The evolution of zerodays market
Raoul «Nobody» Chiesa
St. Hack, Bordeaux, March 14th, 2014
Agenda
• # whoami
• Once upon a time…
• The scenario
• The actors
• The «pricing debate»
• Rules?
– Good sense
– NSA
– Vup...
3
Disclaimer
Disclaimer
● The information contained within this presentation do not infringe
on any intellectual property nor does it c...
 President, Founder, Security Brokers
 Principal, CyberDefcon Ltd.
 Independent Senior Advisor on Cybercrime @ UNICRI (...
Once upon a time…
• I joined the wonderful world of hacking
around 1985.
• Back in 1996, after the operation «Ice
Trap» wh...
Once upon a time…
• Still on those years, we used to find bugs on our own:
– Sun Solaris (we [still] love you so much)
– H...
Years later…
• A couple of things happened.
• Money slowly got involved in this research-
based thing.
– And, the whole wo...
The scenario,
• Guys, we’ve «evolved», somehow…
• Here’s what United Nations says (Hacker’s Profiling Project):
Raoul «Nob...
And, it’s not just «us»
Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
WHAT’S HAPPENING RIGHT NOW
• Cybercrime and Information Warfare have a very wide spectrum
of action and use intrusion tech...
X X
WTF…
Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
Making “Cyber War”…
• „dummy list“ of „ID-10T“ for phishing
• background info on organisation (orgchart etc.)
• Primer for...
Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
 http://rt.com/usa/snowden-leak-black-budget-176/
 http://rt.com/usa/us-hacking-exploits-millions-104/
 http://www.lemo...
Scenarios
• OK, you’re smart, you’ve found the most ever l33t 0day of
your life.
• Who could buy that stuff from you?
– So...
Who do you wanna sell to?
Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
The pricing debate
• I think all of you remember this:
Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
Sou...
The pricing debate
• What about this? (CHEAP but LAME, India’s ones)
Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bor...
Where’s the truth?
What’s the right approach
with pricing?
Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
→ 0-day Markets
0-day
Software
«Bug»
Vendors
CERT (ICS-CERT)
National Institutions
Patch
Software Rel
x.y.z
Black Market
(...
A different (more serious?) approach
Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
Public Knowledge
of t...
Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
Public
Knowledge
of the
vulnerability
Vulnerability relays...
Rules
• Use good sense. Always.
• Don’t be grady.
• Be serious.
• Be conscient.
• Be true.
Raoul «Nobody» Chiesa, St. Hack...
Rules: NSA
Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
?!?
Wow, I feel
better now…
Rules: Vupen
• They claim the 0day is «exclusive» (AFAIK).
• But, they can «rent it» (not just «sell») i.e. for
10, 30, 60...
Rules: SB
Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
Risks
• Your goldie stuff may be underpaid.
• Your stuff maybe be used in repressive countries.
• It may be used for mass-...
Conclusions
• Hunting for bugs is fun.
• Getting in troubles is not.
• Think smart, be paronoid.
• Trust no one. It’s your...
Acknowledgements
• Florian Gaultier for inviting me here and
taking the risk - LOL
• Damien for offering me a glass of win...
Contacts, Q&A
• Need anything, got doubts, wanna ask me smth,
wanna sell?
– rc [at] security-brokers [dot] com
– Pub key: ...
Upcoming SlideShare
Loading in...5
×

StHack 2014 - Raoul Chiesa The evolution of 0days market

403

Published on

What has happened during the last 15 years ?

This presentation will introduce the audience to the 0days market, a very complex ecosystem with different actors, being sellers, buyers or middle-entities.
The speaker will initially provide an high view analysis of this market, then he will zoom into the known and the unwritten rules.

BIO:
Raoul "Nobody" Chiesa was born in Torino, Italy, in 1973. After being among the first italian hackers back in the 90's (1986-1995), Raoul decided to move to professional InfoSec, establishing back in 1997 the very first vendor-neutral Italian security advisory company.

Raoul is among the founder members of CLUSIT (Italian Information Security Association, est. 2000) and he is a Board of Directors member at ISECOM, CLUSIT, OWASP Italian Chapter, Italian Privacy Observatory (AIP/OPSI). Both Raoul and its security team work on research areas such as X.25 and PSDN networks, VoIp Security, Malware Analysis, Cybercrime Intelligence, Threat Agents Profiling, Social Engineering, SCADA & Industrial Automation/Home Automation, Satellite communication, Mobile Security, SS7 threats, Cloud Computing and much more.

