3 ms·
This seems like the market for risk at work. Just as in drug trafficking, more money tends to go to parties that take on more risk. In this case, that's the cri
by ohazi 6y ago
This seems like the market for risk at work. Just as in drug trafficking, more money tends to go to parties that take on more risk. In this case, that's the criminals doing the extorting. So unless the security researcher wants to engage in illegal activity themselves, they probably aren't going to get anywhere close to the extortion dollar amount by just selling their exploit to criminals. At best they'll probably get something close to a large bug bounty, or maybe a few times that.
When setting bug bounty payouts, the company should be looking at what security researchers are likely to get when selling an exploit to criminals, not the actual extortion dollar amount (assuming that most security researchers are not willing to personally engage in illegal activity themselves, which appears to be the case).
However, when evaluating the value that a bug bounty program brings to the company, they should absolutely consider these typical extortion amounts.
- nordsieck 6y ago> This seems like the market for risk at work. Just as in drug trafficking, more money tends to go to parties that take on more risk. In this case, that's the criminals doing the extorting. So unless the security researcher wants to engage in illegal activity themselves, they probably aren't going to get anywhere close to the extortion dollar amount by just selling their exploit to criminals. At best they'll probably get something close to a large bug bounty, or maybe a few times that. This doesn't strike me as a very accurate assessment of the situation. There are already markets where people can buy and sell exploits: researchers don't have to get their hands dirty to get paid for their exploits.
- ohazi 6y agoYou've missed my point. I'm saying that the market value of actually performing an illegal act of extortion is higher than the market value of a zero-day, either on one of these markets or via bug bounty. I'm arguing that the price is different because of the risk of getting caught and going to jail, not that there isn't a market for security researchers to sell exploits to criminals without otherwise getting their hands dirty.
- smabie 6y agoExactly, you need the risk adjusted prices to match up. Getting paid a bug bounty isn't very risky, so the price is always going to be lower than selling or using the exploit yourself. That being said, I still think bug bounties are too low, even when risk adjusting.
- hombre_fatal 6y agoI also don't think they're empathizing with what it would actually be like to sell a zero day. Taking the certain $10k is the better deal over hunting for a shady buyer on shady sites who might send you some bitcoin if the deal even pans out or if they even pay. That's a lot more work and uncertainty while they act like it's just the choice between which lever to pull. A bird in the hand…