Exploit as a service
Exploit-as-a-service or EaaS is a scheme of cybercriminals whereby zero-day vulnerabilities are leased to hackers.[1][2] EaaS is typically offered as a Cloud Service.[3] By the end of 2021, EaaS became more of a trend among ransomware groups.[4]
In the past, zero-day vulnerabilities were often sold on the Dark Web, but this was usually at very high prices, like millions of US dollars per zero-day.[5] A leasing model makes such vulnerabilities more affordable for many hackers.[6] Even if such zero-day vulnerabilities will ever be sold at high prices, they can be leased for some time.[7]
The scheme can be compared with similar schemes like Ransomware-as-a-Service (RaaS), Phishing-as-a-Service and Hacking-as-a-Service (HaaS).[8] [9] The latter includes such services as DoS and DDoS and botnets that are maintained for hackers who use these services.
Parties who offer Exploit-as-a-service need to address various challenges. Payment is usually done in cryptocurrencies like the bitcoin. Anonymity is not always guaranteed when cryptocurrencies are used, and the police have been able to seize criminals on various occasions.[10][11] Zero day vulnerabilities that are leased could be discovered and the software that is used to exploit them could be reverse engineered.
It is as yet uncertain how profitable the exploit-as-a-service business model will be. If it turns out to be profitable, probably the amount of threat actors that will offer this service will increase.[12] Sources of information on Exploit-as-a-Service include discussions on the Dark Web, which reveal an increased interest in this kind of service.[13]
See also
- Exploit (computer security)
- Computer security
- Computer virus
- Crimeware
- Exploit kit
- IT risk
- Metasploit
- Shellcode
- w3af
Notes
- ^ https://web.archive.org/web/20211123034031/https://portswigger.net/daily-swig/exploit-as-a-service-cybercriminals-exploring-potential-of-leasing-out-zero-day-vulnerabilities
- ^ https://web.archive.org/web/20211128180425/https://www.cybertalk.org/2021/11/17/exploit-as-a-service-high-rollers-and-zero-day-criminal-tactics/
- ^ https://web.archive.org/web/20210119022451/https://www.trendmicro.com/en_us/research/11/d/new-type-of-cloud-emerges-exploits-as-a-service-eaas.html New type of cloud: Exploits as a Service (EaaS)
- ^ https://web.archive.org/web/20211201172230/https://cyware.com/news/zero-day-flaws-and-exploit-as-a-service-trending-among-ransomware-groups-27991876 Zero-day Flaws and Exploit-as-a-Service Trending Among Ransomware Groups
- ^ https://web.archive.org/web/20211201172230/https://cyware.com/news/zero-day-flaws-and-exploit-as-a-service-trending-among-ransomware-groups-27991876 Zero-day Flaws and Exploit-as-a-Service Trending Among Ransomware Groups
- ^ https://web.archive.org/web/20210811091611/https://whatis.techtarget.com/definition/hacking-as-a-service-HaaS
- ^ https://web.archive.org/web/20211123034031/https://portswigger.net/daily-swig/exploit-as-a-service-cybercriminals-exploring-potential-of-leasing-out-zero-day-vulnerabilities
- ^ https://web.archive.org/web/20210811091611/https://whatis.techtarget.com/definition/hacking-as-a-service-HaaS Hacking as a Service as saved in the Internet Archive
- ^ https://web.archive.org/web/20211123034031/https://portswigger.net/daily-swig/exploit-as-a-service-cybercriminals-exploring-potential-of-leasing-out-zero-day-vulnerabilities
- ^ https://web.archive.org/web/20211129101836/https://www.bbc.com/news/uk-england-lincolnshire-59054033 Lincolnshire boy has £2m of cryptocurrency seized by police
- ^ https://web.archive.org/web/20211021001236/https://www.theguardian.com/technology/2021/jul/13/met-police-bitcoin-money-laundering-cryptocurrency Met police seize nearly £180m of bitcoin in money laundering investigation
- ^ https://web.archive.org/web/20211123034031/https://portswigger.net/daily-swig/exploit-as-a-service-cybercriminals-exploring-potential-of-leasing-out-zero-day-vulnerabilities
- ^ https://web.archive.org/web/20211117140438/https://www.2-spyware.com/new-criminal-tactics-exploit-as-a-service-and-buying-zero-day-flaws New criminal tactics: exploit-as-a-service and buying zero-day flaws
External links
Media related to Computer security exploits at Wikimedia Commons- Exploit-as-a-service: Cybercriminals exploring potential of leasing out zero-day vulnerabilities as saved in the Internet Archive
- Exploit-as-a-Service, high rollers and zero-day criminal tactics as saved in the Internet Archive
- Hacking as a Service as saved in the Internet Archive
