Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

12/9/2013
05:17 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Hacking The Zero-Day Vulnerability Market

Private brokers sell zero-day bugs for anywhere between $40,000 and $160,000 -- and in some cases buyers could end up spending much more for lucrative targets, new analysis says

A zero-day vulnerability remains private and unknown to the affected software vendor and its users for an average of 151 days.

And on any given day, knowledge of some 85 zero-day flaws are available from boutique exploit providers, according to new analysis of the growing market for these vulnerabilities. Boutique firms, which sell their vulnerability finds to companies and governments, are able to offer more than 100 exploits a year, according to NSS Labs research director Stefan Frei, who has written a new report on just how pervasive and available these "known unknown" zero-day flaws actually are.

And these estimates, according to Frei, are on the low end of the actual numbers. The operations of cybercriminals and nation-states' zero-day activities are not fully known. "This is really a minimum estimate," says Frei, who conducted his analysis using publicly available information.

"Using data from known exploit programs or boutique vendors like VUPEN and putting them all together and connecting the dots -- it's astonishing what you get," he says.

Take the NSA's 2013 budget of $25 million for the purchase of exploits, Frei says. Given that the market price for an exploit ranges from $40,000 to $250,000, this could result in 86 to 541 additional "unknown known" bugs per day floating around, according to his calculations.

[UPDATED 12/10/13 to correct context of dollar figure reference:]
Hitting a particularly valuable target could mean investing even more: "Some [targets] are worth $500,000 or even $1 million," Frei says. If the expected revenue from a target were $10 million, for example, he says, a buyer could spend up to $1 million for an exploit.

A wave of vendors, the most conspicuous being Microsoft, has launched bug bounty programs over the past year or so to attempt to encourage responsible disclosure by researchers and to try to compete with the black market underground for bugs. But with legal zero-day vulnerability providers, such as VUPEN Security, also in the mix, bug bounty programs still face stiff competition.

"They cannot compete," Frei says.

[Microsoft and Facebook co-sponsor community bug bounty program that pays researchers for flaws found in popular open-source software and in Internet protocols. See New Bucks For Bugs Program Focuses On Open-Source Software, Internet Infrastructure.]

Frei crunched the numbers from two major commercial vulnerability purchase programs at iDefense and TippingPoint's Zero Day Initiative from when they were launched in 2002 and 2005, respectively, through September of this year. The two programs in all purchased nearly 2,400 bugs, Frei found, and the timeframe between purchase and disclosure of the flaws was 133 for iDefense and 174 for ZDI.

And drilling down for the years 2010, 2011, and 2012, he found the two companies had published some 1,026 vulnerabilities. "On any given day during those three years, the VCP and ZDI programs possessed 58 unpublished vulnerabilities" affecting Microsoft, Apple, Oracle, or Adobe, the report says.

Boutique vulnerability providers, such as VUPEN Security, ReVuln, NetraGard, Endgame Systems, and Exodus Intelligence, sell subscriptions that include 25 zero-day flaws per year for $2.5 million. Frei says such pricing has cracked the monopoly of nation-states as the main customers of these bugs.

Nation-states are still major buyers, however. "[The boutique vendors] saw a drop in purchases on the government side" during the U.S. government sequester, he says. But that just means "they sell to the other side more," he says.

Jarno Limnell, director of cybersecurity for McAfee's Stonesoft, says the report is a grim reminder that there are plenty of unknown threats circulating below the surface. "That's very scary," he says of the findings. "We also have to keep in mind that a lot of issues are happening in the Internet that we are not even aware of."

The problem then is that some organizations just focus on what is known. "You need to understand the importance of these unknown [threats] and increase resilience," Limnell says.

Frei's full report is available here (PDF) for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17513
PUBLISHED: 2019-10-18
An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
CVE-2019-8216
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8217
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-8218
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8219
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .