PWN 2 PAWN: Why the Vista Hacker Turned to EBay

By Robert McMillan

Wed, April 02, 2008 — IDG News Service —

When Shane Macaulay tried to sell the Fujitsu U810 laptop he won in a hacking contest last week, it seemed almost like an April Fool's joke.

He said that a top quality hacker could probably examine the machine's hard drive and dig up the unpatched zero-day exploit code he had used to compromise the computer in the PWN 2 OWN contest that he'd just won. "This laptop is a good case study for any forensics group/company/individual that wants to prove how cool they are, and a live example, not canned of what a typical incident responce sitchiation [sic] would look like," he wrote in his listing.

At first blush, this seemed like a clear violation of both the rules of the contest's sponsor, TippingPoint, and of eBay's terms of service, and his listing was pulled within hours by eBay staff. The company said it had to go because it could have harmed users.

But Macaulay says that was never his intent. In a Tuesday interview with IDG Infrastructure he explained that Adobe Systems plans to patch his Flash bug on April 8, the day his auction was set to end, and so he would have been practicing responsible disclosure, releasing details of a flaw that had already been patched. The following is an edited version of this interview.

IDG News Service: Why did you try to sell this laptop on eBay?

Shane Macaulay: I wanted to get a sense for what a market price would be for a zero-day exploit. It's really hard to get that. To get a true price on it violates the policy of eBay, so I had to make limited disclosures to them and then limited disclosures to the vendors and other groups to allow that to happen.

IDGNS: Why were you wondering about that?

Macaulay: I've been involved in several attempts to make a sale of these sorts of items to groups that have presented themselves to me as being legitimate users of these things. You give them the exploit or the zero-day code and they want to evaluate it themselves before they pay you. So you can imagine how that goes. You have no leverage in your sale and they change their price... and the person who spent all this time and investment personally into this item loses the ability to make any money.

IDGNS: Were you surprised that eBay took your auction down?

Macaulay: No, because I was a little rushed in my posting. I've got an e-mail group list [at eBay] that I was going to apply to earlier in the process and at least apprise them of the background story, and say, "Hey this is going to be in line with the disclosure process of this vendor and [contest sponsor TippingPoint's] Zero Day Initiative. So by the time this closes, it's going to be non-zero-day."


Loading...
Network MarketSpace
Thinking About Deploying Mobile Broadband?
Explore lessons and best practices experienced by companies that have deployed mobile broadband to their workforce. Learn more »
Increase Application Performance and User Experience
This research shifts the attention from basic load-balancing features to application delivery features. Learn more »
Gartner Magic Quadrant, Application Delivery Controllers 2009
The market for products to improve the delivery of application software over networks remains dynamic. Learn more »
McAfee's Network Security Platform IPS
McAfee's Network Security Platform IPS; the costs, benefits, flexibility, and risk elements. Learn more »
The Cost of SQL Sprawl
Learn how a new approach to SQL server consolidation can reduce server counts by 50%, lower maintenance costs by 70% and reduce administration time by 75%. Learn more »
A Bottleneck-free Infrastructure
Storage bottlenecks have a significant impact on performance and productivity. Learn more »
Application Delivery Despite Emerging Challenges
IT organizations need to choose appropriate application delivery solutions that can scale to support the emerging challenges. Learn more »
 
SPONSORED LINKS
 

ROI of Application Delivery Controllers

Upgrading to VMware vSphere with vWire

Maximizing website Return on Information with high-quality search

See how AT&T can help protect your network.

Webcast: Unleashing the Power of Customer Data

White Paper: Improve Agility with Operational Responsiveness

White Paper: Legacy Tools: Not Built for the Helpdesk

Taking a Seat at the Executive Table: The Reality of Virtualization

White Paper: Next Generation Remote Infrastructure Management

Keeping Your Members Safe from Online Scams and Predators

The Total Economic Impact of Network Security Intrusion Prevention

Generation Remote Infrastructure Management - Changing the Paradigm

Cloud-Based Email Management: Opinion Shifts In Favor

eBook: How Can You Make Your People Productive Anywhere?

Achieving Business Agility with Application Grid

Ready to virtualize tier one applications? Check your virtualization maturity.

Seven Ways ITIL Can Help You in an Economic Downturn

Tips for successful virtualization management.

AT&T Synaptic Storage as a Service. Expand on demand

Trend Micro ranked #1 against real-world malware. Read more.

Webinar: Jump-start your in-house e-discovery with Ringtail QuickCull from FTI Technology

Streamline IT Costs. Boost Performance with WAN Optimization.

Build your 1st app FREE with Force.com

TDWI checklist helps define data readiness for analytics. Download report.

eZine: A Roadmap to Reducing IT Complexity

Gartner Magic Quadrant, Application Delivery Controllers 2009

Return on Information: Google Enterprise Search pays you back

Cut Costs & Green Your IT Operations with PC Power Management

White Paper: 4 Customer Service Myths

White Paper: Managed Security for a Not-So-Secure World

White Paper: 5 Best Practices for Smartphone Support

Global Research: CIOs Weigh In On Virtualization

5 Key Virtualization Management Challenges

Secure Email and Web-Based Communication from Evolving Attacks

WagerWorks Takes Fraudsters Out of the Game using iovation

Seven Design Requirements for Web 2.0 Threat Protection

Increase UPS efficiency without sacrificing protection.

Learn how advanced forecasting tools can deliver significant business results for global corporations.

Lower IT Costs with Oracle Database 11g Release 2

White Paper: Visibility and the New Normal of Mobile Work

Taking the Service Desk to the Next Level

Learn about The Information Technology Infrastructure Library.

Return on Information: Google Enterprise Search pays you back. Get the facts.

VMware. The source for Business Infrastructure Virtualization.

ShoreTel tells businesses to untangle from competitors' complexity and turn to its brilliantly simple UC solution

Top Five CIO Challenges

Read the RSA report: Security for Business Innovation

64-page prescriptive guide to security, compliance, and IT operations.

A Clear View Toward Virtualization

Virtualization Technology as a Business Solution

 
 
RESOURCE CENTER