4 ms·
>> For a 0-day no click exploit, $500k . Which company is that again? You hang around with them cybersec folks too long and you keep hearing about these 6 or 7
by rixrax 8y ago
>> For a 0-day no click exploit, $500k .
Which company is that again? You hang around with them cybersec folks too long and you keep hearing about these 6 or 7-figure payouts for expl0its by some mysterious companies.
But it's always someones friend or friend of friend or some other 'reliable' source.
Can someone here actually say that they have received, or more importantly, are on a consistent basis getting 6-figure payouts for their exploits?
For reference, Microsoft offers bug bounties up-to $250k[0]. I can see that in light of this, it's not entirely unreasonable that some tax payer money has been wasted on buying an exploit or two for large amounts of $$$. But what I am calling into question is the myth of consistent 6/7-figure payouts for 'exploits' when sold to 'shady' companies or that such payments would be common place or such markets being generally available to security 'researchers' (read exploit developers).
Intrigued to be proven wrong here! :)
[0] URL: https://www.microsoft.com/en-us/msrc/bounty https://www.microsoft.com/en-us/msrc/bounty
- cortesoft 8y ago> Can someone here actually say that they have received, or more importantly, are on a consistent basis getting 6-figure payouts for their exploits? I am not going to make any claim on whether people are or are not receiving payments, but anyone who actually is would clearly not disclose it directly, because that would most likely break the terms of the payment. The fact that no one is saying are getting paid directly for exploits is not evidence that it is not happening.
- wepple 8y agohttps://zerodium.com/program.html https://zerodium.com/program.html This is fairly vague, and “up to $X” butnpossibly provides a touch more concrete-ness than you’ve seen so far. You’re right though; you won’t find anyone who is currently selling 0day exploits to brokers or govt who will be willing to go on record. Or even admit that they sell them.
- rixrax 8y agoThanks for this link. It looks like my skepticism may not have been well founded. Are there [many] other similar companies out there? Now that my curiosity peaked, they are the only one mentioned in Wikipedia[0] related to this activity. And as an add-on question to satisfy my curiosity, how would one know when approaching company such as one linked here that the exploit sold will be used by good-guys<tm> and doesn't come to haunt you later when it ends up being used by bad-guys<tm>? [0] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits
- wepple 8y agodisclaimer: I haven’t sold a single exploit, so am taking a few guesses here. Approx ~5 of my relatively close friends are exploit devs, and most of them don’t talk about anything beyond the name of the company they work for. There aren’t a ton of companies, but once you’ve worked in the general offense industry, names start to reappear regularly. I’m not sure what your definition of good/bad guy is. If you don’t like the idea of 0day used for “cyber warfare” then it’s easy: only sell directly to the vendor. If your idea of good guy is your own nation, you can usually tell a companies alignment. They’ll have an ex-NSA CEO, or close partnership with a defense contractor. Ultimately you’re never sure though. Edit: I’ll also add that in your earlier post you mention the high cost, and wasting of taxpayer dollars. I don’t disagree, but an interesting way to look at it is value per dollar. If you look up the cost of running a state of the art attack helicopter or even just a couple of hummers loaded up with navy seals and all their kit, you find that dropping a $1m piece of remote Jailbreak malware on a bad actor is actually really amazing ROI in terms of finding out what your enemy is upto, and disrupting their plans.