What is it about ZDI you are wondering?

@NotNow And yes the exploit market is better paying, but far less ethical given how they tend to be used. It's usually govt buyers > private buyers > bug bounties in terms of price. Personally, I've sold to private buyers under the caveat that the bug will be disclosed in public after a certain amount of time. A bit less ethical than a bug bounty, but far more ethical than selling it to a corrupt govt.

@Arminius Changing your UA is kind of useless for privacy. It actually makes you stick out more.

@forest

Sorry for the typos, it's early morning here and English is not my native language.

@NotNow ZDI makes money by making contracts with companies that they will then ask for bugs for. They don't accept just any random bug for any random software.

The amount they pay goes up the longer you work with them (through their "points" system). The intention is to make people want to stick with them. It's like frequent flyer miles, but for vulnerabilities.

I'm not sure why acknowledging working with ZDI would be bad for your career. Some people prefer only those who publicly disclose vulnerabilities (who have CVEs in their names). It's not like CEH where it's pretty much universally despised.

Selling directly to the government is hard without having the right contacts (even if it's as simple as "some dude I befriended who works at Raytheon SI"), so yeah usually you do go through brokers that take a cut of the profit. It's not always a formal thing where you submit to some sort of vulnerability submission page. It can be as informal as messaging the right guy on IRC and asking if he has anyone who wants to buy $nasty_bug. So yes you have to trust him.

Otherwise, there are companies like Zerodium (a highly unethical company, for what it's worth) which buy bugs and sell to various governments. In their case, you give them the bug and information about it and they will pay you slowly over a period of months. If the bug is fixed before they fully pay out, they'll stop paying you. It's their way of preventing you from selling it to a dozen different contractors at once and then putting it on seclists the next day.

Oh also, no one sells "directly" to governments. They get their exploits through contractors (Leidos, Vencore, Raytheon, Zerodium, Endgame, the list goes on and on), so selling to the government really means selling to these contractors. Violating human rights has to be privatized, of course!

(Seriously though, don't sell to these govt fscks. If you need more money than the ethical routes give you, go for private buyers. At least they aren't murderers.) /rant

I have zero sympathy for governments - all of them. Selling anything to them is not an option, I was just wondering how the process of selling something to them worked. So ZDI wouldn't be interested, say, in an Apache Tomcat Unauthenticated RCE, for example? Wow. So there are zero ethical options for such a high-value target - no IBB, no bug bounty, nothing.

I didn't know that Zerodium pays over a period of months, thanks for that one. I was wondering why people just don't sell anonymously to them and the burn the exploits to the ground.

I know they've done stuff for the Apache httpd before, at least. Do you have an Apache Tomcat RCE?

If in doubt though, just ask them. I have a feeling they would be happy to buy that bug. Even if they don't want it, there are plenty of ways to sell such bugs, since ZDI is not the only company that makes money by providing early access protection to their customers. Do you consider private buyers to be an ethical option?

@NotNow Also, you may want to think about disclosing it in public, which is actually beneficial for you in the long term (if you are confident that you can keep finding such bugs, as opposed to getting your hand on a 0day because of luck and wanting to get some quick money off of it). If you make yourself known as a competent security researcher, higher paying employment opportunities will open up for you.

I don't have an Apache Tomcat RCE, I was just making an example (so you have no business in hacking me to get it, DGSE!). I don't consider private buyers an ethical option - unless they agree to disclose the issue in an acceptable (1 month? ZDI is less, as far as I know) amount of time. Also, I want them to credit me

About the "disclosing it in public" part, I only recently started to do vulnerability research/exploit development and this is one of my first findings, so no, I am not confident I can keep finding bugs. I also don't like the idea of working for free - nor I could afford to do it in my current situation, even if I wanted. That's why I'm thinking of ZDI: they put to the table public and ethical disclosure, attribution and a decent amount of money.

You said earlier "ZDI makes money by making contracts with companies that they will then ask for bugs for. They don't accept just any random bug for any random software". But Tipping Point also makes money providing early access protection to their customers through its products - that's why I thought they would support some widely deployed non commercial software.

