How hacking works
Zerodium launched the challenge in September, saying it would pay seven figures to a team able to figure out a way to take over iPhones and iPads running the latest versions of iOS just by tricking it into visiting the wrong web page or opening a text message.
Two teams actively competed for the reward, but only one was able to meet the terms of the bounty by the contest's October 31 deadline, Zerodium founder Chaouki Bekrar told The Washington Post.
He said the company plans to report the vulnerabilities to its customers, described on its Web site as “major corporations in defense, technology, and finance” and government organizations “in need of specific tailored cybersecurity capabilities.” But it isn't planning to immediately tell Apple how the hack works, although it may do so “later,” he said. That could help Apple create a patch to protect against the attack. Apple declined to comment.
Even if the announcement is a publicity ploy – as some security researchers believe because neither the team's identity nor the exact details of how it broke through iOS's defenses have been revealed – there is something that we can learn from the competition. And that is the economics of hacking and the good, the bad, and the questionable ways to make money by finding bugs in software.
The good: Penetration testing and bug bounty programs
First there are “white hat” hackers who work with companies to protect software. Many work at penetration testing companies or participate in to bug bounty programs. Penetration testing is when a company hires people to attack their products, uncovering problems that the developer can then fix. Bug bounties are sort of a dispersed version of that, where a company sets up a formal system to reward independent researchers who find flaws in their software and work with companies to fix them.
Some companies pay out fairly significant rewards. For example, Microsoft's programs will pay up to $15,000 for an individual bug and up to $100,000 for previously unknown techniques which can sometimes require developers to rethink the architecture behind a system. And this market has become more organized in recent years, with companies like HackerOne popping up to help connect researchers to companies that offer such programs.
However, not all tech companies -- even ones that are good about working with researchers who come forward with problems -- have formal bounty systems. For instance, Apple, which has a generally positive reputation among researchers, doesn't have a formal bug bounty program. And in some cases, companies new to the vulnerability disclosure process may feel threatened by a third-party researcher attempting to tell them about a problem and react with legal threats.
“Often security researchers are threatened with lawsuits under the Computer Fraud and Abuse Act or the Digital Millennium Copyright Act in the U.S., and there are similar laws around the world,” explained HackerOne chief policy officer Katie Moussouris. “But this doesn't actually benefit the company in question. It may temporarily silence researchers, but the flaw is still there,” she said.
The bad: Cybercrime
Perhaps the most obvious path to financial gain from uncovering flaws in computer code is to outright exploit problems for criminal purposes. This is where the nefarious hacker archetype comes from, but in real life, most cybercrime is a pretty professional gig -- think organized gangs with formal structures. “In terms of cybercrime, the ultimate motive is usually financial,” said Raj Samani, Vice President and Chief Technical Officer for Intel Security's operations in Europe, the Middle East, and Africa.
Often times, experts say, the actual hacking part has become more of a software service system, where highly skilled hackers package up software known as exploits that carry out attacks against computers systems and networks with the bugs they find.
But the flip side of this is that as a vulnerability or exploit gets used more and more, the chances that it will be noticed and fixed by the developers. And a lot of cybercrime doesn't run on entirely new bugs -- instead, it relies on previously known problems where users haven't yet applied fixes to their systems. Some bad guy hackers even offer subscription-like support services to the criminals using their tools that help keep their hacking tools up and running, complete with updates that help them get around when companies patch security holes.
Criminals typically use such tools and exploits to break into databases that guard treasure troves of financial data like credit card and banking numbers or other personal information like social security numbers and insurance information. Then they can use that data to carry out fraud and identity theft themselves, or sell it along to other criminals to use for nefarious purposes.
The prices on underground blackmarkets that deal with stolen data help criminal hackers determine where they can get the best return on investment is based on the level of effort to access stolen information, Samani said.
The questionable: The 'zero-day' market
Then there's the “zero-day market” that trades on the private sale of previously unknown vulnerabilities, but generally to governments who look to exploit them for surveillance capabilities. These private sales can offer a heftier price tag than traditional bug bounty programs because the clientele includes intelligence agencies with practically unlimited budgets.
This is where Zerodium's iOS competition comes in. The company is set up to be a middleman that pays independent hackers for new ways to break the security of major software products, and then sells that information to government agencies and major corporations at a premium.
Spy agencies value this sort of information because they can use it to get around security measures put in place by software makers to perform digital surveillance. Government hacking is becoming increasingly sophisticated as tech companies, and Apple in particular, have expanded their offerings of strong forms of encryption that prevent even the companies themselves from being able to unlock devices and the content of communications, even when served with a warrant.
And in addition to companies that outright sell zero-day vulnerabilities, there are also companies, such as Hacking Team, that sell governments such services alongside pricey subscription hacking tools that rely on such exploits.
Participants in this market argue they are providing a valuable tool to law enforcement and operating within the laws of individual nations – or at least in gray areas.
But these services are considered ethically questionable by privacy advocates and some security researchers at tech companies, who argue it can undermine overall security. “They are buying [an exploit] at a very high price because they are paying for silence – they are paying to keep it out of the hands of people who could fix it,” said Moussouris. “The longer a bug goes unfixed the more likely it is to trickle down, and affect more of the population down the road.”
The gulf between what companies like Zerodium say they will pay for unknown bugs and what is offered by bug bounty programs can be wide, as evidenced by the iOS hacking bounty.
“[Tech companies] are never going to compete financially with zero-day buyers,” said American Civil Liberties Union technologist Christopher Soghoian.
Moussouris agrees that there's “no effective way to outbid the offense market” which seeks to weaponize bugs, but argues that the industry is partially asymmetric by design: If developers like Apple started paying out that much for one hack, it would drain the talent pool of people who are building and maintaining new software, she said.
And the zero-day market represents a relatively small percentage of the security economy, according to Moussouris. Everyday users are unlikely to be targeted by the sophisticated exploits sold in the zero-day market because intelligence agencies often reserve them for attacks against the most well-protected targets. Instead, the average person is more likely to be hacked with malware that relies on issues developers have already patched, but that the individual hasn't fixed on their machine yet.
Ultimately, for the Zerodium model to be sustainable, it would have to get more than a million dollars out of the iOS hack by selling it over and over to different clients, Soghoian said. But it's also possible this is a publicity stunt where the payout is a loss leader designed to get press for its initial launch, he said.
Bekrar told The Post that no software other than iOS “really deserves” such a high reward to crack, but that Zerodium would offer other challenges with payouts “around six figures” in the future. – Washington Post
Source
http://www.iol.co.za/scitech/technology/business/how-hacking-works-1.1942499#.VkBwA3ld4nU
Comments
Post a Comment