8

I was checking vuldb.com, and they state in one of the boxes:

Top vulnerabilities with the highest current exploit price of the current month. The evaluation happens multiple times per day.

see quote above...

What do they mean by "current exploit price"?

I think it means that in the "black market" that vulnerability could cost around that, am I right? If so, how do they measure it?

More info here: https://vuldb.com/?exploits.2016

13

Yes, it means that in the exploit market that kind of exploit can be sold and bought for something in that range (e.g. $25k-$50k). That website doesn't specifically talk about black market:

The ongoing observation of the exploit market structure helps to collect current prices.

but, if you don't report vulnerabilities to bug bounties, the market you'll find is somewhat gray, if not definitely black, as the legality of selling exploits to a third party is dubious.

A well-known company in this sector, Zerodium, has published its payout ranges for different types of exploits: https://zerodium.com/program.html. There is also a famous 2012 Forbes article on the topic.

It is also very likely that vuldb.com crawls black market websites, in order to find more accurate information on the prices. However, there are probably market areas which cannot be easily found, such as the three/four-letter agency market (i.e. worldwide intelligence agencies, such as the NSA). It has been speculated that prices in those areas are much higher than the ones typical of the "standard" black market.

  • 1
    What do you mean by "three/four-letter agency market" ? – lepe May 31 '16 at 8:50
  • 7
    @lepe Sorry, I should have been more clear. Three letter agencies are US federal agencies with a three-letter acronym: CIA, NSA, DIA, FBI, .... Here, I was mostly talking about intelligence agencies, not generic law enforcement. In other countries, intelligence agencies have a four-letter acronym: DGSE (France),SUPO (Finland), GCHQ (UK), etc. There are (sometimes confirmed) rumors that several intelligence agencies buy exploits in the black market. Disclaimer: I'm not implying that all the agencies I mentioned here buy exploits. – A. Darwin May 31 '16 at 8:56
  • possibility: Where did the FBI get the hack to access the San Bernardino iPhone? – Mindwin May 31 '16 at 13:56
  • 1
    @Mindwin I believe they worked with Cellebrite, those guys are really into mobile forensics R&D. As for how did they do it, I really don't know. IMO governments buy exploits mostly to build surveillance tools, HackingTeam-style, but for forensics stuff (San Bernardino, etc.) they can rely on regular companies that do this for a living. It's a less shady business, and those companies are somewhat more reliable. There's no need to crawl the black market for something you can get from other sources. Just my $0,02. – A. Darwin May 31 '16 at 14:10
2

Exactly what it sounds like - it's the estimated price for an exploit of this kind. Generally a zero-day exploit (e.g. unpatched, and ideally exclusive to buyer), but not always (there is still a small market for patched bugs, where the target is known not to patch in a timely fashion).

There are various "black market" sites offering exploits for sale, so it would be relatively easy to crawl these looking for the latest prices on a regular basis. Not all exploits are sold in this way - look at the HackingTeam emails for an example of a company developing exploits to order, until they got hacked, at least...

  • 2
    I may be wrong, but I think HackingTeam mostly bought exploits in order to build their "tools". – A. Darwin May 31 '16 at 8:07
  • Seems to have been a mix of buying things other people developed, and developing things to order. Very dubious company either way! – Matthew May 31 '16 at 8:15
  • @Matthew: Your answer was useful. I accepted A. Darwin answer as it had more details. Thanks! – lepe May 31 '16 at 9:07
  • 1
    It's not quite "easy" to crawl the black market sites. Some don't allow entry without proof of some other crime, verified by some other criminal who is already part of the inner circle. Plus, you do have to take care not to be caught up in some law enforcement driftnet or honeypot, or you'll be tarred with the same brush as the criminals. Letting others take the risks (such as vuldb or Krebs) allows you to learn what they know without concern for your own reputation. – John Deters May 31 '16 at 21:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.