2 ms·

Thanks for this link. It looks like my skepticism may not have been well founded. Are there [many] other similar companies out there? Now that my curiosity peak

by rixrax 8y ago

Thanks for this link. It looks like my skepticism may not have been well founded. Are there [many] other similar companies out there? Now that my curiosity peaked, they are the only one mentioned in Wikipedia[0] related to this activity. And as an add-on question to satisfy my curiosity, how would one know when approaching company such as one linked here that the exploit sold will be used by good-guys<tm> and doesn't come to haunt you later when it ends up being used by bad-guys<tm>? [0] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits

wepple 8y ago
disclaimer: I haven’t sold a single exploit, so am taking a few guesses here. Approx ~5 of my relatively close friends are exploit devs, and most of them don’t talk about anything beyond the name of the company they work for. There aren’t a ton of companies, but once you’ve worked in the general offense industry, names start to reappear regularly. I’m not sure what your definition of good/bad guy is. If you don’t like the idea of 0day used for “cyber warfare” then it’s easy: only sell directly to the vendor. If your idea of good guy is your own nation, you can usually tell a companies alignment. They’ll have an ex-NSA CEO, or close partnership with a defense contractor. Ultimately you’re never sure though. Edit: I’ll also add that in your earlier post you mention the high cost, and wasting of taxpayer dollars. I don’t disagree, but an interesting way to look at it is value per dollar. If you look up the cost of running a state of the art attack helicopter or even just a couple of hummers loaded up with navy seals and all their kit, you find that dropping a $1m piece of remote Jailbreak malware on a bad actor is actually really amazing ROI in terms of finding out what your enemy is upto, and disrupting their plans.

by rixrax 8y ago

wepple 8y ago

disclaimer: I haven’t sold a single exploit, so am taking a few guesses here. Approx ~5 of my relatively close friends are exploit devs, and most of them don’t talk about anything beyond the name of the company they work for. There aren’t a ton of companies, but once you’ve worked in the general offense industry, names start to reappear regularly. I’m not sure what your definition of good/bad guy is. If you don’t like the idea of 0day used for “cyber warfare” then it’s easy: only sell directly to the vendor. If your idea of good guy is your own nation, you can usually tell a companies alignment. They’ll have an ex-NSA CEO, or close partnership with a defense contractor. Ultimately you’re never sure though. Edit: I’ll also add that in your earlier post you mention the high cost, and wasting of taxpayer dollars. I don’t disagree, but an interesting way to look at it is value per dollar. If you look up the cost of running a state of the art attack helicopter or even just a couple of hummers loaded up with navy seals and all their kit, you find that dropping a $1m piece of remote Jailbreak malware on a bad actor is actually really amazing ROI in terms of finding out what your enemy is upto, and disrupting their plans.