5 ms·

My understanding is that the grey market for exploits is way more lucrative than the bug bounty programs.

tptacek 9y ago
It is in the very specific case that: (1) You are effective at finding the specific kinds of vulnerabilities that the grey market actually purchases. People have _very_ weird ideas about what the grey market wants. In reality, if your bug isn't a drive-by clientside in a popular client, it is unlikely that anyone wants to buy it. (2) You are willing to get your hands dirty with shady purchasers. If you're talented, you can make good money in the grey market, or you can retain plausible deniability about what your work is being used for, but you can't do both of those things. That first case is really the limiting factor. And remember, if you can reliably sell bugs to the grey market, that strongly implies you have lucrative options in the legitimate market. Bug bounties are not the most competitive alternative to the grey market!
- dsl 9y ago
  > In reality, if your bug isn't a drive-by clientside in a popular client, it is unlikely that anyone wants to buy it. That sounds like black market buyers (maybe we disagree on where the "gray" line is). Governments are very interested in bugs that allow pivoting and lateral movement.
  - daddyo 9y ago
    How would one, hypothetically, go about selling exploits/bugs to governments as a freelancer?
    - big_youth 9y ago
      Plenty of brokers exist, I'm personally familiar with Exodus Intelligence and Zerodium
    - dsacco 9y ago
      The nature of the work is such that: 1. If you have to ask this question, you are quite far from being able to do it any time soon (and that's assuming you can find the vulnerabilities!), 2. You will predominantly sell your vulnerabilities, preferably weaponized as complete exploits, to firms that specialize in "vulnerability research" and "exploitation development" with close ties to government agencies. It's much easier to find a firm that can act as a broker between you and the government agency than it is to knock on the right doors to sell it on your own, with no background or prior contact.
technion 9y ago
I've looked at dartknet markets. Quite often, there are vulnerabilities advertised for thousands or tens of thousands of dollars. And quite often, they claim to be an exclusive sale (ie, they'll take it down after one purchase). And quite often, they will be relisted for months at a time. I'm not at all saying there's no market - we clearly know that a remote code exec on a common server will sell well. Things like "Microsoft Word Exploit" seem a lot more like Duff beer - I'm often hearing how much they are "for sale" for a fortune but I'm not convinced people are getting the significant sums people refer to on a reliable basis.

It is in the very specific case that: (1) You are effective at finding the specific kinds of vulnerabilities that the grey market actually purchases. People have _very_ weird ideas about what the grey market wants. In reality, if your bug isn't a drive-by clientside in a popular client, it is unlikely that anyone wants to buy it. (2) You are willing to get your hands dirty with shady purchasers. If you're talented, you can make good money in the grey market, or you can retain plausible deniability about what your work is being used for, but you can't do both of those things. That first case is really the limiting factor. And remember, if you can reliably sell bugs to the grey market, that strongly implies you have lucrative options in the legitimate market. Bug bounties are not the most competitive alternative to the grey market!

dsl 9y ago
> In reality, if your bug isn't a drive-by clientside in a popular client, it is unlikely that anyone wants to buy it. That sounds like black market buyers (maybe we disagree on where the "gray" line is). Governments are very interested in bugs that allow pivoting and lateral movement.
- daddyo 9y ago
  How would one, hypothetically, go about selling exploits/bugs to governments as a freelancer?
  - big_youth 9y ago
    Plenty of brokers exist, I'm personally familiar with Exodus Intelligence and Zerodium
  - dsacco 9y ago
    The nature of the work is such that: 1. If you have to ask this question, you are quite far from being able to do it any time soon (and that's assuming you can find the vulnerabilities!), 2. You will predominantly sell your vulnerabilities, preferably weaponized as complete exploits, to firms that specialize in "vulnerability research" and "exploitation development" with close ties to government agencies. It's much easier to find a firm that can act as a broker between you and the government agency than it is to knock on the right doors to sell it on your own, with no background or prior contact.

technion 9y ago

I've looked at dartknet markets. Quite often, there are vulnerabilities advertised for thousands or tens of thousands of dollars. And quite often, they claim to be an exclusive sale (ie, they'll take it down after one purchase). And quite often, they will be relisted for months at a time. I'm not at all saying there's no market - we clearly know that a remote code exec on a common server will sell well. Things like "Microsoft Word Exploit" seem a lot more like Duff beer - I'm often hearing how much they are "for sale" for a fortune but I'm not convinced people are getting the significant sums people refer to on a reliable basis.