I'm not sure I understand the cognitive dissonance here. The same imbalance exists in a lot of commercial products; for instance, a new reliable Chrome bug chain might earn you more than a Chrome developer makes in a year, and a lot of those people make bank. It's simply the case that for some projects, reliable exploits are more scarce than feature engineering resources --- they involve different skill sets.
None of this is to say that $25k is adequate compensation for critical FOSS development work.
Erm how would that be fraud? It's certainly unethical to the software's users, but seems to fit the spirit of a private bug bounty. Apart from the ethics, what would legally trip you up is later "disclosing" that bug as a public bugfix, which is presumably against Zerodium's terms.
Fair point, but as someone not familiar with exploit markets, I do find it surprising that an exploit in a relatively niche (because desktop linux is relatively niche) IM client is worth $100,000k.
Zerodium is a proxy for governments wanting to buy exploits. That niche IM client might be the software of choice for a child-exploitation ring or a high level ISIS commander.
Comparatively a single hellfire missile costs $150k - plus $32 million for the drone to fire it from.
The 100k exploit bounty is probably less than the yearly cost of 1 agent for many government organisations. So the target doesn't even have to be a high value ISIS terrorist to make this bounty worth it. Just save them 1 or 2 FTE somewhere and the economics already work.
I would have thought the same, but the existence of this "ask" certainly would suggest there is indeed demand from a market dynamic perspective. Pidgin is cross-platform, and you could conceive that it was being used by people for various activities with OTR or OMEMO end-to-end encryption. At that point, there's a bunch of potential customers looking to pay Zerodium for a good, robust, zero-click exploit that would give them access to exfiltrate and monitor messages sent through the client.
The work is the work, no matter how much the project itself took to build. If it was easy for exploit developers to pull a Pidgin exploit out of their butt, they'd be cheap. The fact that it's a niche target can actually make bugs scarcer; sometimes, exploit devs can draft off the work other people have done beforehand.
I get why that's surprising but I think it's important to beat that surprise out of your brain, because $100k is a rounding error for any state-level actor --- not just the US, but, like, Seychelles as well. If you have a problem that can be solved with a Pidgin exploit, it's a problem you'd fall over rushing to write a simple $100k check for.
What's so perplexing to me is why the pay grades for people in the military are so low. Take Michael Flynn, for example, the O-9 pay for a three star general is lower than what a senior software developer makes. Surely if we're spending $100k a pop for these random exploits it makes sense to spend more at the top of the military to make sure we're buying the right ones.
Also, I don't really see any possible way out of this cyberarms market. There are too many degrees of freedom to really secure anything completely and I'm continually surprised that our governments allow the sale of these munitions to non-allied foreign governments. If someone puts up a $2m dollar bounty for Tesla do we just accept this even if it means physical harm?
Undoubtedly some TLA has learned someone of interest is using Pidgin, and has offered a premium for an exploit to target them. TLAs have deep pockets for such things.
Pidgin has, or at least had, more usage than you might think. I know that it was the typical Jabber client at Oracle a couple years ago. It's been superseded by Slack/Teams/Zoom recently, but it's not exactly rare. Also, if you were going to profile network admins or ops people that might be interesting to target for attack, they're more likely than most to be running Pidgin.
The 0day market is actually getting disrupted by cryptocurrency. Even the major exploit brokers can't compete with weaponizing the exploit against an exchange or online wallet provider to net tens of millions in easily cleaned money.
Also, those selling 0days are not the one's using them in the wild... out or principal. One can sell a 0day and float away on a silver cloud never to be seen again, but use it in an active campaign and they'll come after you hard.
Yes it makes sense, that doesn't mean it is common. I can sell a 0-day for money and it is legitimate income. If I try and scam an exchange I have to be successful, be able to clean the coins I steal and then hope I am not caught.
One example where it was unsuccessful, not sure it counts as evidence. Yes one time someone did try to use it but it doesn't indicate a pattern of behaviour
The difference is that Zerodium can turn around and sell these exploits to autocratic governments. More often than not, these governments then use the exploits to monitor political dissidents.