Raoul publishes books and white papers in English and Italian language as main author or contributor, and he's a regular contact for worldwide media (newspapers, TV and bloggers) when dealing with Information Security issues and IT security incidents.

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
403
On Slideshare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
7
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

StHack 2014 - Raoul Chiesa The evolution of 0days market

  1. 1. The evolution of zerodays market Raoul «Nobody» Chiesa St. Hack, Bordeaux, March 14th, 2014
  2. 2. Agenda • # whoami • Once upon a time… • The scenario • The actors • The «pricing debate» • Rules? – Good sense – NSA – Vupen – SB • Risks • Conclusions Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  3. 3. 3 Disclaimer
  4. 4. Disclaimer ● The information contained within this presentation do not infringe on any intellectual property nor does it contain tools or recipe that could be in breach with known laws. ● The statistical data presented belongs to the Hackers Profiling Project by UNICRI and ISECOM. ● Quoted trademarks belongs to registered owners. ● The views expressed are those of the author(s) and speaker(s) and do not necessary reflect the views of UNICRI or others United Nations agencies and institutes, nor the view of ENISA and its PSG (Permanent Stakeholders Group). ● Contents of this presentation may be quoted or reproduced, provided that the source of information is acknowledged. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  5. 5.  President, Founder, Security Brokers  Principal, CyberDefcon Ltd.  Independent Senior Advisor on Cybercrime @ UNICRI (United Nations Interregional Crime & Justice Research Institute)  PSG Member, ENISA (Permanent Stakeholders Group @ European Network & Information Security Agency)  Founder, Board of Directors and Technical Commitee Member @ CLUSIT (Italian Information Security Association)  Steering Committee, AIP/OPSI, Privacy & Security Observatory  Member, Co-coordinator of the WG «Cyber World» @ Italian MoD  Board of Directors, ISECOM  Board of Directors, OWASP Italian Chapter  Supporter at various security communities The speaker Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  6. 6. Once upon a time… • I joined the wonderful world of hacking around 1985. • Back in 1996, after the operation «Ice Trap» which leaded to my (home) arrest in 1995, I jumped back to the underground «scene». • My hackers friends told me they just began doing something named «Penetration Test». – I had no idea WTF that thing was. – Then I realized someone was glad to pay you in order to «hack» into something. – With rules, tough. It was legal. – Paid in order to do what I mostly liked?!? Risks-free?? – «You must be kidding», LOL  Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  7. 7. Once upon a time… • Still on those years, we used to find bugs on our own: – Sun Solaris (we [still] love you so much) – HP/UX (harder) – VAX/VMS, AXP/OpenVMS (very few ones) – Linux (plenty of) – etc… • No one was paying us for those findings. It was just phun. • No one was «selling» that stuff. – We used to keep ‘em for us, and occasionally «exchange» the exploits with some other (trusted) hackers. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  8. 8. Years later… • A couple of things happened. • Money slowly got involved in this research- based thing. – And, the whole world got «always-on», «interconnected», IT&TLC fully-addicted. • Then, Cybercrime moved to its prime-time age. • Money quickly got involved in this exploits-race thing. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  9. 9. The scenario, • Guys, we’ve «evolved», somehow… • Here’s what United Nations says (Hacker’s Profiling Project): Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  10. 10. And, it’s not just «us» Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  11. 11. WHAT’S HAPPENING RIGHT NOW • Cybercrime and Information Warfare have a very wide spectrum of action and use intrusion techniques which are nowadays, somehow, available to a growing amount of Actors, which use them in order to accomplish different goals, with approaches and intensity which may deeply vary. • All of the above is launched against any kind of targets: Critical Infrastructures, Governative Systems, Military Systems, Private Companies of any kind, Banks, Medias, Interest Groups, Private Citizens.… – National States – IC / LEAs – Organized Cybercrime – Hacktivists – Industrial Spies – Terrorists – Corporations – Cyber Mercenaries Everyone against everybody
  12. 12. X X
  13. 13. WTF… Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  14. 14. Making “Cyber War”… • „dummy list“ of „ID-10T“ for phishing • background info on organisation (orgchart etc.) • Primer for sector-specific social-engineering • proxy servers • banking arrangements • purchase attack-kits • rent botnets • find (trade!) good C&C server • purchase 0-days / certificates • purchase skill-set • bespoke payload / search terms •Purchase L2/L3 system data • equipment to mimic target network • dummy run on similar network • sandbox zerodays Alexander Klimburg 2012
