Tales from the Underground: The Vulnerability Weaponization Lifecycle
summary
Year‑long monitoring of 600+ English and Russian forums finds Microsoft products account for 47% of requested CVEs, average buyer offers about $2,000, and some zero days fetch up to $10,000. Exploit lifecycle shows zero days sold privately, then patched, then relisted as cheaper N‑days or bundled; 22–54% of listings are older than two years and some patched flaws like MS17‑010 and CVE‑2017‑11882 remain widely exploitable on hundreds of thousands of devices.
AI-written summary · about
chapters (15)
- 0:00Start
- 0:19Background
- 1:59Most Requested Exploits by Cybercriminals
- 3:01Examples of Requested Exploits
- 5:17Example of Sales Advertisements
- 5:53Lifecycle of an Exploit in the Underground
- 7:07Experience Seller
- 7:33Bounty Sellers
- 8:25Exploit Brokers
- 10:01Examples of Subscription-Based Services
- 12:32Outdated Exploits Sold in the Underground
- 13:55Access-as-a-Service
- 15:23CVE-2020-9054
- 16:48CVE-2016-5195
- 17:17Sample N2 Dirty Cow Exploit
related talks
39m"Vulnerabilities for Sale - The Good, the Bad and the Ugly"
56mZero Days, Thousands of Nights: The Life & Times of Zero-Day Vulns and Their Exploits
36mFrom Bounties to Bureaucracy
16mHistorical Analysis of Exploit Availability Timelines
50mSelling 0-Days to Governments and Offensive Security Companies
39mCVE 101: The Unfolding Of A Zero Day Attack
27mExploited CVEs of 2024: Lessons for Vendors and Defenders
57mSeeing the Vulnerable Forest Through the Exploited Trees