V
VUPEN Blog
vupen.com · Company blog · on HN since 2010
VUPEN was a French security firm that sold zero-day exploits to governments and published technical write-ups of vulnerabilities.
What HN saysHN commenters cite it as an established seller of 0day exploits to government customers and link its Xen Sysret VM escape write-up.
27HN people shared it
18linked it in comments
9stories submitted
461story points
12 years agolast shared
2010people per year2026
Most-shared posts
- 1Lea index5 people · first shared 2012
- 2Advanced Exploitation of Xen Hypervisor Sysret VM Escape Vulnerability4 people · 1 points · first shared 2012 · discussion on HN
- 3Exploitation of Firefox Use-After-Free Vulnerability (Pwn2Own 2014)3 people · 5 points · first shared 2014 · discussion on HN
- 4Services3 people · first shared 2011
- 5Google Chrome Hacked?2 people · 450 points · first shared 2011 · 210 comments on HN
- 6Company2 people · first shared 2011
- 7Exploitation of Windows Kernel Intel 64-Bit Mode Sysret Privilege Escalation1 people · 2 points · first shared 2012 · discussion on HN
- 8Analysis and Exploitation of Adobe Flash 0-Day (CVE-2011-0609)1 people · 1 points · first shared 2011 · discussion on HN
- 9VUPEN: Adobe Shockwave vulnerability publicly disclosed.1 people · 1 points · first shared 2010 · discussion on HN
- 10Advanced Exploitation of Mozilla Firefox Use-after-free Vulnerability1 people · 1 points · first shared 2012 · discussion on HN
- 112011 11851 people · first shared 2011
- 12Ba gov1 people · first shared 2011
- 13Tpp index1 people · first shared 2012
- 14English1 people · first shared 2012
What HN people wrote when they linked it
JoachimSchipper · 2014-11-13
The company profiled in the article ("ex-NSA") isn't exactly the first player in its space - e.g. VUPEN is a pretty established company (http://www.vupen.com/english/services/lea-index.php), and there have been earlier articles on this market (for instance http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero… is pretty readable).
This may be a very good book, worth reading, but it's not really news.
throwaway3823 · 2012-03-09
Vupen sells 0day exploits so that they can be used to attack people: http://www.vupen.com/english/services/lea-index.php
A patched vulnerability would not be worth nearly as much to them and their customers.
P.S. Vupen sells to ASEAN. ASEAN includes Burma (Myanmar). Burma is not a happy place.
xnull2guest · 2014-11-05
Yes.
The market for 0days has been cooling off in recent years, but for a good decade there you could sell 0days, even mediocre ones for six digits. Nowdays you'll need a pretty good vuln for six digits, and something pretty stellar for seven (this isn't unheard of). ZDI, frsirt and others got into the game as middlemen. They allow(ed) you to not know who the final purchaser is and would allow you to sell 0days that may or may not be interesting to a government entity - in this case ZDI, etc would swallow the cost.
Edit: http://www.vupen.com/english/services/lea-index.php
justincormack · 2014-09-15
res0nat0r · 2014-01-03
Here is a pretty big one from 2012 that was discovered by Rafal Wojtczuk: http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret…
It didn't get a huge press release and media coverage but it was a pretty big deal. Probably because there weren't any 0day exploits floating around at the time so this flew under the radar of the mainstream.
http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-es…
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0217
http://invisiblethingslab.com/itl/About.html
socillion · 2013-06-26
This one?
http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-es…
http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret…
Exploits are developed to break VMs, just like everything else, and are promptly patched once revealed. Apart from general intrusion detection tools, I think you would be hard pressed to find anything to guard against them.
Maybe run a VM inside another VM ;)
codesuela · 2013-04-04
Ever heard of Vupen?
> VUPEN Exploits for Offensive Security
As the world leader in vulnerability research, VUPEN provides extremely sophisticated and government-grade exploits specifically designed for the Intelligence and LEA community to help them achieve their offensive missions using tailored and unique codes created in-house by VUPEN for exclusive and undisclosed vulnerabilities discovered by VUPEN researchers.
