Hacking Contest Winner Explains eBay Auction

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
So everyone freaked when one of the PWN 2 OWN contest winners decided to auction off a laptop that contained the unpatched zero-day exploit code he had used to compromise the computer in the contest. The guy told InfoWorld his side of the story.

The company said it had to go because it could have harmed users. But Macaulay says that was never his intent. In a Tuesday interview with IDG News he explained that Adobe Systems plans to patch his Flash bug on April 8, the day his auction was set to end, and so he would have been practicing responsible disclosure, releasing details of a flaw that had already been patched.
Click to expand...
 
I still think that might have been a little soon. So the patch comes out on the 8th. How many people are actually going ot patch their machines right then. Although at the same time, some people probably wouldn't update period so I guess that really doesn't matter.
 
Why would you not wipe the drive and start from scratch anyway? How many friggin morons are there, that would buy a PC on the net, then just sit down and start using it without a fresh install.

Once again.... TOO STUPID TO LIVE. :eek::rolleyes::p

Wouldn't Egay be more helpful having caveat's in writing up everywhere that systems and storage is sold, to WIPE before using anything you buy. That would seem to be a better public service to thier (stoooopid'r) clients?
 
Yup a little too soon. I mean, you don't see everyone looking at their calendar and go "oops, it's April 8, time to upgrade Adobe Flash!"

"Practicing responsible disclosure" would be getting that tool off his machine first.

He should still be able to fetch a decent bid based on his fame alone.
 
xX_Jack_Carver_Xx said:
Why would you not wipe the drive and start from scratch anyway? How many friggin morons are there, that would buy a PC on the net, then just sit down and start using it without a fresh install.

Once again.... TOO STUPID TO LIVE. :eek::rolleyes::p

Wouldn't Egay be more helpful having caveat's in writing up everywhere that systems and storage is sold, to WIPE before using anything you buy. That would seem to be a better public service to thier (stoooopid'r) clients?
Click to expand...

What are you talking about? People would be buying this machine FOR the hack, not for the machine.

Hell he is selling it to give away the hack not because he wants to get rid of the machine. If he was just wanting to sell the laptop he would have wiped it clean first then sold it. But instead he left the hack on there, posted it on ebay stating the hack was on there and was trying to see how much a hack like that would go for in the market.
 
Personally I think it is perfectly timed. He gets rid of the laptop while it is still worth something. (it being the hack, not the laptop.) By the time the thing is shipped and someone could actually do something with the code it is going to be April 10th or 12th, 2-4 days after the patch has been released. Thats good enough for me. If you don't get a security patch within the first 2-3 days, chances are you'll wait a month or never get it.
 
Sounds ethical to me, but it is understandable that ebay would pull the auction.
 
It was his code, he should be able to sell it. Its not like its his fault Adobe can't follow protocol.
 
cybereality said:
It was his code, he should be able to sell it. Its not like its his fault Adobe can't follow protocol.
Click to expand...

It's my box of matches. I should be able to use it whenever I want, even to burn houses down.
 
Azhar said:
It's my box of matches. I should be able to use it whenever I want, even to burn houses down.
Click to expand...

Not quite the same thing. He's selling the box of matches to someone who might want to use it to burn down houses, in the hopes that the would-be victims put up the flame-retardant siding by then.
 
srangara said:
Not quite the same thing. He's selling the box of matches to someone who might want to use it to burn down houses, in the hopes that the would-be victims put up the flame-retardant siding by then.
Click to expand...

In the hopes? Merely selling the code and computer tells me he doesn't give a shit who's wearing flame redardant sidings on their houses or not.
 
A box of matches is not a good analogy. It has many legitimate uses other than burning houses down. Malicious code has no legal use, at least not to the general public, anyway.
 
HOCP4ME said:
A box of matches is not a good analogy. It has many legitimate uses other than burning houses down. Malicious code has no legal use, at least not to the general public, anyway.
Click to expand...

Giving how he worded his post. He could have wanted legit as well as illegit bids.

True there is no legit use for the general public. But you there is for security companies, people trying to learn how malicious code works so that they can learn how to combat it, and even for other developers to see where company X has went wrong so that they can check to see if they are doing the same in their code thus creating the same flaw. So while John Doe on the streets has no need for it, there are plenty of legal uses for such code.

Add to the that fact it was posted on ebay as opposed to some underground site. If somebody purchased it and 3 days later that expliot is in the wild it would be pretty obvious who it was that did it.

I could be wrong but from the sounds of it I really don't think he had any malicious intent with trying to sell it. Although I could be wrong as I am not him and don't know what he was thinking for sure.
 
You must log in or register to reply here.
Back
Top