4 ms·
There are various security broker companies that governments work with. An unscrupulous pentester could find one, email them, and ask them if they're interested
by sillysaurus3 10y ago
There are various security broker companies that governments work with. An unscrupulous pentester could find one, email them, and ask them if they're interested.
The trouble would be how to prove the exploit works without also revealing how it's done. The best bet would be to demo one or two out of the three exploits required to work, then talk business in exchange for the third.
- jacquesm 10y agoBusiness transactions between parties that don't trust each other is a solved problem: escrow.
- alexkon 10y agoDoes escrow really work with secrets like this? The buyer receives the exploit and claims it doesn’t work. The seller claims it does. The money is still in escrow. How do you proceed? The escrow agent is getting a commission, they should not have access to the full secret. It’s really hard to find an escrow agent who has the skills to assess an exploit and whom both the buyer and the seller would trust not to leak it or use it for their own benefit.
- jacquesm 10y agoYou could have the inspection done by an independent. Anyway, it's been done before by guess-who: https://www.mitnicksecurity.com/shopping/absolute-zero-day-exploit-exchange https://www.mitnicksecurity.com/shopping/absolute-zero-day-e...
- andrepd 10y agoDoes escrow really work with shady black hat deals like these?
- jacquesm 10y agoDepends on who the buyer is and yes, it does work, there are even specialized marketplaces. You'd still be dealing with the devil but you very likely will get paid.