Cyberwar's Secret Trade

Behind computer screens from France to Fort Worth, Texas, elite hackers hunt for security vulnerabilities worth thousands of dollars on a secretive unregulated marketplace.

Using sophisticated techniques to detect weaknesses in widely used programs like Google Chrome, Java, and Flash, they spend hours crafting “zero-day exploits” — complex codes custom-made to target a software flaw that has not been publicly disclosed, so they can bypass anti-virus or firewall detection to help infiltrate a computer system.

Like most technologies, the exploits have a dual use. They can be used as part of research efforts to help strengthen computers against intrusion. But they can also be weaponized and deployed aggressively for everything from government spying and corporate espionage to flat-out fraud. Now, as cyberwar escalates across the globe, there are fears that the burgeoning trade in finding and selling exploits is spiralling out of control — calls for new laws to rein in the murky trade.

Some legitimate companies operate in a legal gray zone within the zero-day market, selling exploits to governments and law enforcement agencies in countries across the world. Authorities can use them covertly in surveillance operations or as part of cybersecurity or espionage missions. But because sales are unregulated, there are concerns that some gray market companies are supplying to rogue foreign regimes that may use exploits as part of malicious targeted attacks against other countries or opponents. There is also an anarchic black market that exists on invite-only Web forums, where exploits are sold to a variety of actors — often for criminal purposes.

The importance of zero-day exploits, particularly to governments, has become increasingly apparent in recent years. Undisclosed vulnerabilities in Windows played a crucial role in how Iranian computers were infiltrated for surveillance and sabotage when the country’s nuclear program was attacked by the Stuxnet virus (an assault reportedly launched by the United States and Israel). Last year, at least eight zero days in programs like Flash and Internet Explorer were discovered and linked to a Chinese hacker group dubbed the “Elderwood gang,” which targeted more than 1,000 computers belonging to corporations and human rights groups as part of a shady intelligence-gathering effort allegedly sponsored by China.

The most lucrative zero days can be worth hundreds of thousands of dollars in both the black and gray markets. Documents released by Anonymous in 2011 revealed Atlanta-based security firm Endgame Systems offering to sell 25 exploits for $2.5 million. Emails published alongside the documents showed the firm was trying to keep “a very low profile” due to “feedback we've received from our government clients.” (In keeping with that policy, Endgame didn’t respond to questions for this story.)

But not everyone working in the business of selling software exploits is trying to fly under the radar — and some have decided to blow the whistle on what they see as dangerous and irresponsible behaviour within their secretive profession.

Adriel Desautels, for one, has chosen to speak out. The 36-year-old “exploit broker” from Boston runs a company called Netragard, which buys and sells zero days to organizations in the public and private sectors. (He won’t name names, citing confidentiality agreements.) The lowest-priced exploit that Desautels says he has sold commanded $16,000; the highest, more than $250,000.

Unlike other companies and sole traders operating in the zero-day trade, Desautels has adopted a policy to sell his exploits only domestically within the United States, rigorously vetting all those he deals with. If he didn’t have this principle, he says, he could sell to anyone he wanted — even Iran or China — because the field is unregulated. And that’s exactly why he is concerned.

“As technology advances, the effect that zero-day exploits will have is going to become more physical and more real,” he says. “The software becomes a weapon. And if you don’t have controls and regulations around weapons, you’re really open to introducing chaos and problems.”

Desautels says he knows of “greedy and irresponsible” people who “will sell to anybody,” to the extent that some exploits might be sold by the same hacker or broker to two separate governments not on friendly terms. This can feasibly lead to these countries unwittingly targeting each other’s computer networks with the same exploit, purchased from the same seller. “If I take a gun and ship it overseas to some guy in the Middle East and he uses it to go after American troops — it’s the same concept,” he says.

The position Desautels has taken casts him as something of an outsider within his trade. France’s Vupen, one of the foremost gray-market zero-day sellers, takes a starkly different approach. Vupen develops and sells exploits to law enforcement and intelligence agencies across the world to help them intercept communications and conduct “offensive cyber security missions,” using what it describes as “extremely sophisticated codes” that “bypass all modern security protections and exploit mitigation technologies.”

Vupen’s latest financial accounts show it reported revenue of about $1.2 million in 2011, an overwhelming majority of which (86 percent) was generated from exports outside France. Vupen says it will sell exploits to a list of more than 60 countries that are members or partners of NATO, provided these countries are not subject to any export sanctions. (This means Iran, North Korea, and Zimbabwe are blacklisted — but the likes of Kazakhstan, Bahrain, Morocco, and Russia are, in theory at least, prospective customers, as they are not subject to any sanctions at this time.)

