steven36 Posted May 31, 2016 Share Posted May 31, 2016 A cybercriminal is offering up what may well be a valid zero-day exploit for $90,000 that supposedly is effective against almost every version of Microsoft Windows now in use. Trustwave researchers said the criminal group's claim that the exploit works on all iterations of the Windows operating system from Windows 2000 to 10 is most likely valid and the security firm expects someone to pay the asking price. The item was first spotted on May 11 on a Russian cybercrime website with an initial price of $95,000, but this was lowered to $90,000 on May 23. Based on this and the prices we know about, the price here seems on the high end but still within a realistic price range, especially considering the return on investment criminals are likely to make using this exploit in any campaign,” Trustwave wrote. The exploit is a local privilege escalation (LPE) zero day for systems running the 32-bit versions of the operating system. The LPE is particularly dangerous because when matched with other malware in can be used in almost any kind of attack. “While the most coveted zero day would be a Remote Code Execution (RCE) exploit, Local Privilege Escalation vulnerabilities are likely next in line in popularity. Although such an exploit can't provide the initial infection vector like a Remote Code Execution would, it is still a very much needed puzzle piece in the overall infection process,” Trustwave wrote. Since this is a case of criminals selling to criminals, the seller tries to build some level of trust into the deal by including two videos that supposedly show the exploit functioning properly. The first shows a Windows 10 system being exploited and the second shows the exploit bypassing all of Microsoft's Enhanced Mitigation Experience Toolkit (EMET) protections included in Windows 10. Those behind the exploit say it will be sold only to a single buyer who for $90,000 will receive the source code for the exploit and the demo, free updates that will address any security improvements added to Windows, a detailed write up of the vulnerability details and complementary consultation on integrating the exploit. The Source Link to comment Share on other sites More sharing options...
Based on this and the prices we know about, the price here seems on the high end but still within a realistic price range, especially considering the return on investment criminals are likely to make using this exploit in any campaign,” Trustwave wrote. The exploit is a local privilege escalation (LPE) zero day for systems running the 32-bit versions of the operating system. The LPE is particularly dangerous because when matched with other malware in can be used in almost any kind of attack. “While the most coveted zero day would be a Remote Code Execution (RCE) exploit, Local Privilege Escalation vulnerabilities are likely next in line in popularity. Although such an exploit can't provide the initial infection vector like a Remote Code Execution would, it is still a very much needed puzzle piece in the overall infection process,” Trustwave wrote. Since this is a case of criminals selling to criminals, the seller tries to build some level of trust into the deal by including two videos that supposedly show the exploit functioning properly. The first shows a Windows 10 system being exploited and the second shows the exploit bypassing all of Microsoft's Enhanced Mitigation Experience Toolkit (EMET) protections included in Windows 10. Those behind the exploit say it will be sold only to a single buyer who for $90,000 will receive the source code for the exploit and the demo, free updates that will address any security improvements added to Windows, a detailed write up of the vulnerability details and complementary consultation on integrating the exploit. The Source
Dce3480 Posted May 31, 2016 Share Posted May 31, 2016 We Like to See This @2600 BABY!! "FFF" 4 LFE nSaners get down Link to comment Share on other sites More sharing options...
knowledge-Spammer Posted May 31, 2016 Share Posted May 31, 2016 for $90,000 ill make a zero-day exploit joke but if its posted on Russian site somewere i bet its a real zero-day exploit criminals selling to criminals, the seller tries to build some level of trust into the deal by including two videos that supposedly show the exploit functioning properly. The first shows a Windows 10 system being exploited and the second shows the exploit bypassing all of Microsoft's Enhanced Mitigation Experience Toolkit (EMET) protections included in Windows 10. i like to see the videos 1st Link to comment Share on other sites More sharing options...
steven36 Posted May 31, 2016 Author Share Posted May 31, 2016 19 minutes ago, knowledge said: for $90,000 ill make a zero-day exploit joke but if its posted on Russian site somewere i bet its a real zero-day exploit criminals selling to criminals, the seller tries to build some level of trust into the deal by including two videos that supposedly show the exploit functioning properly. The first shows a Windows 10 system being exploited and the second shows the exploit bypassing all of Microsoft's Enhanced Mitigation Experience Toolkit (EMET) protections included in Windows 10. i like to see the videos 1st It not a joke if you read the article from Trustwave in the 1st post there's one place paying 5K-500K USD depending on the nature of the zero day. FBI paid $1.3 million. for there iPhone exploit. http://www.digitaltrends.com/mobile/fbi-13-million-cost-to-unlock-terrorists-iphone/ Link to comment Share on other sites More sharing options...
humble3d Posted May 31, 2016 Share Posted May 31, 2016 We thought MSFT already had one they made ? Link to comment Share on other sites More sharing options...
steven36 Posted May 31, 2016 Author Share Posted May 31, 2016 Just now, humble3d said: We thought MSFT already had one they made ? Yes it sort of like this one since i only use x64 windows and dont install get windows 10 updates nether effects me . Link to comment Share on other sites More sharing options...
knowledge-Spammer Posted June 1, 2016 Share Posted June 1, 2016 11 hours ago, steven36 said: It not a joke if you read the article from Trustwave in the 1st post there's one place paying 5K-500K USD depending on the nature of the zero day. FBI paid $1.3 million. for there iPhone exploit. http://www.digitaltrends.com/mobile/fbi-13-million-cost-to-unlock-terrorists-iphone/ criminals selling to criminals, the seller tries to build some level of trust into the deal by including two videos that supposedly show the exploit functioning properly. The first shows a Windows 10 system being exploited and the second shows the exploit bypassing all of Microsoft's Enhanced Mitigation Experience Toolkit (EMET) protections included in Windows 10. were can we see the videos they say in the post tries to build some level of trust into the deal by including two videos Link to comment Share on other sites More sharing options...
steven36 Posted June 1, 2016 Author Share Posted June 1, 2016 7 hours ago, knowledge said: criminals selling to criminals, the seller tries to build some level of trust into the deal by including two videos that supposedly show the exploit functioning properly. The first shows a Windows 10 system being exploited and the second shows the exploit bypassing all of Microsoft's Enhanced Mitigation Experience Toolkit (EMET) protections included in Windows 10. were can we see the videos they say in the post tries to build some level of trust into the deal by including two videos The darknet this is not a hacking forum so were not allowed to post it even if we knew . i dont seek out this kind of stuff i have no need for no exploits if i had 500K id be on a vacation somewhere not worrying about the internet . Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.