4 ms·
End of the post it says 51k so far. I'd expect the price to go up a LOT more, because otherwise the sane (monetary) advice becomes "report some vulnerabilities
by CGamesPlay 6y ago
End of the post it says 51k so far. I'd expect the price to go up a LOT more, because otherwise the sane (monetary) advice becomes "report some vulnerabilities to apple, and then keep finding them and sell them to third parties".
- oarsinsync 6y agoThat's only true if you have no way to be put in (financial) risk by the vulnerability you're not disclosing to Apple.
- bogwog 6y agoIf you're a security researcher, you probably know how to cover your tracks.
- saagarjha 6y agoYes, but the risk if you’re caught is huge.
- stjohnswarts 6y agonot if you're selling them to -your- government. Then you're a patriot but also a rich patriot.
- searchableguy 6y agoWhere do security researchers sell their investigation on the black market? Links?
- shmatt 6y agoany company that builds software for government tracking like NSO Group will happily pay, and have very deep pockets
- nixgeek 6y agoZerodium is probably the closest thing to a “legitimate” acquirer of exploits, those which aren’t being disclosed to the vendor and then fixed.
- nbk_2000 6y agoThe following companies buy 0-days. Each has a slightly different business model: Zerodium - http://zerodium.com/ http://zerodium.com/ Azimuth Security - https://www.azimuthsecurity.com/ https://www.azimuthsecurity.com/ NSO Group - https://www.nsogroup.com/ https://www.nsogroup.com/ ZDI - https://www.zerodayinitiative.com/ https://www.zerodayinitiative.com/ SSD - https://ssd-disclosure.com/ https://ssd-disclosure.com/
- XMPPwocky 6y agoDo you? The skills involved in VR and exploit dev don't necessarily mean you're good at opsec.
- nbk_2000 6y agoTrue, plus "opsec life sucks" so most of us don't do it.
- anonymousisme 6y agoThere are defense contractors that do exactly this. Governments pay more than Apple will ever pay, so if you are in it for the money (and don't care about the ethical repercussions), selling the discovered exploits to governments is the way to go.
- JoblessWonder 6y agoYeah, that is only for 4 vulnerabilities out of 55. And 3 of them were only "High." They still have 10 (!!) more critical vulnerabilities they may receive payment on. Also, they state in the article: "However, it appears that Apple does payments in batches and will likely pay for more of the issues in the following months."
- JoblessWonder 6y agoUpdate: They just paid for 28 more issues, running total is now $288,500. https://twitter.com/samwcyo/status/1314310787243167744 https://twitter.com/samwcyo/status/1314310787243167744
- stjohnswarts 6y agoYeah I imagine you can make a lot more money selling them to state actors than to apple.