The Economics and White Hat Nature of NSS ExploitHub

Question

This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news this month by offering bounties of hundreds of dollars for weaponizing a dozen known vulnerabilities (company offer).

This business model seems to be a variation of the long awaited Holy Grail solution of creating a marketplace for the good guys which will be self-perpetuating and a win-win for all interested in enhanced security. The company quotes H.D. Moore (first link above) and others in support of the concept. His quote suggests this weaponizing activity is benign because it is only focused on non-zero-day vulnerabilities. In the press eEye’s CTO Marc Maiffret (link) provides a more negative comment along the same line of thought "If you are a company getting exploited by known vulnerabilities, your security is not doing its job.”

NSS states is that only 1,000 of 15,000 to 17,000 known critical vulnerabilities have exploits available in Metasploit and that this gap presents a great opportunity for exploit writers to support the pen testing community. The site itself is offering the exploit authors 30% of the revenue and selling unverified exploits for as much as $1,500 each.

Who would pay $1,500 for a single specific exploit? Wouldn’t a simple security audit identifying the vulnerability serve the same purpose passively as a third party penetration tester demonstrating the weakness actively with his purchased attack? If that is the case then is it time to suggest that folks purchasing such exploits might not be wearing such white hats or am I missing something important?

Answer 1

I think you are absolutely along the right lines. The only use for a developed exploit for a known vulnerability is to prove to a disbelieving client that it can be done.

The vast majority of pen testing for a mature client is to confirm/refute their security posture. They do their job, secure and harden the architecture, platforms and applications and then run a penetration test to see whether they missed anything or misconfigured.

Even when our testing takes escalation and vulnerability chaining into account, the usual scenario is:

• Run external tests - see what vulnerabilities exist
• From point on DMZ run tests assuming attackers beat your 1st layer
• From point on core network run tests to see what an internal attacker, or one who passed your outer layers can do

While test teams really enjoy testing which allows them to run a full suite end to end, they are getting rarer, as it is not as cost effective for the client.

The key assumption has to be: if an exploit exists which could provide an attacker with a useful way in to a high value target it will be weaponised, and funded by groups who can pay far more than people like NSS.

Practically, once a vulnerability is known, you should protect until a patch comes out (use other mitigating controls) and then patch. The actual exploit itself isn't necessarily as important.