  15. 15. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  16. 16.  http://rt.com/usa/snowden-leak-black-budget-176/  http://rt.com/usa/us-hacking-exploits-millions-104/  http://www.lemonde.fr/technologies/visuel/2013/08/27/plongee-dans-la-pieuvre-de-la- cybersurveillance-de-la-nsa_3467057_651865.html  PRISM and other secret project’s scandals (“the Snowden case”)  NSA’s budgets for black operations revealed WTF 3
  17. 17. Scenarios • OK, you’re smart, you’ve found the most ever l33t 0day of your life. • Who could buy that stuff from you? – Some hacker folks. • (which, eventually, may resell it to one of the following) – IT Vendors – Security Vendors – Big Internet players – 0days «brokers» – Law Enforcement Agencies (LEAs) – Intelligence Agencies (IAs) – Cybercrime / Organized Crime – Pwoning contests, CTFs, etc. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  18. 18. Who do you wanna sell to? Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  19. 19. The pricing debate • I think all of you remember this: Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR) Source: Forbes, “Shopping For Zero-Days: A Price List For Hackers’ Secret Software Exploits”, 2012, in http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret- software-exploits
  20. 20. The pricing debate • What about this? (CHEAP but LAME, India’s ones) Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  21. 21. Where’s the truth? What’s the right approach with pricing? Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  22. 22. → 0-day Markets 0-day Software «Bug» Vendors CERT (ICS-CERT) National Institutions Patch Software Rel x.y.z Black Market (Cybercrime)Black Market (underground) Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  23. 23. A different (more serious?) approach Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR) Public Knowledge of the vulnerability Buyer’s typology IS = IT Security companies INT = Intelligence Agencies for Governmental use (National Security protection) MIL = MoD/related actors for warfare use OC = Cybercrime 0-day Exploit code + PoC Cost: Min/Max Y IS 10K – 50K USD Y INT 30K – 150K USD Y MIL 50K – 200K USD Y OC 5K – 80K USD N ALL X2 – X10
  24. 24. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR) Public Knowledge of the vulnerability Vulnerability relays on: Operating System ( OS) Major General Applications (MGA) SCADA-Industrial Automation (SCADA) Buyer’s typology IS = IT Security companies INT = Intelligence Agencies for Governmental use (National Security protection) MIL = MoD/related actors for warfare use OC = Cybercrime 0-day Exploit code + PoC Cost: Min/Max Y OS OC 40K – 100K Y MGA INT 100K – 300K Y SCADA MIL 100K – 300K N OS MIL 300K – 600K N SCADA MIL 400K – 1M A different (more serious?) approach
  25. 25. Rules • Use good sense. Always. • Don’t be grady. • Be serious. • Be conscient. • Be true. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  26. 26. Rules: NSA Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR) ?!? Wow, I feel better now…
  27. 27. Rules: Vupen • They claim the 0day is «exclusive» (AFAIK). • But, they can «rent it» (not just «sell») i.e. for 10, 30, 60, 90 days (AFAIK). • Rumors say they are used to sell the same stuff to 5 – 10 customers, tough. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  28. 28. Rules: SB Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  29. 29. Risks • Your goldie stuff may be underpaid. • Your stuff maybe be used in repressive countries. • It may be used for mass-surveillance (Hacking Team docet). • Buyer may learn your (real) identity. • Broker may fool you and disclose your real identity. • Your Government may learn what you sold to who, and may be not too happy with that. • You may make the world worse. – Or better  Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  30. 30. Conclusions • Hunting for bugs is fun. • Getting in troubles is not. • Think smart, be paronoid. • Trust no one. It’s your life. • Relay on nice ppl. • Use your brain. • Don’t exagerate. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  31. 31. Acknowledgements • Florian Gaultier for inviting me here and taking the risk - LOL • Damien for offering me a glass of wine without knowing me (I’m from Turin, Piedmont: this is important stuff to us ;) • All of the sponsors: we’ll drink out all of your money tonight, don’t worry! • The city of Bordeaux for the wine and the beautiful town. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  32. 32. Contacts, Q&A • Need anything, got doubts, wanna ask me smth, wanna sell? – rc [at] security-brokers [dot] com – Pub key: http://www.security-brokers.com/keys/rc_pub.asc Thanks for your attention! QUESTIONS? Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)
  1. Gostou de algum slide específico?

    Recortar slides é uma maneira fácil de colecionar informações para acessar mais tarde.

×