Risk & Repeat: Shadow Brokers launch zero-day exploit service

The Shadow Brokers have returned with yet another scheme to make money off of the stolen cyberweapons from the National Security Agency, and this time, the group is offering a monthly zero-day exploit service.

The hacking group this month began offering the subscription service for approximately $21,000 in Zcash per month, which would give subscribers access to unreleased NSA exploits. The Shadow Brokers previously tried to auction off several of the cyberweapons, and more recently published a cache of zero-day exploits for Microsoft Windows and the SWIFT bank messaging system. This latest move by the Shadow Brokers has left software vendors and enterprise security teams on edge as they wait for the latest vulnerabilities to drop.

But the monthly service for zero-day exploits complicates matters for vulnerability disclosure; a group of security researchers attempted to crowdfund a subscription to the Shadow Brokers' service, but the effort was abandoned because of legal concerns. In addition, the Shadow Brokers' latest stunt has created more confusion about the group's motives and true identities.

Are the Shadow Brokers truly after money, or are they pushing the NSA to disclose and patch these zero-days? Is the NSA already working with vendors behind the scenes to get unreleased exploits patched before they are revealed? How could this monthly service affect bug hunting, research and patching efforts? In this episode of the Risk & Repeat podcast, editors Rob Wright and Peter Loshin discuss those questions and more on the Shadow Brokers and their zero-day exploits subscription service.