“As a European company, we exclusively work with our allies and partners to help them protect their democracies and citizens against threats and criminals,” says Chaouki Bekrar, Vupen’s CEO, in an email. He adds that even if a given country is not on a sanctions list, it doesn’t mean Vupen will automatically work with it, though he declines to name specific countries or continents where his firm does or does not have customers.

Vupen’s policy of selling to a broad range of countries has attracted much controversy, sparking furious debate around zero-day sales, ethics, and the law. Chris Soghoian of the ACLU — a prominent privacy and security researcher who regularly spars with Vupen CEO Bekrar on Twitter — has accused Vupen of being “modern-day merchants of death” selling “the bullets for cyberwar.”

“Just as the engines on an airplane enable the military to deliver a bomb that kills people, so too can a zero day be used to deliver a cyberweapon that causes physical harm or loss of life,” Soghoian says in an email. He is astounded that governments are “sitting on flaws” by purchasing zero-day exploits and keeping them secret. This ultimately entails “exposing their own citizens to espionage,” he says, because it means that the government knows about software vulnerabilities but is not telling the public about them.

Some claim, however, that the zero-day issue is being overblown and politicized. “You don’t need a zero day to compromise the workstation of an executive, let alone an activist,” says Wim Remes, a security expert who manages information security for Ernst & Young.

Others argue that the U.S. government in particular needs to purchase exploits to keep pace with what adversaries like China and Iran are doing. “If we’re going to have a military to defend ourselves, why would you disarm our military?” says Robert Graham at the Atlanta-based firm Errata Security. “If the government can’t buy exploits on the open market, they will just develop them themselves.” He also fears that regulation of zero-day sales could lead to a crackdown on legitimate coding work. “Plus, digital arms don’t exist — it’s an analogy. They don’t kill people. Bad things really don’t happen with them.”

*****

So are zero days really a danger? The overwhelming majority of compromises of computer systems happen because users failed to update software and patch vulnerabilities that are already known about. However, there are a handful of cases in which undisclosed vulnerabilities — that is, zero days — have been used to target organizations or individuals.

It was a zero day, for instance, that was recently used by malicious hackers to compromise Microsoft’s Hotmail and steal emails and details of the victims' contacts. Last year, it was reported that a zero day was used to target a flaw in Internet Explorer and hijack Gmail accounts. Noted “offensive security” companies such as Italy’s Hacking Team and the England-based Gamma Group are among those to make use of zero-day exploits to help law enforcement agencies install advanced spyware on target computers — and both of these companies have been accused of supplying their technologies to countries with an authoritarian bent. Tracking and communications interception can have serious real-world consequences for dissidents in places like Iran, Syria, or the United Arab Emirates. In the wrong hands, it seems clear, zero days could do damage.

This potential has been recognized in Europe, where Dutch politician Marietje Schaake has been crusading for groundbreaking new laws to curb the trade in what she calls “digital weapons.” Speaking on the phone from Strasbourg, France*, Schaake tells me she’s concerned about security exploits, particularly where they are being sold with the intent to help enable access to computers or mobile devices not authorized by the owner. She adds that she is considering pressing for the European Commission, the EU’s executive body, to bring in a whole new regulatory framework that would encompass the trade in zero days, perhaps by looking at incentives for companies or hackers to report vulnerabilities that they find.

Such a move would likely be welcomed by the handful of organizations already working to encourage hackers and security researchers to responsibly disclose vulnerabilities they find instead of selling them on the black or gray markets. The Zero Day Initiative, based in Austin, Texas, has a team of about 2,700 researchers globally who submit vulnerabilities that are then passed on to software developers so they can be fixed. ZDI, operated by Hewlett-Packard, runs competitions in which hackers can compete for a pot of more than $100,000 in prize funds if they expose flaws. “We believe our program is focused on the greater good,” says Brian Gorenc, a senior security researcher who works with the ZDI.

Yet for some hackers, disclosing vulnerabilities directly to developers lacks appeal because greater profits can usually always be made elsewhere. When I ask Vupen’s Bekrar what he thinks of responsible disclosure programs, he is critical of “lame” rewards on offer and predicts that for this reason an increasing number of skilled hackers in the future will “keep their research private to sell it to governments.” It may also be the case that, no matter what the financial incentive, for some it will always be more of a thrill to shun the “responsible.” So even if regulators internationally were to somehow curb exploit sales, it’s likely it would only have a tangible impact on legitimate companies like Vupen, Endgame, Netragard, and others. There would remain a burgeoning black market, in which vulnerabilities are sold off to the highest bidder. This market exists in an anarchic pocket of the Internet, a sort of Wild West, where legality is rarely of paramount importance — as former Washington Post reporter Brian Krebs recently found out for himself.

