5 ms·
From the article: >Previously, a company called Zerodium was vocal about how much it will pay researchers, before handing them to its unknown government custom
by Despegar 7y ago
From the article:
>Previously, a company called Zerodium was vocal about how much it will pay researchers, before handing them to its unknown government customers. In January, the secretive company announced it was offering $2 million for a remote hack of an iPhone.
So that's already more than what Apple offers. I tend to think they'll always be outbid.
- robertAngst 7y agoGovernments are strong. Wow. I forget the influence until I see things like this.
- TheRealSteel 7y agoApologies, I did fail to RTFA in this case. Thankyou!
- deleted 7y ago[deleted]
- tptacek 7y agoI don't know many people here who believe Zerodium's price list, and while I can't speak to Zerodium's payment terms, the norm appears to be tranched payments, apparently ofter over a year; selling the same bug on the grey market for "more" money (whatever it is brokers actually pay) is a gamble that the bug you've sold isn't going to die.
- joshbetz 7y agoWith those terms, they can buy a bug, report it to Apple, collect the $1m, and be off the hook to pay out the remaining payments. It seems to me this makes it much riskier to go to the black market than people here realize.
- grugq 7y agoYes, because that is exactly the sort of behavior that a business would engage in. Screwing over their suppliers and demonstrating that they offer no value whatsoever. How would that make any sense? It is ludicrous.
- Twisell 7y agoWould be a nice pivot for patent troll companies. In a world where profit is king the question is not why, but when?
- tptacek 7y agoA nice pivot for patent companies would be somehow generating the connections and reputation to participate as brokers in this super-insular and highly technical marketplace, and then burn all that work down to fuck over an individual researcher for pocket change?
- toufka 7y agoA "remote hack" generally relies on a stack of exploits. From what I recall when the last jailbreaks came about, that stack was at least 5 or so exploits deep. So $1M/exploit is priced significantly ahead of the $2M/hack. Interesting this also means that an entire exploitable stack now becomes worth a lot more, while any given exploit is worth a lot less. And any stack of exploits becomes much more brittle, as a patch of a single one of N exploits can knock out the use of the stack.
- asp_hornet 7y agoI’d rather a legitimate 1 million I can declare and put in my bank than 2 million from the underworld delivered in instalments in bitcoin.