@NotNow By "random bug for any random software", I meant more obscure bugs. If it's something on the level of an Apache Tomcat RCE, I think it's likely they would take it. As for private buyers, if you wanted to have it disclosed at a certain time, it would be up to you to do the disclosing. All you would do is sell them a bug that you guarantee to remain a 0day for a certain amount of time, after which they should not expect it to remain unpatched.

Generally selling to private buyers or random brokers will give you more or less money depending on how you sell it. For example you'll get the most money from a single buyer if it's an exclusive sale (one where you promise that they are the only one who get the bug, as opposed to selling it to multiple parties). The lowest price would be for a bug which you sell to multiple people and which you don't guarantee to work beyond a certain time (which implies that you may burn it, disclose it, etc).

Okay, that makes sense. Thank you for your answers, they were really helpful! :)

No problem!

Some interesting numbers if anyone cares: $15k (requires JS, conditional) to $70k (some dude ripped off a govt agency) for Firefox RCE, $300k for Chromium exploit chain (was a govt sale though, and unusually high still), $20k for FreeBSD LPE, $150k for nginx RCE, nearly $1m for reliable, undetectable remote to ring 0 RCE for IIS or Apache. Of course, how much someone pays varies tremendously on quite a few things (not just the exploit itself) so it's not like anyone should expect a given price.

for now, CTFing seems more productive in terms of learning and honing my skills

Probably a smart move. CTFing is more laid back and less full of drama.

@forest The privacy-related reason I gave for switching the UA was "You may not want to disclose your OS and browser version to every website you visit." which it's perfectly good for.

@Arminius It is trivial to detect what your OS and browser version is without a UA, and in fact some advertising sites already do that (so it's not purely academic).

I knew you'd say that, sigh

It's also rather pointless in the general case.

Well, is it not true? Proposing something that increases your browsing fingerprint as a way to improve privacy seems a little pointless. Generally you want to have a less unique fingerprint if your goal is to improve web privacy.

yeah changing your UA for privacy seems rather cargo-cultish.

Hmm Cargo Cult Privacy seems like a good topic for an article.

Also a fantastic band name.

As @AviD says, it's a common recommendation (along things with blocking all cookies or turning off the referer) that does more harm than good. You'd want to use something like Tor browser which standardizes its UA and attempts to block other fingerprinting techniques (and even it is far from perfect).

I wouldnt even say "more harm than good", as there is no real good (in the overwhelming majority of cases).

Well one good that can come from it is you can get around those pesky sites that tell you that the site won't work unless you use a browser they want!

who gives a damn which browser you're using? It's probably Chrome anyway, unless you're a technohipster using Firefox, or a practical Windows user on Edge.

Or you're embarrased about using Opera.

Practical Windows users should be using Chrome.

Hey what about the people using lynx who don't wanna get arrested? :P

@forest @forest well sure, but thats not about privacy.

@forest obviously you havent tried it lately ;-)

Tell me how your Lynx UA doesn't stick out

I recently came across a site that legitimately told me "You have JavaScript disabled. Not only will this site not function correctly, but it will actually be harmful to your computer. Please turn on JavaScript".

wut

I know, I had to hold in laughter.

@Arminius again, so what?

so there are a total of 8 Lynx users in the world. Who cares?

@Arminius Oh everything sticks out about lynx. I don't think you can reasonably make it hard to fingerprint a lynx (or elinks or links or w3m) browser.

I mean sure, nothing would work right anyway.

so a typical fingerprint for Lynx is hitting the site, refreshing a couple of times, changing a few settings, then giving up in disgust and going back to text only sites?

You know lynx actually isn't that bad. When you're on a very limited system (old UNIX, hacked embedded device, a friend's kid's Arch install after he tried to update Xorg, etc), it's actually pretty useful for troubleshooting.

I wouldnt know.

@Arminius The way I avoid fingerprinting is by using Tor browser, so I'm grouped in with the millions of users of the browser rather than the... one user otherwise (since everyone else is vulnerable to audiocontext fingerprinting, etc).

Not by using lynx :P

@forest I assume you're using QubesOS then? Otherwise why bother.

Hardened Gentoo with access controls in place. I don't like Qubes because it uses icky Xen (and other silly things like nopasswd sudo).

fair. but my point is a new, clean browser for each site and session.

