Free Newsletters
Technology & Business Daily

InfoWorld
Log-in | Register

Why the Vista hacker turned to eBay

Interview: Hacker Shane Macaulay says he never intended to harm users by auctioning a laptop with Vista attack code on it


When Shane Macaulay tried to sell the Fujitsu U810 laptop he won in a hacking contest last week, it seemed almost like an April Fool's joke.

He said that a top-quality hacker could probably examine the machine's hard drive and dig up the unpatched zero-day exploit code he had used to compromise the computer in the PWN 2 OWN contest that he'd just won. "This laptop is a good case study for any forensics group/company/individual that wants to prove how cool they are, and a live example, not canned of what a typical incident responce sitchiation [sic] would look like," he wrote in his listing.

At first blush, this seemed like a clear violation of both the rules of the contest's sponsor, TippingPoint, and of eBay's terms of service, and his listing was pulled within hours by eBay staff. The company said it had to go because it could have harmed users.

But Macaulay says that was never his intent. In a Tuesday interview with IDG News, he explained that Adobe Systems plans to patch his Flash bug on April 8, the day his auction was set to end, so he would have been practicing responsible disclosure, releasing details of a flaw that had already been patched. The following is an edited version of this interview.

IDG News Service: Why did you try to sell this laptop on eBay?
Shane Macaulay: I wanted to get a sense for what a market price would be for a zero-day exploit. It's really hard to get that. To get a true price on it violates the policy of eBay, so I had to make limited disclosures to them and then limited disclosures to the vendors and other groups to allow that to happen.

IDGNS: Why were you wondering about that?
Macaulay: I've been involved in several attempts to make a sale of these sorts of items to groups that have presented themselves to me as being legitimate users of these things. You give them the exploit or the zero-day code, and they want to evaluate it themselves before they pay you. So you can imagine how that goes. You have no leverage in your sale and they change their price... and the person who spent all this time and investment personally into this item loses the ability to make any money.

IDGNS: Were you surprised that eBay took your auction down?
Macaulay: No, because I was a little rushed in my posting. I've got an e-mail group list [at eBay] that I was going to apply to earlier in the process and at least apprise them of the background story, and say, "Hey this is going to be in line with the disclosure process of this vendor and [contest sponsor TippingPoint's] Zero Day Initiative. So by the time this closes, it's going to be non-zero-day."

It was going to afford me the chance to get at least a bidding process where the bidders were bidding while it was zero day.

Continued
1 | 2 | NEXT PAGE » 


Talkback:

commentPost a Comment

 

MOST COMMENTS

 
 





Beyond AntiVirus: Symantec Endpoint Protection
Today's threats to the endpoint are much more dangerous as they rapidly evolve to evade traditional security measures. To combat these threats, companies should supplement existing security with proactive behavioral based technologies. Join this webcast to learn about Symantec's next generation AntiVirus solution that provides that level of protection. Sponsor: Symantec

»  Click here to view this Webcast
  Virtualization Solutions Guide
This comprehensive IT Strategy Guide covers Virtualization and puts you at the forefront of the discussion. You'll learn all you need to know from the cost of virtualization, how to implement it for your business, how to back it up safely and which products are best. Sponsored by Riverbed

»  Click here to download now

- Special Advertising Partners -
WHITE PAPERS
 

» Technology White Papers Library

Technology White Papers by Topic

Technology White Papers E-mail Alert

Find out when the latest white paper is available:
 
 
INFOWORLD MARKETPLACE
 
» BUY A LINK NOW
 
 

Video

 
 
 

Podcasts

 
 
 

 

Columnists

 
 
 

Resource Center


Ads by techwords beta  [See your link here]
 




Sponsored Technology Links

 
 
 HOME  NEWS  BLOGS  PODCASTS  VIDEOS  TECHNOLOGIES  TEST CENTER  EVENTS  CAREERS   About | Advertise | Awards | RSS | Contact Us 

Copyright © 2008, Reprints, Permissions, Licensing, IDG Network, Privacy Policy, Terms of Service.
All Rights reserved. InfoWorld is a leading publisher of technology information and product reviews on topics including viruses,
phishing, worms, firewalls, security, servers, storage, networking, wireless, databases, and web services.

CIO :: ComputerWorld :: CSO :: Demo :: GamePro :: Games.net :: IDG Connect :: IDG World Expo
Industry Standard :: IT World :: JavaWorld :: LinuxWorld :: MacUser :: Macworld :: Network World :: PC World :: Playlist