official said he was not

Free speech or weapons in need of regulation? · Free speech or weapons in need of regulation? Christopher Soghoian . First: a disclaimer ^The government official said he was not

Nethemba - Writing exploits

Nethemba - Writing exploits

EXPLOITS MAGAZINE April 2014

EXPLOITS MAGAZINE April 2014

WoD Weapons Cards - Emerald Samurai Weap… · Weapons Weapons Weapons Weapons Weapons Weapons Weapons Weapons Back Created by Skari-dono ... Pages 169-170 of the World of Darkness

WoD Weapons Cards - Emerald Samurai Weap… · Weapons Weapons Weapons Weapons Weapons Weapons Weapons Weapons Back Created by Skari-dono ... Pages 169-170 of the World of Darkness

TCP Exploits

TCP Exploits

Exploits in Management*

Exploits in Management*

Software Exploits

Software Exploits