5 ms·

Applying a zero-day exploit without making it public doesn't burn anything. After all, no one knows how they did it.

by bootloop 8y ago

solarkraft 8y ago
But would they even risk raising suspicion?
- gph 8y ago
  I'm confused why anyone in this thread chain would think a firm like Ernst and Young would have access to zero-days?
  - g45y45 8y ago
    0days are not magic. Stare enough at code and you will find them. E&Y and the other Professional Services companies have a big pentesting team, and they would have made discoveries on their own regarding system security. Any company with a large security / research team would have 0days. What they do with them, (report, sit, burn, etc) is up the organizational and individual ethics of the operator.
  - dagw 8y ago
    Ernst and Young are huge and do a lot of very sophisticated forensic accounting work. If they don't have people in house, they almost certainly have the phone number to someone who does.
  - barkingcat 8y ago
    Because 0-days are accessible to anyone with money. And Ernst and Young would have a ton of money, and plenty of opportunities where clients would come to them and hire them privately about issues like this. Coming up with 0-days is moderately hard with your own cracking team. Buying them is an easy thing to do. Ultimately, that's what 0-days are for in the wider market. You find one and sell it.
- stordoff 8y ago
  Why would it? If no one else knows the password, just say it was a weak password (or even that you got lucky). There's $137m missing, so clearly something went wrong - one more mistake wouldn't be hard to believe. Even if it does, does it matter? "There's a vulnerability in <OS>" is not exactly news or useful.
- barkingcat 8y ago
  they probably do this every day. At this level, it would have needed to be packaged similar to the way the NSA tools were. A package of tools that comes on a hardened usb key, just plug it in in the field and it runs through the 0days that it knows about.

Applying a zero-day exploit without making it public doesn't burn anything. After all, no one knows how they did it.

solarkraft 8y ago

But would they even risk raising suspicion?

gph 8y ago
I'm confused why anyone in this thread chain would think a firm like Ernst and Young would have access to zero-days?
- g45y45 8y ago
  0days are not magic. Stare enough at code and you will find them. E&Y and the other Professional Services companies have a big pentesting team, and they would have made discoveries on their own regarding system security. Any company with a large security / research team would have 0days. What they do with them, (report, sit, burn, etc) is up the organizational and individual ethics of the operator.
- dagw 8y ago
  Ernst and Young are huge and do a lot of very sophisticated forensic accounting work. If they don't have people in house, they almost certainly have the phone number to someone who does.
- barkingcat 8y ago
  Because 0-days are accessible to anyone with money. And Ernst and Young would have a ton of money, and plenty of opportunities where clients would come to them and hire them privately about issues like this. Coming up with 0-days is moderately hard with your own cracking team. Buying them is an easy thing to do. Ultimately, that's what 0-days are for in the wider market. You find one and sell it.
stordoff 8y ago
Why would it? If no one else knows the password, just say it was a weak password (or even that you got lucky). There's $137m missing, so clearly something went wrong - one more mistake wouldn't be hard to believe. Even if it does, does it matter? "There's a vulnerability in <OS>" is not exactly news or useful.
barkingcat 8y ago
they probably do this every day. At this level, it would have needed to be packaged similar to the way the NSA tools were. A package of tools that comes on a hardened usb key, just plug it in in the field and it runs through the 0days that it knows about.