Sorry, I did not mean to imply that. I was just noting an important difference between bug bounty-style exploits funded by companies and what Zerodium does.
Chrome funding is probably in the XXM$/year, while Zerodium offers 500k$ for a vulnerability, that's an approximate 20-100 funding / vulnerability ratio.
Pidgin is at 25k$/year, for 100k$ for a vulnerability, so a ratio of 1:4.
I think the only reasonable conclusion is that community-driven opensource projects are 100 time safer than private company-funded opensource projects /s
I don't think cognitive dissonance is the right label to apply to this. I read it more as a misalignment of incentives. It's a sad comment on the state of things that a year of effort to produce some popular software is worth only a quarter of what somebody else is willing to pay for exploitable bugs in that same software.
Like, I understand why that's the case, but it still sucks.
I would pay more than my yearly salary to find out if I have a 'curable' cancer, so that I could treat it. To not, or ignore that, would likely mean my death. I imagine it is similarly motivating for OSS projects.
OSS projects aren't people with curable diseases. Most of them are labors of love, run by people in their spare time. Those people have needs that are mostly not met by working on open source projects. Epsilon open source projects are well-enough funded that nobody in the project feels starved for resources.
Bug bounty programs are only useful for these projects if the details of the bug are shared with the project. Zerodium's model relies on keeping developers unaware of the bugs for as long as possible [1].
Nobody developing OSS is grateful for programs like Zerodium.
Many of these exploits (certainly not all) have been used to catch child predators. I do not know of any case of a 0day being used against journalists or hackers from a NATO country.
> Zerodium customers are government organizations (mainly from Europe and North America) in need of advanced zero-day exploits and cybersecurity capabilities.
Based off Zerodium’s origin and reputation, it seems an exploit is sought which enables a governmental actor to examine information that it otherwise could not. I am assuming they do not have a legal basis for doing so or courts would have granted/ordered such access.
> I am assuming they do not have a legal basis for doing so or courts would have granted/ordered such access.
It's also possible that they have a lawful basis and warrant, but realise executing a physical warrant won't get access to what's required - with e2e encrypted chats going over Pidgin, on an encrypted laptop, you need to be very confident that when you swoop, the laptop is on and decrypted. You get one "go" at that, otherwise you have a suspect, little or no evidence, and an attorney requesting their immediate release on bail absent any actual evidence, which would let them flee and clean up any other evidence that may be out there, either with them or others.
How do you think warrants work? The police suspect Criminal Charlie of organizing a crime using pidgin, so they get a warrant, then they give the warrant to Charlie? "Please remember to cc us on all your criminal plans. Thanks."
The issue isn’t about the warrant but the over breadth of the method for getting the desired information as it can leave other users vulnerable. Whether they have a warrant or not, this seems like overkill, because they could obtain said info in a much more straightforward way, assuming they have probable cause.
What Pidgin user(s) could possibly be worth that much?
Are there some activist or terrorist monitored by a 3 letter agency that is computer literate enough to use Linux + pidgin to try and keep away from prying eyes (or just plain ethical reasons)? Or would the exploit end up being targeted at some foreign government that has standardized on Pidgin?
There are many government organizations which are still using XMPP and the Clients they usw are most likely based on libpurle the vasic library for pidgin and similar clients (Adamantium on MacOS).
Maybe. But if you're holding a LOT of crypto, it's very unwise to store the private keys on an internet-connected computer you also use for instant messaging and other things.
(I'm sure plenty of people do actually do that; just lamenting the fact rather than expressing skepticism at the plausibility.)
I left like $80 worth of crypto on a computer that my nephew was using for gaming online, and only remembered when I realized that it had grown to be worth over $1000
Fortunately I recovered it before any of the virus-riddled crapware he downloaded noticed it was there, haha
Pidgin is the IM client provided in Tails Linux. In practice that makes it the OTR over XMPP client provided in Tails Linux.
I suspect that this use also causes those that are not doing Tails to use Pidgin on Windows to communicate with those that are. After all, Pidgin is in Tails. It must be secure.
