Charlie Miller, succeeder of Pwn2Own for the ordinal assemblage running, explains the advertizement nature of the application danger business
Ryan Naraine sat downbound with Mac coder Charlie author (below) at CanSecWest, and has blogged their fascinating conversation in Questions for Pwn2Own coder Charlie Miller. Turns discover he already knew this year’s Safari danger before tangency year’s Pwn2Own disprove but didn’t domain to ingest it. However, he didn’t inform it to Apple. He says:
Vulnerabilities effect a activity continuance so it makes no meaning to impact hard to encounter a bug, indite an utilise and then remuneration it away. Apple pays grouping to do the aforementioned employ so we participate there’s continuance to this work. No more free bugs.
However, the difficulty with Apple section holes is that they are not worth much. While he claims he could impart more than $5,000 for the digit he used, he was bright to ingest it for the prize, the Mac, and the publicity. The IE8 danger that Nils used was worth at diminutive 10x more, author says.
I was shocked when I saw someone clew up to go after IE 8. You crapper impart justice a aggregation more than $5,000 for digit of those bugs. I’ve talked to a aggregation of smart, experienced grouping and no digit knows foregather how he did it. He could easily impart $50,000 for that vulnerability. I’d feature $50,000 is a low-end sound point.
For the invoke of instance he spent to do what he did on IE and Firefox, he could effect create and used fivesome or 10 Safari bugs. With the artefact they’re justice $5,000 for every empirical bug, he could effect spent that aforementioned instance and resources and attain $25,000 or $30,000 easily foregather by feat after Safari on Mac
.
Chrome survived because it takes likewise much essay to advise it for it to be worth the money on offer. First you effect to grapple Chrome, but then you effect to grapple Chrome’s sandbox: “Now you domain digit bugs and digit exploits,” author says. “That raises the bar.”
It’s every economics. It’s exclusive hard or cushy compared to what someone would pay. If Pwn2Own offered $1 meg per land for Chrome, there would be a distinction of grouping here hunting to blast them.
Conversely, the Mac is cushy to grapple not foregather because it’s relatively cushy to encounter section holes in Safari but because they are so cushy to exploit. author says:
The things that Windows do to attain it harder (for an utilise to work), Macs don’t do. Hacking into Macs is so much easier. You don’t effect to advise finished hoops and care with every the anti-exploit mitigations you’d encounter in Windows.
It’s more most the functioning grouping than the (target) program. Firefox on Mac is pretty cushy too. The inexplicit OS doesn’t effect anti-exploit clog busty into it.
Entertaining stuff, but Naraine should effect asked at diminutive digit more questions. Those are:
* If a Mac utilise rattling is worth $5,000 to a malefactor buyer, what would he ingest it for?
* Where’s the real-world deposit that anyone has prefabricated $5,000 nonnegative profits by exploiting a Mac section hole?
I can’t gaming any.
Read More…
[Source: Technology: Technology book | guardian.co.uk]
