Hacker News Reader

Comment by hospitalJail | Hacker News Reader

I hate windows, like I'm trying to get off it because of the ads/ragebait news. I hate edge. Microsoft is basically a never buy anymore, but according to this:

https://zerodium.com/program.html

Getting a Windows exploit is higher value than any linux exploit. Given how many servers use Linux, it makes me wonder if Linux 0 click are easier than windows.

There are a bunch of counters like 'there are too many distros', or 'a personal computer of a VIP is higher value than some corporations'. But I'm not sure its fair to include your point number 1.

I like to give people credit where its due, I imagine it took lots of work to make windows as secure as it is. (Giving Android OS the most credit for their 2.5M payout)

View on HN

Linux servers generally aren't being used interactively though and expose a fairly limited attack surface to the internet, and so I feel like the value in Linux server exploits is more in the openssl/Apache/etc vulnerabilities

Linux is the just kernel. Everything else in a distro is software running on top of it. Kernel bugs are generally hard to exploit remotely and typically have to be chained with other exploits. That's why there's so many specific payouts for common enterprise apps. Windows is a complete, highly integrated OS with a wide array of attack vectors baked right into it.

Plus sketchy companies like Zerodium major customers are nation-state actors who are primarily interested in data exfiltration and the application data stores themselves.

>Kernel bugs are generally hard to exploit remotely and typically have to be chained with other exploits.

This is why its so valuable though.

But what’s the point ? Most vulnerable Linux servers are hosting blogs or dns servers. They’re only useful to run a crypto miner or host a phishing page, and for that you probably don’t need to go further than exploit a wordpress bug. No need to go for the kernel or even root.

Whereas a desktop often has users on it who enter banking details or corporate login credentials. Much juicier targets.

Can be a good DDoS source, lots of bandwidth often. Bonus if they can spoof packets, which needs root.

The payouts are based on what their 'clients' are willing to pay in turn for the exploits. There's just less of a market for Linux kernel exploits. If nation-state actors are involved in deep APT style attacks where they would leverage low level kernel exploits they are going to either develop the exploits themselves or acquire them through their own clandestine channels. Purchasing that stuff from a publicly facing company that could potentially be compromised themselves is high risk and leaves too obvious of a trail.

Two reasons I think Windows exploits would pay higher than 'Linux':

1. The Windows (end-)user base is much larger than Linux (not counting Android), so a Windows exploit enables more potential victims.

2. Windows has been the de-facto corporate OS for a long time, so a Windows exploit offers more high-value targets.

It's strange to me that Thunderbird is even on their chart. Surely only a few free software enthusiasts use that anymore? Most of the population doesn't even use a desktop email client and if they do its work-provided Outlook to connect to Exchange/Office365.

https://zerodium.com/faq.html

>Zerodium reviews, tests, validates, and documents all acquired vulnerability research then provides it to institutional clients as part of the

Zerodium only cares about shit their own customers want to target. They aren't trying to fund the entire world of software security.

Their customers in particular are select governments wanting exploits for their own use. You can sure as shit bet they already have specific targets in mind and what they use.

EDIT: For example, the forum software noted on Zerodium's list are popular for "blackhat" and "darkweb" forums from everything from card dump selling to malware. Many governments would love to get themselves a database dump with some user IPs. Conversely, this is why Discourse which is a major BB these days is missing as it's not popular in those circles.

Desktop Email Clients are good for downloading all your Gmail before Google randomly decides to nuke your account.

I'm sure 99% of the population does not use email personally anymore, except for delivery of their Amazon invoices.

Yep. Receipts and notifications. It’s a bad means for communications.

> I hate edge.

It's a thin wrapper around Blink just like Chrome/Chromium. What is there to "hate"?

> What is there to "hate"?

The endless fluff and clutter to clean up (Search bar appearing on desktop, sidebar foistware). The relentless marketing and push of adjacent services (Bing AI).

The passive-aggressive IE compatibility mode (unremovable nag banner to stop using IECM, your Legacy App URLs expire after 30 days for no good reason).

Edge allegedly manages to be worse at privacy than Chrome: https://apple.slashdot.org/story/20/03/07/0054219/edge-brows...

So many ads on the home page.

'turn it off'

I did. But its not intuitive, its some settings button that is semi-transparent. I literally had to google/bing it.

The inital setup was awful.

Then it opening all my links in edge was not okay. I'm signed in on firefox, I don't want things opening in edge.

I can't remember, I gave up after the whole BingGPT thing was a let down.

Reply on news.ycombinator.com