PWN 2 PAWN: Why the Vista Hacker Turned to EBay

By Robert McMillan

Wed, April 02, 2008 — IDG News Service —

When Shane Macaulay tried to sell the Fujitsu U810 laptop he won in a hacking contest last week, it seemed almost like an April Fool's joke.

He said that a top quality hacker could probably examine the machine's hard drive and dig up the unpatched zero-day exploit code he had used to compromise the computer in the PWN 2 OWN contest that he'd just won. "This laptop is a good case study for any forensics group/company/individual that wants to prove how cool they are, and a live example, not canned of what a typical incident responce sitchiation [sic] would look like," he wrote in his listing.

At first blush, this seemed like a clear violation of both the rules of the contest's sponsor, TippingPoint, and of eBay's terms of service, and his listing was pulled within hours by eBay staff. The company said it had to go because it could have harmed users.

But Macaulay says that was never his intent. In a Tuesday interview with IDG Infrastructure he explained that Adobe Systems plans to patch his Flash bug on April 8, the day his auction was set to end, and so he would have been practicing responsible disclosure, releasing details of a flaw that had already been patched. The following is an edited version of this interview.

IDG News Service: Why did you try to sell this laptop on eBay?

Shane Macaulay: I wanted to get a sense for what a market price would be for a zero-day exploit. It's really hard to get that. To get a true price on it violates the policy of eBay, so I had to make limited disclosures to them and then limited disclosures to the vendors and other groups to allow that to happen.

IDGNS: Why were you wondering about that?

Macaulay: I've been involved in several attempts to make a sale of these sorts of items to groups that have presented themselves to me as being legitimate users of these things. You give them the exploit or the zero-day code and they want to evaluate it themselves before they pay you. So you can imagine how that goes. You have no leverage in your sale and they change their price... and the person who spent all this time and investment personally into this item loses the ability to make any money.

IDGNS: Were you surprised that eBay took your auction down?

Macaulay: No, because I was a little rushed in my posting. I've got an e-mail group list [at eBay] that I was going to apply to earlier in the process and at least apprise them of the background story, and say, "Hey this is going to be in line with the disclosure process of this vendor and [contest sponsor TippingPoint's] Zero Day Initiative. So by the time this closes, it's going to be non-zero-day."

Loading...
Network MarketSpace
White Papers
The Challenge of a Demanding Network Infrastructure
Today's data centers are expanding as demand for data and storage continues to grow exponentially. Learn more »
Reduce Infrastructure and Administrative Costs
The Brocade® FastIron® CX Series of switches provides new levels of performance. Learn more »
A New Generation of Application Delivery Controllers (ADCs)
Learn more about Brocade® ServerIron® intelligent application delivery and traffic management solutions. Learn more »
Want to Offer a Superior User Experience?
Control a "boundary-less" enterprise with scalable solutions. Learn more »
Realize Potential Without Increasing Your Risk
Combining Brocade's high-performance infrastructure and McAfee's Web gateway solution ensures trusted environments. Learn more »
Brocade and Imperva: Providing Best-of-Breed Products
Web applications have become the backbone of business in nearly every segment of the economy. Learn more »
 
SPONSORED LINKS
 

Maximizing the Business Value of the PC Infrastructure

Enterprise PBX Comparison Guide

Getting Value from Outdated Networking Equipment

Seven Ways ITIL Can Help You in an Economic Downturn

Data Loss Prevention: A Better Way to Approach Security

Learn how to managing client systems in the enterprise.

Cloud Computing: Read about VMware's compelling vision & set of products

Top-line Performance that's Bottom-line Efficient

Accenture: Outsourcing for uncertain times. Click to learn more.

White Paper: 8 Key Ingredients to Building an Internal Cloud

Read about virtualization and consolidation effort best practices

Building the Virtualized Enterprise with VMware Infrastructure

Top 10 Business and IT Drivers for the Wealth Management Sector

Bottom-Line Benefits of Virtualization

White Paper: The Building Blocks for Cloud Computing

Oracle's Application Grid Technical Demo

Next-Generation Application Servers and Infrastructure

Application Infrastructure at Enterprise Organizations

Achieving Business Agility with Application Grid

Learn about The Information Technology Infrastructure Library.

Achieving Pervasive Performance Management

Automating the Generation and Secure Distribution of Excel Reports

Reduce risk, gain agility. See how Progress can help your business.

Improve ROI, lower TCO and reduce energy consumption.

Introducing the new HP ProLiant G6 server family

Enterprise PBX Buyer's Guide

Secondary Market Primer: Your Network at Half Price

Taking the Service Desk to the Next Level

Why Data Loss is Increasing--and What You Can Do About It

Communications and Collaboration Needs at Business Organizations

Using Open Source to Deploy Web Applications

Mid-Sized Company CIO Community: infoBOOM!

Accenture IT Consulting: Logical meets technological. More . . .

Stop Application Fraud at the Source with Device Reputation

Learn about the VMware vSphere (TM) & Intel (R) Xeon (R) Processor 5500 Series

Learn how a virtualized enterprise can help your company reduce costs

Why Isn't Server Virtualization Saving Us More?

8 Key Ingredients to Building an Internal Cloud

Data Center Optimization: Three Key Strategies

A CIO Executive Guide: Cloud Computing Looms Big on the Horizon

Oracle WebLogic Server Technical Demo

Data Grids and Service-Oriented Architecture

Achieving the Impossible: Unlimited Application Scalability

A Middleware Foundation for Application Grid

Tips for successful virtualization management.

Smart Decisions: The Role of Key Performance Indicators

Gartner Shares Predictions for 2009

64-page prescriptive guide to security, compliance, and IT operations.

Get Google Enterprise Search for your business information.

Accenture IT Consulting: Enabling high performance. More...

 
 
RESOURCE CENTER