4 ms·
Aboveground, even - I've seen claims that brokers will allow seller's discretion on where exploits can go. (E.g. "NATO only".) Northrup-Grumman, Raytheon, and L
by Bartweiss 9y ago
Aboveground, even - I've seen claims that brokers will allow seller's discretion on where exploits can go. (E.g. "NATO only".) Northrup-Grumman, Raytheon, and Lockheed are commonly listed as zero day buyers. Presumably those channels either get passed on to American intelligence, or used defensively to make a "safer than the competition" claim.
It's certainly fairly overt, though I don't know the legal standing. Whether or not a researcher broke CFAA in finding a bug, is describing it to a third party a criminal act?
- willstrafach 9y agoCFAA would apply only if the bug involved unauthorized access to the company’s servers (The violation being the researcher accessing them to validate). The zero days you refer to would instead be vulnerabilities in software which a researcher would test against local software / hardware they own, not only for legal reasons, but also because actively probing a web server can set off alarm bells (Making access less useful after validation).