Well, surely you just have a confederate add one, sell the exploit, then patch it. Do it three times and you’ve got a decade of funding. I’m sure you’ll get away that many times.
It’s sad state only because the FOSS developer managed a low funding. OTOH, if they had managed significantly more, say a million, then irrespective of the bounty size we wouldn’t label it a sad state.
This is to say that FOSS needs more funding and contributors; rest of the industry can do whatever they want, and we wouldn’t care.
Begging cash for os exploits is trashy and rude, the author should have just submit a pr with the fix.
Target crapy closed projects where real money is next time and ask for more, peasant.
71 comments
[ 4.2 ms ] story [ 135 ms ] threadNone of this is to say that $25k is adequate compensation for critical FOSS development work.
(This is fraud, don't actually do this! But it comes up every time someone does bug fixing metrics)
Edit: If it's not a bug bounty to fix it, but a vuln bounty to sell it, then it's highly-unethical but not necessarily illegal.
Fixing some bugs and adding some features is a nice-to-have that most people and companies aren't willing to pony-up much for.
Comparatively a single hellfire missile costs $150k - plus $32 million for the drone to fire it from.
Also, I don't really see any possible way out of this cyberarms market. There are too many degrees of freedom to really secure anything completely and I'm continually surprised that our governments allow the sale of these munitions to non-allied foreign governments. If someone puts up a $2m dollar bounty for Tesla do we just accept this even if it means physical harm?
I would take the 0-day payday thanks.
I don't necessarily disagree with you, but I do think it's dissonant enough to be interesting.
Chrome funding is probably in the XXM$/year, while Zerodium offers 500k$ for a vulnerability, that's an approximate 20-100 funding / vulnerability ratio.
Pidgin is at 25k$/year, for 100k$ for a vulnerability, so a ratio of 1:4.
I think the only reasonable conclusion is that community-driven opensource projects are 100 time safer than private company-funded opensource projects /s
Like, I understand why that's the case, but it still sucks.
OSS projects aren't people with curable diseases. Most of them are labors of love, run by people in their spare time. Those people have needs that are mostly not met by working on open source projects. Epsilon open source projects are well-enough funded that nobody in the project feels starved for resources.
Bug bounty programs are only useful for these projects if the details of the bug are shared with the project. Zerodium's model relies on keeping developers unaware of the bugs for as long as possible [1].
Nobody developing OSS is grateful for programs like Zerodium.
[1]: https://security.stackexchange.com/questions/199480/what-doe...
> Zerodium customers are government organizations (mainly from Europe and North America) in need of advanced zero-day exploits and cybersecurity capabilities.
Based off Zerodium’s origin and reputation, it seems an exploit is sought which enables a governmental actor to examine information that it otherwise could not. I am assuming they do not have a legal basis for doing so or courts would have granted/ordered such access.
It's also possible that they have a lawful basis and warrant, but realise executing a physical warrant won't get access to what's required - with e2e encrypted chats going over Pidgin, on an encrypted laptop, you need to be very confident that when you swoop, the laptop is on and decrypted. You get one "go" at that, otherwise you have a suspect, little or no evidence, and an attorney requesting their immediate release on bail absent any actual evidence, which would let them flee and clean up any other evidence that may be out there, either with them or others.
Are there some activist or terrorist monitored by a 3 letter agency that is computer literate enough to use Linux + pidgin to try and keep away from prying eyes (or just plain ethical reasons)? Or would the exploit end up being targeted at some foreign government that has standardized on Pidgin?
(I'm sure plenty of people do actually do that; just lamenting the fact rather than expressing skepticism at the plausibility.)
Fortunately I recovered it before any of the virus-riddled crapware he downloaded noticed it was there, haha
I suspect that this use also causes those that are not doing Tails to use Pidgin on Windows to communicate with those that are. After all, Pidgin is in Tails. It must be secure.
This is to say that FOSS needs more funding and contributors; rest of the industry can do whatever they want, and we wouldn’t care.