Krebs, who regularly publishes scoops about zero days on his popular blog, has on several occasions been besieged by hackers after writing about vulnerabilities circulating on the black market. Krebs says his website came under attack last year after he exposed a zero day that was being sold on an exclusive, invite-only Web forum. “They don’t like the attention,” he says. The hackers were able to find Krebs’ home IP address. Then, they began targeting his Internet connection and taunting him. Krebs was eventually forced to change his router and has since signed up for a service that helps protect his online identity. But he says he still receives malware by email “all the time.”

It’s difficult to imagine how the aggressive black market that Krebs encountered could ever be efficiently curtailed by laws. That is why the best way for vulnerabilities to be fully eliminated — or at least drastically reduced — would perhaps be to place a greater burden on the software developers to raise standards. If only developers would invest more in protecting user security by designing better, safer software and by swiftly patching security flaws, the zero-day marketplace would likely be hit by a crushing recession.

At present, however, that remains an unlikely prospect. And unfortunately it seems there’s not a great deal you can do about it, other than to be aware of the risk.

“Most organizations are one zero day away from compromise,” Krebs says. “If it’s a widely used piece of software, you’ve just got to assume these days that it’s got vulnerabilities that the software vendors don’t know about — but the bad guys do.”

This article first appeared at Slate.

GPS Tracking, USA

The tools once reserved for intelligence operatives have become increasingly cheap and available in recent years, and perhaps no one has benefited from this more than private investigators who make their money by monitoring suspected cheaters. No longer do they have to sit outside a seedy motel for hours, trying to take pictures of a philandering husband and his mistress entering a room together. They need only attach a GPS device to the suspected adulterer’s car, and the client’s suspicions can be confirmed.

In a landmark ruling in January, the US Supreme Court held that law enforcement use of GPS trackers to monitor movements constitutes a “search.” That means the technology falls under the Fourth Amendment’s protections against unreasonable searches and seizures, making it difficult for police to put a tracker on a car without first obtaining a warrant. But for private individuals, laws around the use of GPS trackers remain patchy, differing state to state.

Take California, Texas, Virginia, and Minnesota. These states allow private individuals to use tracking devices where the owner of a vehicle consents to it being monitored. Where there is no consent, it is considered a misdemeanor that can result in a fine and a jail sentence of six to 12 months. If a vehicle is jointly owned — say, by a husband and wife — and one owner wants to secretly track the other, it’s a murky area that’s as ethically dubious as it is legally contentious. However, that isn’t stopping private investigators — some of whom appear willing to track any vehicle regardless of its ownership.

In a bid to find out whether private eyes are adhering to the law, earlier this month I decided to dabble in a bit of undercover investigating of my own. Posing as a suspicious wife and using a fake email address, I wrote to a number of PIs in the states with the strictest laws on the use of GPS surveillance trackers. Those I randomly selected were all advertising a GPS service openly on their websites, and I emailed to request a quote for how much it would cost to “GPS monitor movements of my husband's car” over a two-week period.

Of the 20 investigators I contacted, 16 replied, and only one declined to offer me some sort of GPS tracking citing legal concerns. The majority of the PIs said they would do it on the condition that my name was on the title of the car, with some offering to provide a DVD of its movements and others offering “real-time” surveillance of the vehicle for me to watch live via cellphone or computer.

Two separate investigators in California I approached expressed no immediate concern for the state’s GPS tracking law, which unequivocally outlaws tracking a car without the consent of its owner. Still using the fake name and email address, I asked whether the investigators would be willing and able to monitor more than one vehicle at a time. “There is another person who I believe is involved with my husband and it would be useful for me to check her car's movements at the same time as my husband's,” I wrote.

The response from Irvine, Calif.-based Hudson Investigations was a straight yes. “I could do it for $1200 including install and removal,” company boss Rick Hudson, a former Orange County police officer, told me. I received a similarly affirmative answer from Western Investigations, a firm headquartered near San Diego that claims on its website to be one of the most experienced PI agencies in California. “You are looking at a total of $1,800 for 2 vehicles for 2 weeks of the tracking,” Western Investigations’ general manager wrote. “We will give you access to monitor it yourself during the entire course of the investigation. And if you would like a location history report at the conclusion of the investigation, we can do so as well.”

