PWN 2 PAWN: Why the Vista hacker turned to eBay

Filthy lucre not the point, honest

When Shane Macaulay tried to sell the Fujitsu U810 laptop he won in a hacking contest last week, it seemed almost like an April Fool's joke.

He said that a top quality hacker could probably examine the machine's hard drive and dig up the unpatched zero-day exploit code he had used to compromise the computer in the PWN 2 OWN contest that he'd just won. "This laptop is a good case study for any forensics group/company/individual that wants to prove how cool they are, and a live example, not canned of what a typical incident response sitchiation [sic] would look like," he wrote in his listing.

At first blush, this seemed like a clear violation of both the rules of the contest's sponsor, TippingPoint, and of eBay's terms of service, and his listing was pulled within hours by eBay staff. The company said it had to go because it could have harmed users.

But Macaulay says that was never his intent. In a Tuesday interview with IDG News he explained that Adobe Systems plans to patch his Flash bug on April 8, the day his auction was set to end, and so he would have been practicing responsible disclosure, releasing details of a flaw that had already been patched. The following is an edited version of this interview.

Why did you try to sell this laptop on eBay?

I wanted to get a sense for what a market price would be for a zero-day exploit. It's really hard to get that. To get a true price on it violates the policy of eBay, so I had to make limited disclosures to them and then limited disclosures to the vendors and other groups to allow that to happen.

Why were you wondering about that?

I've been involved in several attempts to make a sale of these sorts of items to groups that have presented themselves to me as being legitimate users of these things. You give them the exploit or the zero-day code and they want to evaluate it themselves before they pay you. So you can imagine how that goes. You have no leverage in your sale and they change their price... and the person who spent all this time and investment personally into this item loses the ability to make any money.

Were you surprised that eBay took your auction down?

No, because I was a little rushed in my posting. I've got an e-mail group list [at eBay] that I was going to apply to earlier in the process and at least apprise them of the background story, and say, "Hey this is going to be in line with the disclosure process of this vendor and [contest sponsor TippingPoint's] Zero Day Initiative. So by the time this closes, it's going to be non-zero-day."

It was going to afford me the chance to get at least a bidding process where the bidders were bidding while it was zero day.

What do you mean by "non-zero-day?

That the patch was going to be available and possibly even automatically rolled out to the users of this software. Today there's no defense. You, the user of this software are going to get hacked. By the time the auction would have closed, it would have been non-zero-day and it would have been patched.

So the auction was sent to end on April 8. When is the patch supposed to come out then?

On the 8th.

You said earlier that this flaw would work on 90 per cent of systems out there. Why target Vista?

I had just done a lot of my work in the past on Windows. I'm a very avid Linux users, but I haven't been working on Linux exploits since 2001. I'm really good at the Windows platform right now because that's where I've been focusing all my attention for almost a decade. To go back to Linux now would be too much of a learning experience.

A lot has been made of this contest by fans of different operating systems. What would you take away from this?

People want to believe that they're right about what they're using. They're very much attached to it and they use it every day, and they really want to believe that they're doing the right thing. There's no difference in my mind between any of them.

Are you going to enter the contest next year?

Yeah, get the trifecta going on. I've already got a number of things probably that I could use.

What operating system will you target?

Macaulay: Maybe Linux, just for fun.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?