3 ms·
What's the business model of zerodium? Do they sell them on black market somehow? Why is it able to pay $2M if they weren't going to be able to extort more bou
by alpb 7y ago
What's the business model of zerodium? Do they sell them on black market somehow? Why is it able to pay $2M if they weren't going to be able to extort more bounty from Apple (which at that point the security researcher herself can go to Apple, as well?)
- jtokoph 7y agoThis is the first I’ve heard of them but they seem to be based in DC and have government clients. I’m guessing they are funded by the US government to acquire vulnerabilities to use against targets as well as defend from being sold to other countries first.
- alpb 7y agoThat sounds grossly unethical. While the US somehow defends itself from being sold to other countries first (which it still might be), it probably also acquires them to attack/spy on its own citizens as there's been precedents about this, and no indication of policy change to stop it.
- bigiain 7y ago> it probably also acquires them to attack/spy on its own citizens Or possibly, "to spy on foreign nationals and to share with FVEY partners - who'll do the spying on US citizens, because doing it themselves would be illegal"... :sigh:
- lern_too_spel 7y agoAsking other countries spy on US citizens is also illegal. You are spreading a rumor that has no basis in fact.
- jnwatson 7y agoWhat do you think the CIA and CyberCom do for a living? Buying vulns/exploits is just a little government outsourcing.
- StuffedParrot 7y agoEthically, comparing to the CIA is about lowest bar possible.
- deleted 7y ago[deleted]
- numpad0 7y agoThey do entertaining things as long as you are comfortably more than ten feet from the end where freedom is expelled at supersonic speeds though, like, from buying Titanium sheets from communists to build the fastest airplanes to spy communists, to letting own psycos spike unsuspecting grad school elites to experimentally manufacture terrorists
- deleted 7y ago[deleted]
- tptacek 7y agoCommercial vulnerability brokers don't pay out up front; they pay in monthly tranches, and stop paying when the vulnerability stops working. It's not an apples-apples comparison with bounty payouts.
- wyxuan 7y agoWhat's the incentive to go to cellebrite rather than Apple? Cellebrite offers more but Apple does lump sum, from what I can tell.
- Polylactic_acid 7y agoI guess thats what stops you selling it to multiple orgs.