On the tiny Mediterranean island of Malta,two Italian hackers have been searching for bugs not the islands many beetle varieties,but secret flaws in computer code that governments pay hundreds of thousands of dollars to learn about and exploit.
The hackers,Luigi Auriemma,32,and Donato Ferrante,28,sell technical details of such vulnerabilities to countries that want to break into the computer systems of foreign adversaries. The two will not reveal the clients of their company,ReVuln,but big buyers of services like theirs include the National Security Agency which seeks the flaws for Americas growing arsenal of cyberweapons and American adversaries like the Revolutionary Guards of Iran.
All over the world,from South Africa to South Korea,business is booming in what hackers call zero days,the coding flaws in software like Microsoft Windows that can give a buyer unfettered access to a computer and any business,agency or individual dependent on one.
Just a few years ago,hackers like Auriemma and Ferrante would have sold the knowledge of coding flaws to companies like Microsoft and Apple,which would fix them. Last month,Microsoft sharply increased the amount it was willing to pay for such flaws,raising its top offer to $150,000. But increasingly the businesses are being outbid by countries with the goal of exploiting the flaws in pursuit of the kind of success,albeit temporary,that the US and Israel achieved three summers ago when they attacked Irans nuclear enrichment program with a computer worm that became known as Stuxnet.
The flaws get their name from the fact that once discovered,zero days exist for the user of the computer system to fix them before hackers can take advantage of the vulnerability. A zero-day exploit occurs when hackers or governments strike by using the flaw before anyone else knows it exists,like a burglar who finds,after months of probing,that there is a previously undiscovered way to break into a house without sounding an alarm.
A zero-day bug could be as simple as a hackers discovering an online account that asks for a password but does not actually require typing one to get in. Bypassing the system by hitting the Enter key becomes a zero-day exploit. The average attack persists for almost a year 312 days before it is detected,according to Symantec,the maker of antivirus software. Until then it can be exploited or weaponised by both criminals and governments to spy on,steal from or attack their target.
Ten years ago,hackers would hand knowledge of such flaws to Microsoft and Google free,in exchange for a T-shirt or perhaps for an honourable mention on a companys web site. Even today,so-called patriotic hackers in China regularly hand over the information to the government. Now,the market for information about computer vulnerabilities has turned into a gold rush. Disclosures by Edward J Snowden,the former NSA consultant who leaked classified documents,made it clear that the US is among the buyers of programming flaws. But it is hardly alone.
Israel,Britain,Russia,India and Brazil are some of the biggest spenders. North Korea is in the market,as are some West Asian intelligence services. Countries in the Asian Pacific are buying,too.
To connect sellers and buyers,dozens of well-connected brokers now market information on the flaws in exchange for a 15% cut. Some hackers get a deal collecting royalty fees for every month their flaw is not discovered.
Many technology companies have started bug bounty programmes in which they pay hackers to tell them about bugs in their systems rather than have the hackers keep the flaws to themselves or worse,sell them on the black market. Nearly a decade ago the Mozilla Foundation started one of the first bounty programmes to pay for bugs in its Firefox browser. Since then,Google,Facebook and PayPal have all followed suit. In recent months,bounties have soared.