0-day broadcast: A coming-of-age ceremony for safe communities

Anonymous GitHub accounts have released 47 undisclosed 0-day vulnerabilities in the past 72 hours, involving browser engines, mail servers, and industrial control protocol stacks. The safety zone exploded. CISA issued an emergency warning, manufacturers were working overtime, and the media headline read "Digital Pearl Harbor."

When I see this, the view is contrary to the mainstream: this is not a crisis, it is a good thing.

No, I'm not crazy. When I say "good things", I don't mean the loophole itself-of course the loophole is bad. I am talking about the behavior of "anonymous release", which is the inevitable drainage of long-term diseases in the security industry. The pustule was always there, but no one wanted to poke it. Now that someone has poked him, the pain is real, but it is better than being rotten to the bones.

This matter is not complicated, so you can understand it after taking a look.

vulnerability black market accounts, no one has ever calculated clearly

First look at a set of numbers. Zerodium's 2023 public price list shows that a 0-day offer for iOS remote jailbreak is US$2 million, Android is 1.5 million, and Chrome RCE is 500,000. This is just a public purchase price. What about private deals? I know a friend who works as a loophole broker (who does not do illegal things and is purely an intermediary). He told me that in 2022, a 0-day transaction against an industrial firewall was sold for US$3.7 million. The buyer was an intelligence agency of a Middle Eastern country.

$3.7 million for a loophole. Where does the money come from? Taxpayer. Where does this money go? Part of it goes to security researchers, and a large part goes to "service fees" for middlemen, brokerage companies, and anonymous trading platforms. In this chain, loopholes have become financial products, and security researchers have become arms dealers.

The problem is that this market is completely opaque. You have no way of knowing who a 0-day was sold to or what it was used for. The seller does not know, the buyer pretends not to know, but the regulatory authorities really do not know. The only thing that is certain is that vulnerabilities are flowing, attack capabilities are flowing, and the defenders-those vendors, corporate security teams, ordinary users-will always be the last to know.

This forms a deformed incentive mechanism. Tell me a counter-intuitive one:

After security researchers discover a vulnerability, they have three options:

1. reports to manufacturers and gets thousands to tens of thousands of dollars in bug bounty
2. is sold to legal acquirers like Zerodium for hundreds of thousands to millions of dollars
3. is privately sold to criminal organizations or hostile countries for more, but it is illegal

Option 1 is morally correct, option 3 is illegal, and option 2 is a gray area. The problem is that the price difference between options 1 and 2/3 is so large that it is no longer an economic decision but an ethical test. When you put an independent researcher with an annual salary of $80,000 to the temptation of $2 million, you are not testing human nature, you are tormenting human nature.

The black market for loopholes is essentially an information asymmetric arbitrage game --The attacker knows that the loopholes exist, the defender does not, and the middlemen earn the difference. The price of this game is everyone's safety.

Why do smart people do stupid things together?

Which brings me to the motif I've been thinking about: Why do smart people do stupid things together?

There is no shortage of smart people in the security industry. Instead, it's one of the smartest people on earth. They can reverse binary, bypass ASLR, and construct sophisticated ROP chains. But the entire industry has collectively chosen the stupidest solution when it comes to vulnerability handling: pretend that the vulnerability does not exist unless someone makes it public.

I have been in the safety circle for fifteen years and have seen this cycle too many times. The researcher discovered the loophole and reported it privately to the manufacturer. The manufacturer delayed it for six months. The researcher threatened to disclose it. The manufacturer's legal department issued a lawyer's letter, and the researcher either swallowed it or made it anonymous. As a result, people who really want to do things are forced to become "bad people," while criminal organizations that really use loopholes do not follow this process at all. They directly buy, sell, and attack directly.

[SVG Figure 1: The flow path of vulnerability from discovery to exploitation]

This picture makes one thing clear: The moral line is designed for gentlemen, but gentlemen suffer losses in this system . The black market of loopholes turns discovery into an asset. You donate your assets for free and are threatened by a lawyer's letter. What kind of incentive mechanism is this?

There was a case I remember clearly before. In 2018, a security researcher discovered a serious vulnerability in a well-known VPN product. He reported it to the manufacturer, and the manufacturer delayed it for eight months. He finally disclosed the details of the vulnerability on Twitter, and the manufacturer's legal department immediately sent a lawyer's letter saying that he "endangered national security." Not fixing loopholes for 8 months and sending lawyers 'letters 24 hours a day is the efficiency of our industry.

What are the people released by ## this time?

Let's take a look at the content of this release first. 47 vulnerabilities, covering:

• 8 browser/JavaScript engine related (including Chrome V8 JIT compiler bug, which is a high-risk)
• 12 mail server/client vulnerabilities (IMAP protocol parsing, MIME processing)
• 15 industrial control protocol stack vulnerabilities (implementation issues in Modbus, DNP3, Profinet)
• 6 VPN/network device vulnerabilities
• 6 database/middleware vulnerabilities

What are the common characteristics of these vulnerabilities? They are all "known to the manufacturer but not fixed" or "perfunctory after reporting." One release person wrote a passage in README to the effect that "These vulnerabilities have been privately reported to manufacturers for 12-24 months. Some manufacturers have directly closed the ticket, some say 'no external reports', and some say' This is a design feature, not a bug'. "

[SVG Figure 2: Distribution of vendor response time after vulnerability reports]

Looking at this data, tell me, what options do these researchers have? Swallow your anger and let the vulnerabilities rot in the manufacturer's ticket system, and then an APT organization happens to discover them the next time it scans? Or will it be made public directly and force everyone to repair it?

Let me make a bet: These liberators are not saboteurs, but engineers forced to become "whistleblowers". They tried formal channels, but the formal channels were blocked. They don't want to break the law and commit crimes (selling loopholes to the black market), and they don't want loopholes to become ticking time bombs forever. Anonymously released is the only moral option left.

