StHack 2014 - Raoul Chiesa The evolution of 0days market

67 %
33 %
Information about StHack 2014 - Raoul Chiesa The evolution of 0days market
Technology

Published on March 19, 2014

Author: sth4ck

Source: slideshare.net

Description

What has happened during the last 15 years ?

This presentation will introduce the audience to the 0days market, a very complex ecosystem with different actors, being sellers, buyers or middle-entities.
The speaker will initially provide an high view analysis of this market, then he will zoom into the known and the unwritten rules.

BIO:
Raoul "Nobody" Chiesa was born in Torino, Italy, in 1973. After being among the first italian hackers back in the 90's (1986-1995), Raoul decided to move to professional InfoSec, establishing back in 1997 the very first vendor-neutral Italian security advisory company.

Raoul is among the founder members of CLUSIT (Italian Information Security Association, est. 2000) and he is a Board of Directors member at ISECOM, CLUSIT, OWASP Italian Chapter, Italian Privacy Observatory (AIP/OPSI). Both Raoul and its security team work on research areas such as X.25 and PSDN networks, VoIp Security, Malware Analysis, Cybercrime Intelligence, Threat Agents Profiling, Social Engineering, SCADA & Industrial Automation/Home Automation, Satellite communication, Mobile Security, SS7 threats, Cloud Computing and much more.

Raoul publishes books and white papers in English and Italian language as main author or contributor, and he's a regular contact for worldwide media (newspapers, TV and bloggers) when dealing with Information Security issues and IT security incidents.

The evolution of zerodays market Raoul «Nobody» Chiesa St. Hack, Bordeaux, March 14th, 2014

Agenda • # whoami • Once upon a time… • The scenario • The actors • The «pricing debate» • Rules? – Good sense – NSA – Vupen – SB • Risks • Conclusions Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

3 Disclaimer

Disclaimer ● The information contained within this presentation do not infringe on any intellectual property nor does it contain tools or recipe that could be in breach with known laws. ● The statistical data presented belongs to the Hackers Profiling Project by UNICRI and ISECOM. ● Quoted trademarks belongs to registered owners. ● The views expressed are those of the author(s) and speaker(s) and do not necessary reflect the views of UNICRI or others United Nations agencies and institutes, nor the view of ENISA and its PSG (Permanent Stakeholders Group). ● Contents of this presentation may be quoted or reproduced, provided that the source of information is acknowledged. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

 President, Founder, Security Brokers  Principal, CyberDefcon Ltd.  Independent Senior Advisor on Cybercrime @ UNICRI (United Nations Interregional Crime & Justice Research Institute)  PSG Member, ENISA (Permanent Stakeholders Group @ European Network & Information Security Agency)  Founder, Board of Directors and Technical Commitee Member @ CLUSIT (Italian Information Security Association)  Steering Committee, AIP/OPSI, Privacy & Security Observatory  Member, Co-coordinator of the WG «Cyber World» @ Italian MoD  Board of Directors, ISECOM  Board of Directors, OWASP Italian Chapter  Supporter at various security communities The speaker Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Once upon a time… • I joined the wonderful world of hacking around 1985. • Back in 1996, after the operation «Ice Trap» which leaded to my (home) arrest in 1995, I jumped back to the underground «scene». • My hackers friends told me they just began doing something named «Penetration Test». – I had no idea WTF that thing was. – Then I realized someone was glad to pay you in order to «hack» into something. – With rules, tough. It was legal. – Paid in order to do what I mostly liked?!? Risks-free?? – «You must be kidding», LOL  Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Once upon a time… • Still on those years, we used to find bugs on our own: – Sun Solaris (we [still] love you so much) – HP/UX (harder) – VAX/VMS, AXP/OpenVMS (very few ones) – Linux (plenty of) – etc… • No one was paying us for those findings. It was just phun. • No one was «selling» that stuff. – We used to keep ‘em for us, and occasionally «exchange» the exploits with some other (trusted) hackers. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Years later… • A couple of things happened. • Money slowly got involved in this research- based thing. – And, the whole world got «always-on», «interconnected», IT&TLC fully-addicted. • Then, Cybercrime moved to its prime-time age. • Money quickly got involved in this exploits-race thing. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

The scenario, • Guys, we’ve «evolved», somehow… • Here’s what United Nations says (Hacker’s Profiling Project): Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

And, it’s not just «us» Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

WHAT’S HAPPENING RIGHT NOW • Cybercrime and Information Warfare have a very wide spectrum of action and use intrusion techniques which are nowadays, somehow, available to a growing amount of Actors, which use them in order to accomplish different goals, with approaches and intensity which may deeply vary. • All of the above is launched against any kind of targets: Critical Infrastructures, Governative Systems, Military Systems, Private Companies of any kind, Banks, Medias, Interest Groups, Private Citizens.… – National States – IC / LEAs – Organized Cybercrime – Hacktivists – Industrial Spies – Terrorists – Corporations – Cyber Mercenaries Everyone against everybody

X X

WTF… Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Making “Cyber War”… • „dummy list“ of „ID-10T“ for phishing • background info on organisation (orgchart etc.) • Primer for sector-specific social-engineering • proxy servers • banking arrangements • purchase attack-kits • rent botnets • find (trade!) good C&C server • purchase 0-days / certificates • purchase skill-set • bespoke payload / search terms •Purchase L2/L3 system data • equipment to mimic target network • dummy run on similar network • sandbox zerodays Alexander Klimburg 2012

Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

 http://rt.com/usa/snowden-leak-black-budget-176/  http://rt.com/usa/us-hacking-exploits-millions-104/  http://www.lemonde.fr/technologies/visuel/2013/08/27/plongee-dans-la-pieuvre-de-la- cybersurveillance-de-la-nsa_3467057_651865.html  PRISM and other secret project’s scandals (“the Snowden case”)  NSA’s budgets for black operations revealed WTF 3

Scenarios • OK, you’re smart, you’ve found the most ever l33t 0day of your life. • Who could buy that stuff from you? – Some hacker folks. • (which, eventually, may resell it to one of the following) – IT Vendors – Security Vendors – Big Internet players – 0days «brokers» – Law Enforcement Agencies (LEAs) – Intelligence Agencies (IAs) – Cybercrime / Organized Crime – Pwoning contests, CTFs, etc. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Who do you wanna sell to? Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

The pricing debate • I think all of you remember this: Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR) Source: Forbes, “Shopping For Zero-Days: A Price List For Hackers’ Secret Software Exploits”, 2012, in http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret- software-exploits

The pricing debate • What about this? (CHEAP but LAME, India’s ones) Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Where’s the truth? What’s the right approach with pricing? Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

→ 0-day Markets 0-day Software «Bug» Vendors CERT (ICS-CERT) National Institutions Patch Software Rel x.y.z Black Market (Cybercrime)Black Market (underground) Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

A different (more serious?) approach Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR) Public Knowledge of the vulnerability Buyer’s typology IS = IT Security companies INT = Intelligence Agencies for Governmental use (National Security protection) MIL = MoD/related actors for warfare use OC = Cybercrime 0-day Exploit code + PoC Cost: Min/Max Y IS 10K – 50K USD Y INT 30K – 150K USD Y MIL 50K – 200K USD Y OC 5K – 80K USD N ALL X2 – X10

Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR) Public Knowledge of the vulnerability Vulnerability relays on: Operating System ( OS) Major General Applications (MGA) SCADA-Industrial Automation (SCADA) Buyer’s typology IS = IT Security companies INT = Intelligence Agencies for Governmental use (National Security protection) MIL = MoD/related actors for warfare use OC = Cybercrime 0-day Exploit code + PoC Cost: Min/Max Y OS OC 40K – 100K Y MGA INT 100K – 300K Y SCADA MIL 100K – 300K N OS MIL 300K – 600K N SCADA MIL 400K – 1M A different (more serious?) approach

Rules • Use good sense. Always. • Don’t be grady. • Be serious. • Be conscient. • Be true. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Rules: NSA Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR) ?!? Wow, I feel better now…

Rules: Vupen • They claim the 0day is «exclusive» (AFAIK). • But, they can «rent it» (not just «sell») i.e. for 10, 30, 60, 90 days (AFAIK). • Rumors say they are used to sell the same stuff to 5 – 10 customers, tough. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Rules: SB Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Risks • Your goldie stuff may be underpaid. • Your stuff maybe be used in repressive countries. • It may be used for mass-surveillance (Hacking Team docet). • Buyer may learn your (real) identity. • Broker may fool you and disclose your real identity. • Your Government may learn what you sold to who, and may be not too happy with that. • You may make the world worse. – Or better  Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Conclusions • Hunting for bugs is fun. • Getting in troubles is not. • Think smart, be paronoid. • Trust no one. It’s your life. • Relay on nice ppl. • Use your brain. • Don’t exagerate. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Acknowledgements • Florian Gaultier for inviting me here and taking the risk - LOL • Damien for offering me a glass of wine without knowing me (I’m from Turin, Piedmont: this is important stuff to us ;) • All of the sponsors: we’ll drink out all of your money tonight, don’t worry! • The city of Bordeaux for the wine and the beautiful town. Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Contacts, Q&A • Need anything, got doubts, wanna ask me smth, wanna sell? – rc [at] security-brokers [dot] com – Pub key: http://www.security-brokers.com/keys/rc_pub.asc Thanks for your attention! QUESTIONS? Raoul «Nobody» Chiesa, St. Hack, March 14th 2014, Bordeaux (FR)

Add a comment

Related presentations

Related pages

The Underground Economy (with a zoom on Bitcoins)

Raoul «Nobody» Chiesa ... The evolution of 0days market Bitcoins ... Raoul Chiesa Created Date: 4/11/2014 9:23:31 PM ...
Read more

DOSSIER PARTENARIAT - Sthack 2015 | Evénement sécurité ...

http://www.slideshare.net/sth4ck/sthack­2014­raoul­chiesa­the­evolution­of­0days­market : The evolution of 0days market ...
Read more

Conferences |

The evolution of 0days market (EN) Raoul Chiesa: Incident Response: From the Front Lines (EN) Mathias Fuchs, Mandiant/Fireeye: 12h30-14h00: lunch: 14h00-14h45:
Read more

Sthack 4.0 : Confs & Ctf in Bordeaux ! | ShoxX Security Blog

Hacking 16/03/2014 2 Comments. ... The evolution of 0day Markets By Raoul « Nobody » Chiesa. ... 2 commentaires on "Sthack 4.0 : ...
Read more

Ioan-Cosmin MIHAI

The conference CyberCon Romania 2014 aims to encourage the exchange of ideas about evolution of ... DefCamp 2014 gathered over ... CSFI, Raoul Chiesa ...
Read more

Ronaldo Souza - Wikipedia, the free encyclopedia

Ronaldo Souza; Born: Ronaldo Souza dos Santos ... Evolution. He would next fight ... 2014, at UFC Fight Night 50. [28]
Read more

E Hacking News - Latest Hacker News and IT Security News

Carding and Black Market Analysis; NOTE: These are just some sample topics. ... Complete set of Speakers will be published: 20th February 2014
Read more