3 ms·
IANAL but I would think selling exploits would be legal (and distinct from using them). A very strong argument could be made that it's no different than an empl
by michaelbuckbee 18y ago
IANAL but I would think selling exploits would be legal (and distinct from using them). A very strong argument could be made that it's no different than an employee of one of the security groups or the government uncovering them.
- wmf 18y agoThe whole business stinks. I wonder if these black hats offer right of first refusal to the affected vendors, because that sure sounds like extortion. "I'll happily sell this exploit to you... or to the Russian mob -- it's your choice."
- tptacek 18y agoNo. People who sell vulnerabilities sell them immediately, to well-known brokers. At least part of the market for vulnerabilities is open and "above board" --- TippingPoint's Zero Day Initiative and iDefense being two of the best known. Most of the brokers you've heard of have relatively strict policies on notifying the vendor and securing patches prior to open release, though there's usually loopholes that benefit the broker themselves.
- tptacek 18y agoThe two obstacles to selling vulnerabilities are NDAs, which you certainly have if you're an employee of the company you're selling out, and shrink-wrap licenses, which universally forbid reverse engineering.