3 ms·

Isn’t legal involved in most business moves? Getting a wind of those ahead of a public announcement surely must be worth something ;)

• detaro 6y ago
  A "market" needs a bit more than "is worth something". What multiplier of the $7500 bounty would you want for the trouble of committing a crime? Who's the buyer (FB afaik doesn't buy a whole lot of publicly traded companies, so it probably needs to be someone who can get into the deals, and quickly)? How do you find them? How do you convince that buyer that your deal is worth the money and the hassle of committing a crime? How do you trust the buyer? How do you handle it if the hole gets closed before the buyer can profit? How do you value the risk it gets closed before you got your deal? Does all that work out in a way that you really don't want to take the bounty? People buying backdoor access into companies probably happens occasionally, but it's probably not the easy high-profit thing compared to bounties many people think, but rather on the level of selling account information by the dozen for a few bucks - and for something like that you'll burn them quickly.
  • tedunangst 6y ago
    In other words, how much would Pepsi pay for the secret recipe to Coke?
    • rascul 6y ago
      Pepsi would report the person to Coca Cola instead of buying the recipe. https://thehustle.co/coca-cola-stolen-recipe https://thehustle.co/coca-cola-stolen-recipe > Months earlier, when Pepsi received the trio’s initial letter, they’d promptly forwarded it to Coca-Cola, and informed them they had a leaker. In turn, Coca-Cola had brought in the FBI to conduct an undercover investigation. > On July 5, 2006, Williams, Dimson, and Duhaney were arrested on charges of wire fraud and unlawfully stealing and selling trade secrets.
  • tptacek 6y ago
    I believe a good way to think about the market for vulnerabilities is this: There are markets for vulnerabilities that slot seamlessly into existing business processes. In other words, you can tend to find a buyer for a vulnerability that would replace another vulnerability already being used, that accomplishes pretty much exactly the same thing as that vulnerability. The more people run that business process, the more likely it is that there's a liquid market. Lots of organizations have business processes that rely on browser RCEs. Generally, there aren't many organizations that have business process that rely on serverside vulnerabilities in line-of-business applications that have instantaneous half-lives, because once the patch is developed they're gone.
    • detaro 6y ago
      Interesting. I guess a real-world analogy is theft of valuables. If you steal random money, that's easy to turn into value. There's a harder to access criminal industry smelting down gold, which will equally reduce jewelry and priceless museum artifacts to material value. And a unique well-known painting is pretty much impossible to sell if you aren't already connected to a buyer with a specific interest.
  • mszcz 6y ago
    Didn’t say it was easy to monetize. I do recall a bust, some time ago, of a ring that used prerelease (?) announcement pdfs already placed on publicly accessible servers (?) as a source of insider alpha. (‘?’ because I’m on my third whiskey and about to turn in :)
    • detaro 6y ago
      Yeah, the response is purely in context of the mentions of "black market" value higher up the thread. Being able to turn potential gain for someone into actual money for you is the key issue.