7 ms·

That's fine. If Congress illegalizes speech of this nature, then public disclosures of exploits and other code errors won't happen nearly as often. So what wou

That's fine. If Congress illegalizes speech of this nature, then public disclosures of exploits and other code errors won't happen nearly as often. So what would happen then? There's many, many organizations that are willing to pay for exploits, because they plan to use them. There's one such company in DC that is likely to sell to the defense industry. For a 0-day no click exploit, $500k . So sure, make it illegal. You only push this into the illegal side of operations and exploits. And I would much rather have exploits well known, so I can make the determination to: do nothing, take service down until fixed, or try to patch if available.

amelius 8y ago
It should then also be illegal to disclose exploits of the tax system, etc. Hacking is not limited to electronics, but can also happen to any of our social/legal constructs.
- crankylinuxuser 8y ago
  Ugh. Your comment reminds me of the Etherium DAO debacle. Is the law the actual legal code, or should it be conjoineded with the spirit and justification for the law? If the law is the law, devoid of underlying reason, then it is no exploit to discuss edge cases in the law. It is indeed the law, regardless the intentions upon initial discussion and passing. It also doesn't hurt that most of these edge cases can only be triggered with large amounts of money. Us normal people can look at the edge cases, but never touch.
fosco 8y ago
what company?
rixrax 8y ago
>> For a 0-day no click exploit, $500k . Which company is that again? You hang around with them cybersec folks too long and you keep hearing about these 6 or 7-figure payouts for expl0its by some mysterious companies. But it's always someones friend or friend of friend or some other 'reliable' source. Can someone here actually say that they have received, or more importantly, are on a consistent basis getting 6-figure payouts for their exploits? For reference, Microsoft offers bug bounties up-to $250k[0]. I can see that in light of this, it's not entirely unreasonable that some tax payer money has been wasted on buying an exploit or two for large amounts of $$$. But what I am calling into question is the myth of consistent 6/7-figure payouts for 'exploits' when sold to 'shady' companies or that such payments would be common place or such markets being generally available to security 'researchers' (read exploit developers). Intrigued to be proven wrong here! :) [0] URL: https://www.microsoft.com/en-us/msrc/bounty https://www.microsoft.com/en-us/msrc/bounty
- cortesoft 8y ago
  > Can someone here actually say that they have received, or more importantly, are on a consistent basis getting 6-figure payouts for their exploits? I am not going to make any claim on whether people are or are not receiving payments, but anyone who actually is would clearly not disclose it directly, because that would most likely break the terms of the payment. The fact that no one is saying are getting paid directly for exploits is not evidence that it is not happening.
- wepple 8y ago
  https://zerodium.com/program.html https://zerodium.com/program.html This is fairly vague, and “up to $X” butnpossibly provides a touch more concrete-ness than you’ve seen so far. You’re right though; you won’t find anyone who is currently selling 0day exploits to brokers or govt who will be willing to go on record. Or even admit that they sell them.
  - rixrax 8y ago
    Thanks for this link. It looks like my skepticism may not have been well founded. Are there [many] other similar companies out there? Now that my curiosity peaked, they are the only one mentioned in Wikipedia[0] related to this activity. And as an add-on question to satisfy my curiosity, how would one know when approaching company such as one linked here that the exploit sold will be used by good-guys<tm> and doesn't come to haunt you later when it ends up being used by bad-guys<tm>? [0] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits
    - wepple 8y ago
      disclaimer: I haven’t sold a single exploit, so am taking a few guesses here. Approx ~5 of my relatively close friends are exploit devs, and most of them don’t talk about anything beyond the name of the company they work for. There aren’t a ton of companies, but once you’ve worked in the general offense industry, names start to reappear regularly. I’m not sure what your definition of good/bad guy is. If you don’t like the idea of 0day used for “cyber warfare” then it’s easy: only sell directly to the vendor. If your idea of good guy is your own nation, you can usually tell a companies alignment. They’ll have an ex-NSA CEO, or close partnership with a defense contractor. Ultimately you’re never sure though. Edit: I’ll also add that in your earlier post you mention the high cost, and wasting of taxpayer dollars. I don’t disagree, but an interesting way to look at it is value per dollar. If you look up the cost of running a state of the art attack helicopter or even just a couple of hummers loaded up with navy seals and all their kit, you find that dropping a $1m piece of remote Jailbreak malware on a bad actor is actually really amazing ROI in terms of finding out what your enemy is upto, and disrupting their plans.

