WabiSabiLabi Pimping ClamAV Vulnerability & Exploit

The New Acunetix V12 Engine


Interesting, a new arena for marketing spin and sales talk – the auctioning of exploits.

WabiSabiLabi is pushing hard for a good price for a ClamAV vulnerability and exploit that it has gotten hold of, it’s dosing it up with a good portion of spin to make it seem like the next big thing – I guess because no one bidded on it.

WabiSabiLabi, which bills itself as the eBay of software vulnerabilities, has borrowed a page from used car salesmen, except instead of talking up their affordable rates and low down payments, the outfit is championing the sale of a nasty sounding exploit that puts Unix boxes at risk.

The vulnerability resides in ClamAV, an open source anti-virus toolkit for Unix-based email gateways. Two weeks ago, WabiSabiLabi listed the auction of exploit code that targets the antivirus program, so far without a single person bidding on it. Enter the group’s marketing monkeys, who in a blog post are trying to drum up interest.

Enter the marketing machine, enter the buzzwords! Remote code execution – wooo!

It doesn’t seem like they are doing too well.

The shameless plug also comes amid what might be considered less-than-spectacular enthusiasm for WabiSabiLabi’s vulnerability marketplace. In all, it records 38 auctions listed since the site went live in August. Of the 19 listings currently pending at the time of writing, only two had bids, and in each case, there was only one bid. Furthermore, seven listings were scheduled to expire in less than nine hours, and none of them had attracted a single bid.

Representatives from Switzerland-based WabiSabiLabi weren’t immediately available for comment.

In all, WabiSabiLabi claims to have received more than 150 vulnerability submissions, and that raises another question: What is it doing with all of those exploits? The company says it’s rejected about 40 entries because researchers used illegal methodologies such as reverse engineering of protected software to discover them.

Perhaps they didn’t think the whole concept out. Most of the people that need these kind of exploits – have access to them. Those that code trade, those that don’t code steal and trade – those that have no skills..pick up the left overs.

But people have them anyway.

Source: The Register

Posted in: Exploits/Vulnerabilities, Legal Issues, Linux Hacking

, ,


Latest Posts:


Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.
Acunetix Vulnerability Scanner For Linux Now Available Acunetix Vulnerability Scanner For Linux Now Available
Acunetix Vulnerability Scanner For Linux is now available, now you get all of the functionality of Acunetix, with all of the dependability of Linux.
Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.


12 Responses to WabiSabiLabi Pimping ClamAV Vulnerability & Exploit

  1. Goodpeople December 3, 2007 at 2:45 pm #

    Well, I guess that when you know that banks etc. pay big bucks for the latest vulnerabilities, that makes it commercially interresting to auction off those vulns.

    But who whould have thought that the guys from Bucksaplenty Inc. weren’t interrested in an exploit for some open source virus scanner?

  2. dirty December 3, 2007 at 5:08 pm #

    Looks like they sold it…for 600 Euros. Its no longer on their auction block. Wasn’t Wabi’s purpose originally to garner support for reseachers so big software companies would acknowledge their vulnerabilities a pay up. Not in a blackmail way but as a way for sec researchers to legitimately get paid? Doesn’t look like its working out too well.

  3. Nobody_Holme December 4, 2007 at 12:46 pm #

    Hm… I feel some people may just own them to find out the vulns, then walk off laughing… they really dont seem competent, so it cant be too hard…

  4. Goodpeople December 4, 2007 at 8:15 pm #

    @dirty,

    Maybe it’s harder to shake down some Open Source developers than it is to extract money from bigger companies? :=)

  5. dirty December 4, 2007 at 8:38 pm #

    @Goodpeople

    I concur.

    @Nobody Holme
    600 Euros is a lot for a chuckle

  6. aush0k December 5, 2007 at 12:14 pm #

    its open source lol

  7. Nobody_Holme December 5, 2007 at 1:37 pm #

    dude… they can post that someone paid up to hide that they got owned…

  8. dirty December 5, 2007 at 4:14 pm #

    Who got owned? IDK who you are exactly talking about. WABI?

  9. Nobody_Holme December 6, 2007 at 1:52 pm #

    Yeah. *learns to type properly*

  10. Goodpeople December 7, 2007 at 10:57 am #

    Of course they would want to hide it if they were owned. But if I was the one who owned them…. I’d want the world to know!

  11. CG December 7, 2007 at 1:58 pm #

    “The company says it

  12. nobody December 9, 2007 at 12:46 pm #

    hello,
    Roberto Preatoni, co-founders of WabiSabiLabi and H-Zone was arrested in Italy. you can read the full story here: http://www.securityfocus.com/blogs/283