[ISN] The Black Market Code Industry

http://www.fastcompany.com/magazine/127/nexttech-fear-of-a-black-hat.html

By Adam L. Penenberg
Fast Company
Issue 127 | July 2008

Inside the shadowy underworld where rogue employees sell holes in their 
companies' software. The buyers: security firms, mobsters, and -- 
surprise -- the U.S. government.

Juergen Marester, a 24-year-old French network consultant, needed seed 
capital to start his own computer-security company. So he turned to his 
off-hours hobby -- black-hat hacking -- and did what a growing number of 
hackers are doing: selling "0days" (pronounced "oh-days" or "zero days," 
it generally refers to unknown, or zero-hour, software threats). These 
are recipes and code for penetrating the software run by governments, 
corporations, and private citizens. When properly deployed, 0days can 
result in minor disruptions such as a Web site's temporary paralysis. At 
their extreme, they grant an attacker total control over a network.

In August 2007, Marester announced on a popular computer-security forum 
that he had 0days for Linux, HP-UX (the computer maker's popular Unix 
database software), Microsoft Windows, and Apache. "Please let me 
message by mail if you are interested," he typed. By mid-September, he 
also offered 0days for SAP, Mozilla Firefox, Microsoft's Office 2003 and 
2007, and Internet Explorer. "For any interest, please mail me to this 
adress [sic]. Good bye and have a good day."

The posts weren't unusual for this forum, except, perhaps, for their 
politeness. They provide a window into a thriving black market for 
hackerware, where computer-security firms, mobsters, corporate spies, 
cybercrime rings, and government agents rub shoulders with code jockeys 
looking to score quick bucks. Any company or government entity running 
popular programs, such as the ones on Marester's list of targeted 
software, is at risk, and governments -- both allies and enemies of the 
United States -- are among the biggest buyers. According to the 
Electronic Frontier Foundation, as a general rule, it isn't illegal to 
offer vulnerabilities (the holes in software) and exploits (the code 
that does the actual penetration) for sale. What's different about 
Marester's case, as I would learn, is that the seller worked for one of 
the companies whose code he promised to compromise.

I first learned of Marester from an American computer-security 
consultant, who had been taken aback by the sheer number of 0days -- 
some of them very powerful -- that Marester was hawking. In the interest 
of protecting his own clients, the security professional and some 
colleagues posed as buyers and, over the course of four months, won the 
hacker's confidence. Eventually, Marester revealed his true identity in 
order to collect his bounty. The security pros, who requested anonymity 
for this article, turned over their evidence to me, including an 
extensive email trail.

[...]


_______________________________________________      
Attend Black Hat USA, August 2-7 in Las Vegas, 
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings 
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.  
Visit product displays by 30 top sponsors in 
a relaxed setting. http://www.blackhat.com