amelius 8y ago

It should then also be illegal to disclose exploits of the tax system, etc. Hacking is not limited to electronics, but can also happen to any of our social/legal constructs.

crankylinuxuser 8y ago
Ugh. Your comment reminds me of the Etherium DAO debacle. Is the law the actual legal code, or should it be conjoineded with the spirit and justification for the law? If the law is the law, devoid of underlying reason, then it is no exploit to discuss edge cases in the law. It is indeed the law, regardless the intentions upon initial discussion and passing. It also doesn't hurt that most of these edge cases can only be triggered with large amounts of money. Us normal people can look at the edge cases, but never touch.

fosco 8y ago

what company?

rixrax 8y ago

>> For a 0-day no click exploit, $500k . Which company is that again? You hang around with them cybersec folks too long and you keep hearing about these 6 or 7-figure payouts for expl0its by some mysterious companies. But it's always someones friend or friend of friend or some other 'reliable' source. Can someone here actually say that they have received, or more importantly, are on a consistent basis getting 6-figure payouts for their exploits? For reference, Microsoft offers bug bounties up-to $250k[0]. I can see that in light of this, it's not entirely unreasonable that some tax payer money has been wasted on buying an exploit or two for large amounts of $$$. But what I am calling into question is the myth of consistent 6/7-figure payouts for 'exploits' when sold to 'shady' companies or that such payments would be common place or such markets being generally available to security 'researchers' (read exploit developers). Intrigued to be proven wrong here! :) [0] URL: https://www.microsoft.com/en-us/msrc/bounty https://www.microsoft.com/en-us/msrc/bounty

cortesoft 8y ago
> Can someone here actually say that they have received, or more importantly, are on a consistent basis getting 6-figure payouts for their exploits? I am not going to make any claim on whether people are or are not receiving payments, but anyone who actually is would clearly not disclose it directly, because that would most likely break the terms of the payment. The fact that no one is saying are getting paid directly for exploits is not evidence that it is not happening.
wepple 8y ago
https://zerodium.com/program.html https://zerodium.com/program.html This is fairly vague, and “up to $X” butnpossibly provides a touch more concrete-ness than you’ve seen so far. You’re right though; you won’t find anyone who is currently selling 0day exploits to brokers or govt who will be willing to go on record. Or even admit that they sell them.
- rixrax 8y ago
  Thanks for this link. It looks like my skepticism may not have been well founded. Are there [many] other similar companies out there? Now that my curiosity peaked, they are the only one mentioned in Wikipedia[0] related to this activity. And as an add-on question to satisfy my curiosity, how would one know when approaching company such as one linked here that the exploit sold will be used by good-guys<tm> and doesn't come to haunt you later when it ends up being used by bad-guys<tm>? [0] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits
  - wepple 8y ago
    disclaimer: I haven’t sold a single exploit, so am taking a few guesses here. Approx ~5 of my relatively close friends are exploit devs, and most of them don’t talk about anything beyond the name of the company they work for. There aren’t a ton of companies, but once you’ve worked in the general offense industry, names start to reappear regularly. I’m not sure what your definition of good/bad guy is. If you don’t like the idea of 0day used for “cyber warfare” then it’s easy: only sell directly to the vendor. If your idea of good guy is your own nation, you can usually tell a companies alignment. They’ll have an ex-NSA CEO, or close partnership with a defense contractor. Ultimately you’re never sure though. Edit: I’ll also add that in your earlier post you mention the high cost, and wasting of taxpayer dollars. I don’t disagree, but an interesting way to look at it is value per dollar. If you look up the cost of running a state of the art attack helicopter or even just a couple of hummers loaded up with navy seals and all their kit, you find that dropping a $1m piece of remote Jailbreak malware on a bad actor is actually really amazing ROI in terms of finding out what your enemy is upto, and disrupting their plans.