Whenever there’s something that some people value, there will be a marketplace for it. A few years ago, I spent a fascinating hour with a detective exploring the online marketplaces that exist in the so-called “dark web” (shorthand for the parts of the web you can only get to with a Tor browser and some useful addresses). The marketplaces we were interested in were ones in which stolen credit card details and other confidential data are traded.
What struck me most was the apparent normality of it all. It’s basically eBay for crooks. There are sellers offering goods (ranges of stolen card details, Facebook, Gmail and other logins etc) and punters interested in purchasing same. Different categories of these stolen goods are more or less expensive. (The most expensive logins, as I remember it, were for PayPal). But the funniest thing of all was that some of the marketplaces operated a “reputation” system, just like eBay’s. Some vendors had 90%-plus ratings for reliability etc. Some purchasers likewise. Others were less highly regarded. So, one reflected, there really is honour among thieves.
But it’s not just credit cards and logins that are valuable in this underworld. The most highly prized “goods” are what hackers call “exploits” – ie specialist knowledge of vulnerabilities in operating systems or other software that can be exploited by intruders for malign purposes. And within this category the really, really valuable ones are “zero-day” exploits. These are aimed at software vulnerabilities that, prior to their discovery, were completely unknown; in other words, they are vulnerabilities with no known patches and can therefore be exploited until a fix has been found.
There are, as you might expect, specialised marketplaces in which zero-day exploits are traded. Some of the most avid purchasers are the security agencies of governments. I’m sure that GCHQ, the NSA and the CIA, for example, maintain stockpiles of zero-day exploits, some internally discovered by their geeks together with some purchased from the market. But there are other, even less savoury customers too. And there are vendors of varying degrees of transparency and integrity who operate in the marketplace. Companies like Zerodium, for example, which describes itself as “the leading exploit acquisition platform for premium zero-days and advanced cybersecurity capabilities”, operate openly. Their modus operandi seems to involve connecting ethical hackers and computer scientists who have discovered vulnerabilities with organisations whose computer systems might suffer from them and would therefore value being alerted.
Some zero-day exploits can fetch high prices. This week Zerodium announced that it will pay $2.5m to security researchers who provide exploits that allow the complete takeover of Android phones without requiring the target to click on anything. But the big news in the announcement was that Zerodium was valuing the same kinds of exploits on Apple’s iOS operating system at only $2m. Given that the Android system is notoriously littered with security vulnerabilities while iOS is reckoned to be relatively secure, the discrepancy looked like a misprint. Surely the rewards for cracking the more secure system should be higher?
In principle, yes. But on 29 August, Google’s Threat Analysis Group’s researchers revealed that m alicious websites had been covertly and successfully hacking iPhones for years. The hacked sites were being used in “indiscriminate watering hole attacks” against their visitors, using iPhone zero-day exploits. Simply visiting a hacked site was enough for the exploit server to attack the iPhone, and if it was successful, install a monitoring implant. Google estimated that these sites received “thousands of visitors” per week. And an enigmatic passage in the Google report – “To be targeted might mean simply being born in a certain geographic region or being part of a certain ethnic group” – has led to fevered speculation that the culprit was China and the target its Muslim Uighur minority.
This revelation of iOS’s unsuspected vulnerability came as a shock to a world that had assumed that the orderly, tightly controlled Apple software ecosystem would be more secure than the chaotic, multi-versioned and unpoliced Android system. Nothing, remember, goes on an iPhone that Apple has not vetted and approved, whereas anything goes on Android. But the corollary of this is that iOS is a complacent monoculture – a vast billion-strong monoculture. That has two consequences. One is that it’s a juicy target for attackers. The other is that if you are confident that your phone is secure then you will be cavalier in what you do with it. Which leads one to wonder how many Uighurs are now ruing the day they first thought of buying an iPhone.
What I’m reading
Ne’er the twain
Two systems, one world. That’s the subject of a thoughtful essay on the Project Syndicate site by Joshka Fischer, former German foreign minister, about the prospect of a bi-polar world dominated by China and the US.
The word on the street
There’s some wonderful reportage by Maciej Cegłowski on his idlewords.com blog about being among the demonstrators on the streets of Hong Kong.
That’s the way to do it…
How to review a novel: the title of a characteristically acute, amusing and perceptive essay on Literary Hub by Mary-Kay Wilmers, co-founder and long-time editor of the London Review of Books.