Zero Day bugs are “original” and undocumented security holes in software that nobody – not even the creators of the software – knows about yet. They are typically found by one person or a team of people working on finding these vulnerabilities. They are either then sold to the black market criminals for a bounty, given to the software developers or governments for a bounty, or simply “given up” in good will to the software developers. In fact, it is each of these three choices that make up the different “hats” that hackers have: black, gray, or white.
In one instance, as reported by KrebsOnSecurity.com, a Windows zero day bug that has the ability to bypass security in ALL versions of Microsoft Windows is going for the grand sum of: $90,000.
Krebs reported that this particular vulnerability was being sold on a cybercrime forum somewhere deep in the underworld of the internet–specifically semi-exclusive Russian language cybercrime forum exploit[dot]in.
The bug is a class known as a Local Privilege Escalation – or LPE. It is used in conjunction with another malicious piece of code in order to attack systems that are not being run as “administrator” and will trick the system into allowing the malicious code to run with administrator privileges.
The seller of this particular code assured potential buyers that they could use this on any version of Windows from Windows 2000 to Windows 10. That’s a wide array of versions, showing that this vulnerability probably goes pretty deep. In order to prove that the bug works the seller provided two videos of the bug in action.
Interestingly enough, the hacker probably could have made more money by selling this zero day flaw directly to Microsoft itself. However, it appears that the seller would take a lower sum of money in exchange for reputation points in this particular cyber crime forum / community. By using the forum’s particular escrow service, his bug is then “verified” in an honor among thieves way, and his name is bolstered within the community.
It seems as though zero-day exploits are fast becoming a very popular commodity in the cybercrime and hacking world, as we are seeing more and more of them being sold to high bidders in the black and white sectors. It was a zero-day flaw that the FBI was looking to obtain when it was attempting to gain access to the iPhone used by the San Bernardino terrorists, and which they eventually obtained. It is still considered “zero day” because Apple doesn’t yet know what it is, and for now the exploit is being kept under intense secrecy. It’s believed that the FBI purchased this zero day bug from a security firm rather than force Apple to make a backdoor.
