Zero-Day Vulnerability in Microsoft Windows Leaked on Twitter

It sometimes can be perhaps slightly less lucrative than you might expect, with your average pen tester paid significantly less than your average SWE. And often somewhat different than the kind of specialty skills someone focused on (say) Windows Internals might have. Compare with selling exploits, where a month's worth of highly enjoyable work might turn into mid-five-figures. Or higher.

You're absolutely right. Penetration testing and code auditing are ways to make money. It's possible that there may be some relevant differences in both subject and compensation is all.

Companies, such as companies that sell surveillance software to governments, do hire people to just find exploits, but judging by leaked emails that can be a stressful job as you are expected to regularly deliver new exploits.

Is selling an exploit to a foreign government even 100% legal? (Serious question; that seems like the sort of thing that could get one in trouble.)

Yup, I've seen this more recently but now the cycle is faster. My comments regularly get downvotes but then later in the evening they turned into upvotes.

Also back in Dec 2017, there was a huge wave of people shilling on reddit for ICOs and subreddits would regularly post what "HN users think" and "how to correct them".

I'd like to also point out that there is a very real cabal of HN nicks that is actively doing drive by downvotes on specific topics centring around LGBTQ+, immigration and ICOs.

I started seeing this back in 2014 and it correlated with the rise of r/the_donald. There are even amino groups that specifically coordinates such attacks. For instance, the Damore threads were really interesting. Within the first few hours of posting there were a lot of comments seemed off for HN userbase, defending trump and Damore's manifesto. Counter comments were flagged and downvoted.

We know reddit is under the influence of shills and HN is not exempt.

Selling 0days for profit isn't the issue. The more pressing issue, considering she seems to be desperately looking for an employer, is that she has aired her life openly, honestly, and unfiltered through the same channels as her professional work. Sorry, but any serious employer isn't going to hire somebody who is openly unstable, especially not the "suicidal/disappearing for months at a time" unstable.

I'd recommend reading the rest of her twitter posts, plus the content she has published on her website, to get a better idea of her character. While she has a moderate amount of technical ability in her specific niche, it's nowhere near the level that would justify hiring past all of the red flags.

It's unfortunate, but she really needs to re-invent her online presence by decoupling her severe emotional issues from her showcased professional work.

Some companies have policies that don’t allow you to sell them while employed there (it’s awkward when your employee sells a bug in software sold by a client/partner/competitor/supplier), but they wouldn’t generally blacklist anyone who had sold bugs in the past.

As a transgender person, this is all that happens in our lives to be honest. It's very tough to have anything but a 'rough time' when the general public views you weirdly, and your family/friends have completely abandoned you.

From her blog last week

http://sandboxescaper.blogspot.com/2018/08/my-greatest-ambit...

Researchers sell bugs all the time. Whether to a bounty program, a broker, a carder forum, etc, it happens all the time.

Nobody is going to look down on her for admitting to doing what some people do for a living.

Would you prefer she works for MSFT for free or "responsibly" works with Zerodium so that the Feds can get their hooves on the bug first?

I'm curious why you made such a post without knowing the industry?

But a browser exploit isn't. They're a dime a dozen. Also, I'm surprised that email is still a primary vector that's used to get people to click on links with their work computer. It seems like such a monitored method compared to, say, a LinkedIn contact.

Oh, nice :)

> They're doing the best they can, but the Win-APIs are too powerful and there is no sandbox (like those for Mac) in place.

Hmmmm.

> Mac has its own sandbox and Linux offers SELinux and I was talking about a security vulnerability I have written for Windows specifically, that's why I gave the tip for Sandboxie.

I have to admit I've never really poked SELinux. My understanding of it is that because it was bolted-on, both architecturally and conceptually, that getting the most out of it is a real pain. This has put me off. :/ (heh)

>> I would be extremely interested to hear some of the ways you'd particularly go about attacking Linux, which I use everyday.

> Sorry, I can't talk about this specific attack in detail because this vulnerability can't be fixed. It's conceptually fairly simple and <400 LoC and I'm sure you can find it on your own if you're determined.

Righteo then writes program that generates all possible C programs <400 LoC long

In all seriousness, you definitely have me interested now :) I guess what might be a relevant question is, how universally applicable is it? Would it run on my minimally-configured Slackware box, for example?

And I am _very_ fascinated to hear that this "cannot be fixed". Are you describing a Linux-specific Spectre/Meltdown?

If this is Chrome-specific - or, shall we say, could be deeply contextualized into domains very important to Chrome - well, I'm sure you've seen https://bugs.chromium.org/p/chromium/issues/detail?id=648971 and https://bugs.chromium.org/p/chromium/issues/detail?id=766253, and particularly the one tag with the numbers in it in the sidebar on the left...

To be honest I'm not really sure what I'm interested in, you could sort of describe where I'm at as somewhat similar to your post 8 months ago about finding your passion. (In my case it's a resource thing.) I've started playing with X11 recently though, to the extent of just learning the wire protocol for fun.

I was actually thinking of making a tiny Xlib-less keylogger the other day, haha. (As in, talking to X via write()/read() directly.) Not quite sure why; perhaps the theoretically-interesting scenario of "not linking to libX11 might be less suspicious?" could be one explanation. I don't seem to need to give myself a rationale to stay motivated on my current track (woohoo), so I'm just tinkering for now.

Uh - getting root on Linux isn't exactly straightforward! Although there was that one time I found a very confused Docker installation (running Ubuntu on CentOS... I'd never used Docker before and could not figure out which way was up ("wat, I have yum AND ap--wait no now apt-get disappeared where did it go"), for about an hour lol) and this system may or may not have left /dev/vda1 in the Docker image... and it may have allowed me to mount it read-write from under the host system, with effective UID 0... ._. (IIRC, I think it was visudo that worked great.)

I wonder if there's a password manager that stores data in the kernel and/or uses the kernel's crypto keyring - and whether such effort would be worth it? (At least this would thwart local attacks, and only remote attacks via the Wi-Fi stack would work. xD)

I've fished forgotten passwords out of Login Data more times than I have fingers, I think. sqlite3 .dump + printf "$(sed 's/../\\x&/g')" FTW.

Linux's non-umbrella model, where there's no cohesive oversight, will be its undoing, I think.

I've wanted to do do packet inspection for a little while now, incidentally, and the introduction of TLS 1.3 has been most annoying. https://news.ycombinator.com/item?id=17540111

On the subject of AV my favorite thing is https://github.com/taviso/loadlibrary :P (if just for the very non-official "you totally know Google is using this every day.")

One thing I was vaguely considering (last night, actually) was an idea I've had for a while - taking forensic memory-dump analysis tools to the next level and making them work in realtime with QEMU. End result being, you run a tool as root with the PID to a running QEMU instance, it attaches (possibly via process_vm_{read,write}v) and lets you watch VT streams, see keys+passwords being typed in SSH, perhaps take screenshots, see the process tree, etc.

Thanks for the tips!