QKPFX11 What will the opponents of QK say?

The most refutation I hear is: "By exposing loopholes like this, you are providing weapons to attackers! Manufacturers will not have time to repair it, and users will suffer on a large scale. "

This refutation has a fatal assumption: attackers do not know they exist when vulnerabilities are not made public.

This assumption is naive. The truly powerful attackers-APT organizations, national hacking teams, and large criminal groups-have their own vulnerability discovery capabilities and their own 0-day reserves. They do not rely on public releases on GitHub. They have obtained these vulnerabilities long ago, perhaps even earlier than the manufacturers.

Who does the public release really hurt? It's middlemen and black markets for loopholes. Once the vulnerability is made public, the manufacturer has to fix it, and the commercial value of the vulnerability immediately returns to zero. Anonymous release is disinfecting with sunlight, killing the vulnerability transaction itself, not the attacker.

[SVG Figure 3: Comparison of attacker responses before versus after vulnerability disclosure]

See clearly? Before it was made public, only the attacker knew about the loophole, and everyone ran naked. After it was made public, everyone knew that the attacker's window of advantage had shrunk sharply. Information asymmetry is the weapon of the attacker, and transparency is the weapon of the defender.

Of course, there will be risks in the short term-there is indeed a window between disclosure and vendor repair, and script boys will rush to take advantage of it. But this window is rapidly shortening. Chrome's security team can now fix public critical vulnerabilities within 24 hours, and Microsoft's MSRC issues patches critical vulnerabilities within 48 hours of disclosure. Ten years ago, this window period was calculated on a weekly or even monthly basis, but now it is calculated on an hourly basis.

Public releases are forcing manufacturers to establish real rapid response capabilities , rather than letting vulnerabilities rot in the ticket system and pretend they don't exist.

Look at it in a different scene

I know an engineer who works on industrial control systems in a company that makes SCADA systems for power plants. They have a product that was released in 2008 and is still running today and has never been updated. It's not that we don't need updates, but no one dares to touch them-the customer said,"Don't touch them as long as you can run", and the manufacturer said,"If the customer doesn't pay maintenance fees, we have no budget to repair them."

Last year, an independent researcher found a high-risk vulnerability in their system, remote code execution level. He reported it to the company, and the other party's reply was: "This product is EOL (End of Life) and we do not provide security updates. "The problem is that this 'EOL' product is still operating in more than 30 power plants, controlling real physical equipment.

The researcher told CISA about the matter, and CISA issued a warning, but no follow-up. Finally, the researcher sent the details of the vulnerability to the Full Disclosure mailing list. 48 hours later, the manufacturer miraculously released an emergency patch .

You see, when silence is free, manufacturers choose silence. When the cost of disclosure is greater than the cost of repair, the manufacturer will repair it. This is not a technical issue, it is an incentive issue.

transparency is the only way out, but it is not easy to go

When I say anonymous release is a good thing, it doesn't mean I'm naive. This road must have a price, and the price is not small.

The first price is abuse by the script boy. After the vulnerability is disclosed, some people will definitely write exploit, some will scan and attack, and some will take advantage of the situation. There is no way to avoid this, but to be honest, it is much easier to defend against script boys using public vulnerabilities than APT organizations using private vulnerabilities. In the former, you know the attack vector, you have the patch, and you have the IDS rules; in the latter, you don't know anything and can only wait until it is hacked to discover it.

The second cost is the legal risk for the researcher. In the United States, the CFAA (Computer Fraud and Abuse Act) can be interpreted extremely broadly, and disclosure of vulnerability details may be deemed to be "providing attack tools." Although the person released this time was anonymous, there is a real legal risk if someone is traced. We need "safety research exemption" bills, like what some states are already pushing, but not enough.

The third cost is the collapse of trust among manufacturers. If manufacturers feel that "researchers will disclose it anyway," they may be even less willing to cooperate with the responsible disclosure process. This is indeed a risk, but to be honest, manufacturers are not very cooperative now . Only 4 of the 47 vulnerabilities received normal responses. Is this called cooperation? Trust has long collapsed, and public release only makes the collapse visible.

Golden Sentence Moment

Writing here, I want to understand two truths:

A loophole is not a secret, a loophole is a debt. Every technical debt you owe will eventually have to be repaid, with interest calculated exponentially. ****

The security industry's rite of passage is to admit that the black market of loopholes is not a "necessary evil" but a "treatable cancer." The first step in treatment is to let the sun shine in. ****

The anonymous releases are not terrorists. They are doing what the industry should do most but no one dares to do: breaking information asymmetry, holding manufacturers accountable, and turning loopholes from "weapons for the few" to "problems for everyone."

It's not complicated. Either you make all your loopholes public and everyone protects them together; or you trade all your loopholes privately and everyone runs naked together. There is no middle ground, no option for "responsible procrastination."

What the security community should really panic is not that 47 vulnerabilities have been made public, but that there are still 470 vulnerabilities quietly circulating in the black market and we know nothing about them. ****

Anyway, maybe I was thinking too well. Can anonymous release really eliminate the black market of loopholes? There is a high probability that it cannot. But as long as it can make the cost, risk, and profit of loophole trading higher, and allow more researchers to choose "open" rather than "sell out," this trend is worth embracing.

I repeat: This is not a crisis, this is a reckoning. What is liquidated is not loopholes, but bad debts that the industry has pretended to be invisible for two decades. It hurts, but when the pain is over, maybe we can have a healthier immune system.

As for those who are still calling the anonymous release "irresponsible"-let me ask you, if a loophole is reported to you, you delay fixing it for 18 months, and then someone else makes it public, who is irresponsible?