Vupen Security

» see vupen.com as it lived, on the wayback machine

~ the eulogy ~

The French company register still carries the file. VUPEN SECURITY, SIREN 478502123, created 2 September 2004, registered office in Montpellier, administrative state "cessée". The register closes the establishment on 27 April 2015, and on 5 May 2015 the founders filed the documents that ended the company itself. Eleven weeks after that they opened a new one in the United States.

What Vupen did in between was find zero-day vulnerabilities in software from the biggest vendors and sell them to law enforcement and intelligence agencies, which used them for offensive as well as defensive operations. The bugs went to the buyers rather than to the companies that could have fixed them. There was a US branch in Annapolis, Maryland, and a founder, Chaouki Bekrar, who was happy to describe the business in print while most of the trade stayed anonymous.

Nothing Vupen produced was ever sold to individuals. The price list was for governments, and the only route its work took to my machine was a browser update I clicked through without reading. This whole business operated one layer above anything I could observe, trading the gap between the day a hole is found and the day it gets patched.

~ the dossier ~

~ what they actually sold ~

The model was subscription. A government agency paid an annual fee and got access to a stream of working exploits for software it wanted to get into. Forbes put the trade on the record in March 2012 under the headline "Meet The Hackers Who Sell Spies The Tools To Crack Your PC (And Get Paid Six-Figure Fees)", and Vupen was the company willing to be named in it.

That was a change from how Vupen started. It used to publish vulnerability information for free, then decided to charge for it. Bekrar told Die Zeit in October 2013 that the software companies had their chance and that now it was too late.

~ four years at pwn2own ~

Vupen took first prize at Pwn2Own four years running, from 2011 through 2014. The most argued-about win was 2012, when it broke Google Chrome and then declined to tell Google how it had done it. In 2014 it reversed that position and handed the affected vendors everything, which fed a round of security updates from five separate vendors that March.

~ the customer list ~

On 15 September 2013 it came out that the NSA held a subscription to Vupen's exploit service. On 9 November 2014 Der Spiegel reported that Germany's BSI was also a customer, which is an unexpected name on a list of exploit buyers given that its remit is defending federal government networks.

The Hacking Team breach added a line to the record on 22 July 2015, by which point Vupen was already closed. Analysis of the leaked files showed it had supplied exploits to the Italian surveillance vendor between 2010 and 2011, and Hacking Team's own client list came out of the same documents. That put a documented chain on paper, running from a Montpellier office through Hacking Team to Hacking Team's buyers.

~ the move ~

Zerodium launched on 23 July 2015, in the United States, with the same founders and a different shape: it buys zero-day capabilities from independent researchers instead of only producing its own, then passes them to government clients with mitigation advice attached. Bekrar told eWEEK it was spending between $400,000 and $600,000 a month acquiring vulnerabilities. Meanwhile vupen.com still loads, all 44 KB of it, with a 2011 copyright line at the bottom and nothing newer anywhere on the page.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »