3 ms·

What you're describing sounds credible, but the problem I have with accepting it is that I have seen absolutely no evidence in the wild that there is actually a

by dsacco 10y ago

What you're describing sounds credible, but the problem I have with accepting it is that I have seen absolutely no evidence in the wild that there is actually a market for this. It is counter to the entire methodology of pricing vulnerabilities. You don't need a vulnerability to spread spam on Facebook, so that's out. Page likes and video views can be done with botnets. Spreading malware doesn't make sense - it would be far superior to buy a vulnerability allowing direct desktop access, not one that will be patched quickly. The other examples require me to believe that companies which would be interested in photos or email addresses are the same ones willing to pay four or five figures for a one-time use vulnerability. This is an extraordinary claim. There is no real-world Venn diagram of companies interested in harvesting emails or photos and companies willing to pay for Facebook vulnerabilities. Those companies are either TMZ or the NSA. You're asking me to believe that TMZ is willing to purchase security vulnerabilities and competently use them, or that the NSA is willing to purchase Facebook vulnerabilities for one-time use (if anything, I'd believe in them developing them in-house). What actually happens is vulnerabilities in iOS, PHP, WordPress, OpenSSH, etc. are use for wide-reaching effect, not for a single website.

Cyph0n 10y ago
> You don't need a vulnerability to spread spam on Facebook, so that's out. Page likes and video views can be done with botnets. Spreading malware doesn't make sense - it would be far superior to buy a vulnerability allowing direct desktop access, not one that will be patched quickly. But using compromised accounts that belong to real people with a believable history is more effective for spamming. Of course you'll need botnets, but if the accounts look fake, rarely anyone will follow what you're saying. This is less of a big deal for page likes and views, but it can still be helpful as it will make your page's likes look more legitimate. Using the accounts and pages of influential people (100k likes or so) to spread malware and advertise is a whole different beast than using some account without a profile pic to do the same. Regarding personal information, yes I agree, it's definitely more limited in usefulness and not something worth $10k. But for the rest I've mentioned, I'd argue that a large malware spreading service (yes, these exist) would find an exploit of such nature quite valuable.

by dsacco 10y ago

Cyph0n 10y ago

> You don't need a vulnerability to spread spam on Facebook, so that's out. Page likes and video views can be done with botnets. Spreading malware doesn't make sense - it would be far superior to buy a vulnerability allowing direct desktop access, not one that will be patched quickly. But using compromised accounts that belong to real people with a believable history is more effective for spamming. Of course you'll need botnets, but if the accounts look fake, rarely anyone will follow what you're saying. This is less of a big deal for page likes and views, but it can still be helpful as it will make your page's likes look more legitimate. Using the accounts and pages of influential people (100k likes or so) to spread malware and advertise is a whole different beast than using some account without a profile pic to do the same. Regarding personal information, yes I agree, it's definitely more limited in usefulness and not something worth $10k. But for the rest I've mentioned, I'd argue that a large malware spreading service (yes, these exist) would find an exploit of such nature quite valuable.