Technology Liberation Front - Latest Comments in eBay for Black Hats?

Re: eBay for Black Hats?

Roland Dobbins — Sun, 17 Dec 2006 23:00:35 -0000

There's a very real miscreant economy, and many things, including exploits, access to botnets for DDoS (useful for extortion, etc.), and so forth are bought and sold daily. I've never heard of an exploit going for $50K, but they do go for amounts into the thousands.

I've never heard of anything like an 'eBay' for miscreants', most of the transactions are negotiated over IRC and IM, AFAIK.

Re: eBay for Black Hats?

Luis Villa — Sun, 17 Dec 2006 07:08:05 -0000

Who says auction system? There are ways of doing auctions without software, you know :) Anonymized chat room (which they are already very good at doing anonymously/untraceably, to control the botnets) + chatters saying 'I'll bid X' 'Do I hear X+1?' 'X+1!' You know, the old fashioned way :)

Re: eBay for Black Hats?

David — Sat, 16 Dec 2006 23:22:25 -0000

I have to agree with Tim. I find it hard to believe that people who have the programming knowledge to engineer exploits to operating systems would trust any type of online auction system. Seems like a nice plot for a novel though.

Re: eBay for Black Hats?

Tim Lee — Sat, 16 Dec 2006 22:10:45 -0000

Right, but doesn't putting your exploit up for auction substantially increase the chances of getting caught? I can believe that these exploits could be worth 50 grand, but I wouldn't think an online auction would be the way you'd sell them.

Re: eBay for Black Hats?

Luis Villa — Sat, 16 Dec 2006 19:39:42 -0000

I've heard of such things for earlier versions of Windows before, including some reputable/documented stories of auctions of botnets. Their existence shouldn't be too surprising- get that zero day exploit, and you can get yourself a very profitable botnet. Given the reputed cash flow for some of the spam kings, $50K doesn't sound implausible. And of course they are already in deep legal trouble if caught, so an additional charge wouldn't scare them very much.

The only part of this that sounds implausible is that it is for Vista- there is no commercial value in hacking into undeployed systems. But maybe they'll just stockpile it.