{"id":22794,"date":"2023-08-29T05:21:09","date_gmt":"2023-08-29T13:21:09","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2023\/08\/29\/news-16524\/"},"modified":"2023-08-29T05:21:09","modified_gmt":"2023-08-29T13:21:09","slug":"news-16524","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/08\/29\/news-16524\/","title":{"rendered":"For the win? Offensive research contests on criminal forums"},"content":{"rendered":"

Credit to Author: Matt Wixey| Date: Tue, 29 Aug 2023 10:00:17 +0000<\/strong><\/p>\n

\n

If you\u2019re a security researcher who wants to share your innovations and insights with the wider community (and gain some peer recognition into the bargain), you\u2019ve got a few options: present at conferences; write papers, blogs, or Twitter threads; submit CVEs; or enter CTFs (capture-the-flag competitions) and vulnerability research contests like Pwn2Own. The legitimate side of the house is awash with opportunities.<\/p>\n

But what if you\u2019re a threat actor, whose research is usually more clandestine? In theory, there\u2019s nothing stopping you from doing any of the above \u2013 but it could (and almost certainly will) draw unwanted attention and be counter-productive. Better to share it with other threat actors, perhaps \u2013 but how, and where?<\/p>\n

If there\u2019s one thing criminal marketplaces do well, it\u2019s fulfilling the needs and demands of criminals, and this area is no exception. For several years, prominent Russian-language cybercrime forums like Exploit and XSS have run annual research contests for their members<\/a>, with monetary prizes put up by sponsors \u2013 usually prominent threat actor groups.<\/p>\n

As Digital Shadows notes in the article linked above, early contests were simple, involving trivia quizzes, graphic design competitions, or guessing games. We\u2019ll dig into exactly how today\u2019s contests work shortly, but the key point is that they\u2019re very different from those first, basic competitions. Recent contests are more akin to typical Call for Papers (CFPs) for legitimate security conferences \u2013 with users invited to submit \u2018articles\u2019 on technical topics, complete with source code, videos, and\/or screenshots.<\/p>\n

And unlike those earlier contests, today\u2019s events are big pulls for threat actors. This is partly because a considerable amount of money is up for grabs \u2013 not as much as Pwn2Own<\/a> or the Tianfu Cup<\/a>, but not exactly pocket change, either \u2013 and also because they\u2019re an opportunity for threat actors to attain recognition and plaudits from their peers.<\/p>\n

While the fact that these contests exist is interesting in itself, their entries provide us with some insight into threat actor innovation: what they\u2019re working on, what obstacles they\u2019re seeking to overcome and how, and what their peers deem important.<\/p>\n

How contests work<\/h2>\n

Forums usually run their contests annually, although the last one on Exploit closed in May 2021, and at the time of writing there hasn\u2019t been another. The process is pretty simple: an admin announces the contest, and specifies the closing date, topic area, and rules.<\/p>\n

Any user of the forum can submit an entry, typically by posting it in a dedicated thread. At the closing date, admins disqualify any entries which don\u2019t meet the rules (e.g., they\u2019re below a minimum word limit, or have been plagiarized), and the rest are put to a public vote on the forum .<\/p>\n

Exploit\u2019s most recent contest at this writing was launched on April 20, 2021, with a total prize fund of $80,000 USD. The contest was themed around cryptocurrencies, with articles requested on attacks, thefts, weaknesses, and vulnerabilities. Specifically, the administrator suggested the following topics:<\/p>\n