Thursday, August 30, 2012

Bitcoin vs Exploit Finds

Quick hypothetical: Rather than wasting computing resources on running BitCoin mining (which attempts to hash numbers such that they will be below a certain other number) why not attempt to find exploits in popular browsers, Java, or Flash?

Bitcoin mining (according to this article: https://sanchom.wordpress.com/2011/05/24/bitcoin-mining-first-you-get-the-power-then-you-get-the-money/  which is old, so prices are probably down as computational complexity has increased over the last year) nets around $100 a month. We're talking about tons of computational power on a GPU that runs all day.

A good Java/Firefox/Chrome/IE exploit, when turned in to the proper authorities merits closer to $1337 per exploit, or if you have a particularly good one (like a Java6/7 0day, sold to the proper government it could be worth up to $100,000)

If you have a site, a hidden iFrame/Java Applet/Flash Plugin is all you need. If you set up two communication channels, websockets we'll say, and feed the user something to the hidden frame/applet, if the applet crashes, that websocket channel dies. If it also kills the browser, both die; if nothing happens, everyone goes about their merry way. When the site is closed, you'll need to emit a clean close on the channels so you don't get false results.

Slap this on a gaming website, a company homepage (if you're a corporation looking to use spare cycles), or somewhere else it won't be noticed, and you may have something much more lucrative than Bitcoin mining (or better for the community, if you see it that way.)

No comments:

Post a Comment