Nice ideas. I'll add that it helps to make the target look more interesting. Make it seem like an obscure lab or organization in DOD. Or a company with valuable intellectual property that big Chinese/Russian firms could use. Plant some connections between the fake site and a real one they're probably reading. Then wait.
]]>This is nice because this is taking a bug from the black market to the vendor. And this makes money.
The TLA are already making honeypot, but won't sell such 0days to vendors like you may do now.
]]>(1) setup a chrome OS as a blog server paraphrasing articles about fortune of China's leaders.
(2) firewall any non-http inbound connection with an OpenBSD computer (or other secure computer, see http://www.schneier.com/blog/archives/2013/02/... for details).
(3) publish on the blog that you regularily visit english.cri.cn to check that they don't write about it.
(4) increase your visibility through Search Engine Poisoning, comments at NYTimes newspaper, private mail to NYTimes under China's scrutiny, ...
(5) publish the OS version of your blog server.
(6) visit regularily english.cri.cn, and use the OpenBSD box to log all answers.
(7) parse these answers on OpenBSD. This is the difficult step.
(8) sell this 0day exploit to Google.
The payment I am seeing from these firms is paltry compared to what I see from the government black market. (Which I have never seen is so great, though just from peer talk.)
I do not know about Chrome OS, but the Android OS has some serious weaknesses in it.
If you gain access to the user's Google credentials, you can gain access to their Google Play site where you can force upload from the web remotely whatever programs you wish onto their system.
Google does not encrypt their credentials in their mail application's database -- which is not secured permissions wise.
And they have a lot of sites where someone could steal their cookies. Like one sees with this recent Yahoo hack.
Their main sites are very hard core secured at the web level, but not so with all of their far flung sites of the same domain.
(Their main sites' security is not so secure when combined with certain Android applications.)
I strongly doubt Chrome OS is "all that", and if it was, they would feel confident in offering stronger monetary rewards all the time.
But Kaspersky database of file hashes from their customers is still one of the coolest file correlation techniques I have seen for off line social network analysis.
]]>BTW, in last year Edition, VUPEN hacked into chrome and declined to reveal how they escaped the sandbox. They said they were going to sell the code instead, what happened with the code?
Result: more people will try to develop exploits of Chrome OS. But Chrome OS won't be safer.
Google's $3141590 cannot compete with them.
]]>On a more serious note, when vendors subject their products to scrutiny - in the security arena or otherwise - it is almost always good for consumers.
]]>