Access to this service is restricted to organizations from countries members or partners of NATO, ANZUS and ASEAN.
http://www.vupen.com/english/services/lea-index.php
completely legitimate company
yuhong · 2012-11-02
Yea, they sell protection against the same exploits too:
http://www.vupen.com/english/services/tpp-index.php
seanp2k2 · 2012-06-02
VUPEN provides 0-days to governments http://www.vupen.com/english/
robtoo · 2012-03-09
They even admit it's not just governments they sell to: VUPEN customers include worldwide governments and major corporations in finance, technology and manufacturing. [http://www.vupen.com/english/company.php] although their continued use of weasel words does stop just short of admitting that they're enabling industrial espionage.
ward · 2012-03-09
I thought that too, at first, but it seemed to blatantly illegal to believe. Going by their site, it's mostly for government agencies against other agencies?[1] I'm not proficient enough at law to comment on the legalities of it.
Another possibility I had in mind is that they want to get paid by people wanting to fix this vulnerability on their systems. eg, company X will have to come to them if they want their IE browsers to receive the patch against this bug.
[1] http://www.vupen.com/english/services/lea-index.php
morganpyne · 2011-05-20
To be honest, I'm just curious why we haven't seen much real malware yet. The Mac Defender stuff is a joke, but there's no reason why somebody couldn't be exploiting the recent Skype bug (http://www.purehacking.com/blogs/gordon-maddern/skype-0day-vulnerabili… or the Chrome/Flash bug (http://www.vupen.com/demos/VUPEN_Pwning_Chrome.php), the bugs found at pwn2own or the myriad other holes which are closed regularly via updates.
adrianp · 2011-05-09
I can understand their joy but the last sentence in the post and the Twitter update: "Sorry Google...we have officially pwned Google Chrome and its sandbox with a 0-Day." [1] seem rather unprofessional for the "world leader in vulnerability research for defensive and offensive security" [2], a company with "Government customers".
[1] https://twitter.com/VUPEN
[2] http://www.vupen.com/english/company.php
ceejayoz · 2011-05-09
http://www.vupen.com/english/services/
> As the world leader in vulnerability research, VUPEN Security provides weaponized and highly sophisticated exploits specifically designed for Law Enforcement and Intelligence Agencies to help them achieve their offensive missions using tailored and unique codes created in-house by VUPEN for vulnerabilities discovered by our researchers.
Note also the "under contract with VUPEN" part of the disclosure bit.
syllogism · 2011-05-09
I felt the same way until this comment below:
> http://www.vupen.com/english/services/
> As the world leader in vulnerability research, VUPEN Security provides weaponized and highly sophisticated exploits specifically designed for Law Enforcement and Intelligence Agencies to help them achieve their offensive missions using tailored and unique codes created in-house by VUPEN for vulnerabilities discovered by our researchers.
Note also the "under contract with VUPEN" part of the disclosure bit.
trotsky · 2011-05-09
Well, I was close...
- Gov. and Law Enforcement Agencies in Countries Members or Partners of NATO, ANZUS or ASEAN
http://www.vupen.com/english/services/ba-gov.php
VladRussian · 2011-05-09
Looking at VUPEN services it sounds like HBGary twin :
http://www.vupen.com/english/services/
"offensive security", yep. The guys are dirty like the Gary.
Why a racket and government always means a happy marriage?
nbpoole · 2011-05-06
It doesn't happen by chance (usually), but it's not an infrequent occurrence either.
Take an example from earlier today: there's a vulnerability in Exim that can allow arbitrary remote code execution (http://www.vupen.com/english/advisories/2011/1185). For anyone who doesn't know what Exim is, I refer you to Wikipedia (http://en.wikipedia.org/w/index.php?title=Exim&oldid=421157736):
"Exim is a mail transfer agent (MTA) used on Unix-like operating systems. Exim is free software distributed under the terms of the GNU General Public License, and it aims to be a general and flexible mailer with extensive facilities for checking incoming e-mail.
...
A large number of Exim installations exist, especially within Internet service providers[1] and universities in the UK. Exim is also widely used with the GNU Mailman mailing list manager, and cPanel."