3 ms·
IMO the most interesting metric these days is bug price. https://zerodium.com/program.html https://zerodium.com/program.html Chrome bugs are currently selling
by px43 6y ago
IMO the most interesting metric these days is bug price.
https://zerodium.com/program.html https://zerodium.com/program.html
Chrome bugs are currently selling for $500k and Firefox/Edge bugs are selling for $100k. It's kind of shocking that we got to this point, but for comparison, a full Chrome exploit sells for the same amount as a full exploit for IIS or Apache. Firefox and Edge sell for the same price as a full exploit in Wordpress.
- stilisstuk 6y agoWhy is that interesting? It reflects number if users, not breeder security?
- px43 6y agoIf you track over time, which that site doesn't show, you'd see that "number of users" isn't much of a factor. There are a bunch of popular apps with shitty security practices that have cheaper bugs than less popular apps with better design practices. This is a great way to measure "attacker utility". That is, it's not only a measure of how rare some of these bugs are, but how useful they are to attackers. Chrome bugs have been significantly more expensive than IE bugs since long before Chrome overtook IE in popularity. For a while, Firefox bugs and Chrome bugs we neck and neck, because even though it was easier to find exploitable bugs in Firefox, the Intelligence Community was buying up Firefox bugs like mad in order to exploit Tor users, since Firefox is the underlying tech behind the Tor browser.