When I subsequently contacted Western Investigations under my real name about this story, I asked whether it was aware the service I requested is classified as a misdemeanor under California’s penal code. “If I gave you the wrong impression then I was mistaken,” the GM wrote back in an email, insisting that the company would not install a tracking device without the consent of the registered owner. Western Investigations’ owner Patrick Schneemann then told me in a separate message, “I can assure you that our company policy is that we do not use GPS in our investigations unless we have consent from the owner of the vehicle.”

Rick Hudson at Hudson Investigations said he was sure he had mentioned the legal constraints in his emails (he didn’t) and said that he wouldn’t put a tracker on any vehicle without signing a GPS agreement with the customer that says that they have the authorisation. Hudson added that he gets “so many calls regarding these tracking units that it's crazy.”

Other PI companies were reluctant to directly help me track the vehicles but instead offered to sell or rent me GPS tracking equipment. This would mean any unlawful use of the tracker would be on my shoulders and not those of a PI. In one instance, even after I informed Texas-based LP Dynamics that I was looking to track two vehicles, one of which had no ownership connection to me, I was offered "2 passive GPS units" for $125 each. A company representative emailed: "Just place on a vehicle, remove when you want and download to your computer to see where they have been." When I later contacted the company for this story, CEO Michael Morrison emailed that "we are a licensed private investigation corporation and not an attorney." Morrison rightly stated that LP Dynamics follows Texas law "to the letter" because the penal code covers only the installation of tracking systems but not the sale of the devices. This could be considered something of a legal loophole.

The solitary exception was California-based Orange Investigations, run by former military policeman Ryan Garrahy. Of the 16 that responded to me, Garrahy was the only PI to completely stonewall my request. Orange Investigations has previously provided GPS tracking for its clients, but Garrahy said he has stopped doing so “at this particular time” because of concerns about a possible rise in civil suits linked to the Supreme Court decision in January.

*****

Overall, the impression I got was that it was not difficult to find companies willing to help me track any vehicle, which could potentially result in a misdemeanor being committed. Even the investigators who were more cautious, telling me that they would only track a vehicle I had an “ownership interest” in, were on shaky ground. Though a case in Minnesota last year ruled that it was acceptable to use a GPS tracker on your spouse if you co-own the car, there is far from a legal consensus on the matter in other states.

Austin, Texas-based criminal lawyer Ian Inglis told me he thought that the Texas statute on tracking wasn’t constructed with joint ownership in mind. “Even if there’s no criminal liability, there could be some civil liability, and it might look bad in a divorce, too,” Inglis said. “Whether it’s your husband or wife, it’s a bad idea to track anybody’s car without their permission.”

In California, similarly, it’s a gray area. Hanni Fakhoury, staff attorney at the Electronic Frontier Foundation, said he wasn’t aware of any statutory California law that addressed the joint ownership question. Fakhoury referred to Georgia v. Randolph, a Supreme Court case where it was ruled that there needed to be joint agreement for the lawful search of a jointly owned property. According to Fakhoury, the joint consent deemed necessary in Randolph is consistent with other California law and so could feasibly apply to the use of trackers on a jointly owned vehicle. (Californian wiretap law, for instance, requires both parties to a conversation to consent to having the conversation recorded — unlike federal wiretap law, which only requires one party to consent.)

Contentious legal issues aside, what’s clear is that the use of GPS tracking devices is very far from being under control. While law enforcement agencies are now bound to consider the trackers as covered by the Fourth Amendment, in the private domain there’s a lack of clarity when it comes to the regulation. Where there are laws, in some cases they are being ignored, and where there is any ambiguity, it is being exploited — often by individuals who stand to make a profit.

As is frequently the case in the realm of surveillance, the technology is out of step with the law. High-tech tracking tools that would a decade ago have rarely been used outside police and military circles are available today to anyone with a credit card and access to the Internet. The technology is continuing to advance and is simultaneously becoming cheaper. And that’s not going to change any time soon.

SpyBase, a surveillance gadgets retailer based out of Torrance, Calif., has seen in recent years a rapid increase in sales of GPS trackers, a trend that’s continuing. The store’s owner, who didn’t want to be named, told me GPS trackers were his “best-sellers,” and that a sophisticated $299 real-time tracker called the PTX 5 was his customers’ favorite.

“PIs, police, private citizens,” he said. “It’s a very big market.”

This article first appeared at Slate.