5 ms·
Isn't the idea of a bug bounty at this scale that the monetary reward (especially combined with the lowered legal risk, but also when considered in isolation) i
by TheRealSteel 7y ago
Isn't the idea of a bug bounty at this scale that the monetary reward (especially combined with the lowered legal risk, but also when considered in isolation) is higher from reporting it to the vendor than from selling it on the black market? I.E. presumably Apple has done their research and one million dollars is more than they believe you'd getting selling a zero day to somebody else.
I don't work in the security field nor am I a business number cruncher, but that was the gist I had of what these programs achieved.
Edit: see Despegar's reply, I should have RTFA! However worth pointing out that there would be some incentive for researchers to go to Apple instead of a third party, which might tip the scales in their favour.
- corobo 7y agoDepends who’s buying I imagine. Not sure about everyone else but I always picture the entities buying on the black market as singular people for some reason When you consider it could be the likes of the three digit shoe inspectors over there in the US it could be a fair chunk of change
- grugq 7y agoWho are these individuals that will pay millions of dollars for an exploit? Cyber criminals rely almost exclusively on dead bugs, frequently using exploits from the metasploit framework. That gives then sufficient access to a broad range of victims so they can generate revenue through volume. 0days are used against hardened targets. Think “Iranian nuclear facilities” rather than “grandma’s PC”
- corobo 7y agoThey are made up, in my head, figments of my imagination. Hence “for some reason”.
- grugq 7y agoYeah. They don’t exist. People don’t think about things rationally, they see phrases like “black market” and assume it is some sort of criminal transaction with armed guards and meetings at midnight and shit. It is nothing like that. It is the same as freelance development work, except there are very few customers and the developer writes something that may or may not have any value.
- Despegar 7y agoFrom the article: >Previously, a company called Zerodium was vocal about how much it will pay researchers, before handing them to its unknown government customers. In January, the secretive company announced it was offering $2 million for a remote hack of an iPhone. So that's already more than what Apple offers. I tend to think they'll always be outbid.
- robertAngst 7y agoGovernments are strong. Wow. I forget the influence until I see things like this.
- TheRealSteel 7y agoApologies, I did fail to RTFA in this case. Thankyou!
- deleted 7y ago[deleted]
- tptacek 7y agoI don't know many people here who believe Zerodium's price list, and while I can't speak to Zerodium's payment terms, the norm appears to be tranched payments, apparently ofter over a year; selling the same bug on the grey market for "more" money (whatever it is brokers actually pay) is a gamble that the bug you've sold isn't going to die.
- joshbetz 7y agoWith those terms, they can buy a bug, report it to Apple, collect the $1m, and be off the hook to pay out the remaining payments. It seems to me this makes it much riskier to go to the black market than people here realize.
- grugq 7y agoYes, because that is exactly the sort of behavior that a business would engage in. Screwing over their suppliers and demonstrating that they offer no value whatsoever. How would that make any sense? It is ludicrous.
- b_tterc_p 7y agoWorth adding that clean money is worth more than dirty money
- jjcm 7y agoIf the money is directly from the government, is it really dirty money?
- bigiain 7y agoYes.
- Supermancho 7y agoDepends which government, I would think.
- TheRealSteel 7y agoKind of what I meant by "Especially considering the lower legal risk" but I guess there's the specific cost of laundering it too. A good point!
- gmanley 7y ago
- astrodust 7y agoThere's going to be an equilibrium here dictated by how much Apple itself is willing to pay for bugs. If Apple pays more then presumably more bugs will get reported which makes the remaining unreported bugs much more valuable since they'll be relatively rare.
- gmanley 7y agoI would imagine the publicity a researcher would get from wining the 1 million is also very valuable.
- agumonkey 7y agoI wonder how a company investigates black market to that levels.