Yeah, the browser profile is loaded into tmpfs under its own user, in a sandboxed Xephyr (because X11 security is sad). I mean Tor browser tries to make its sessions totally ephemeral, but bugs happen. Better to be safe than sorry.

Whoosh.

Hm?

but it sounds like you are one of the few that actually bother doing it right, unlike the majority that think changing their UA for privacy makes any sense.

Thanks for getting back to that

sorry @Arminius, wasnt dissing you personally :-)

its just the CargoCultPrivacy that bothers me.

Indeed. Honestly people should either use Chrome (or Chromium) and add whatever extensions they want, let themselves be fingerprinted (in cases where they don't care about that and only want security from e.g. drive-by exploits), and use Tor browser if they care about fingerprintability in any way. Anything in between is cargo cultish or even dangerous.

yeah.

ftr I dont see why normal people in normal situations care about fingerprinting.

(yes there are legit exceptions, but doesnt apply to most people.)

What I usually recommend is an up-to-date Chromebook for their normal stuff, and a Tails live CD on some other laptop when they need privacy/anonymity. That way they can choose easily between security and anonymity without needing to have complex setups. Because there are plenty of times when folks need anonymity (researching controversial subjects, looking up things which may be illegal in an oppressive country)

but browser fingerprinting has very little to do with anonymity.

If most or at least a fair share of OS and browser version stats simply extract from the UA, why can't it just be a I-don't-want-to-be-in-these-stats thing?

well unless youre one of the 8 people using Lynx.

@AviD Many fingerprinting techniques can uniquely identify a person's individual hardware (webgl and audiocontext fingerprinting for example), so it's a prerequisite for anonymity.

@Arminius why do you care?

@forest perhaps. But the version of your browser is such a small part of that.

@Arminius btw I'm not being glib here.

@AviD Yeah that's true. I was thinking of fingerprinting as the broad class of techniques to discover unique signatures in a client, not just the version that the UA spits out.

unless you're using something very obscure, or want them to think you are, why should you even bother?

@AviD I saw someone's UA on my site which said "GRUB2 bootloader internet browser module 2.3" :D

Actually had to look it up to see if it was some really obscure crazy module or just a prank.

okay, I'd understand why you'd care on the other end, looking at the rare/unique UAs. but unless its a sick sense of humour, why would anyone (outside of a specific set of scenarios) care?

I am genuinely asking.

@forest and....? :-)

@AviD Just goes to show that some people change their UA to make life a little bit more fun for those snoopy sysadmins. :P

heh exactly: sick sense of humour. :D

I guess changing your UA would also be useful to make a political statement to the sites you visit. Still not privacy though.

Or of course setting it to some XSS sequence or SQLi injection attempt

I feel sorry for anyone who stores UA data in a database. I'm sure there are also quite a few exploitable access log parsing programs!

heh sure, a lot of reasons to do so. Not so much privacy though.

@forest yup, seen this a few times.

Changing your UA for privacy, The Right Way™: 1) Change UA to exploit. 2) Visit vulnerable site. 3) Exploit site, execute rm -rf /var/log/ 4) ??? 5) profit!

Hmm, I'll keep casually changing my UA to a more common OS and browser version. That's my religious freedom

Fair enough.

Cute XSS conundrum: security.stackexchange.com/questions/182762/…

Don't think we had that one before

Soo... we're back in our CTFtime account :)

@Arminius nice, who's managing it again?

@HamZa As fas as I understand, every team member is able to by design. Can you check if you're able to?

Oh, well, yes you need an account and request membership

I guess it's not that exciting to be in the team on CTFtime anyway, it's mainly important to manage the events

@Arminius true that

Ah, interesting, to remove a member it needs two members to agree

So, while every team member can manage the team, a single one can't go wild and remove everyone else

@Arminius do you need two team members to "accept" a member?

Hopefully

hehe

Ah, there's a waiting period

After being accepted

So you can't just invite a sock puppet account and lock everyone else out without waiting 30 days

i see

heya

and it seems that our participation in SwampCTF was automatically recorded by the system

@TomK. it seems that as long as we use those team names, then they get automagically recorded

hm.. kinda good... kinda weird

security.stackexchange.com/q/182800/165253 I am so, so confused.