3 ms·
Why don't state actors that are explicitly aligned against the USA have public bug buying programs? Like a Russian website where you can go and submit your bug
by spoonjim 6y ago
Why don't state actors that are explicitly aligned against the USA have public bug buying programs? Like a Russian website where you can go and submit your bug and get $250K.
- roveo 6y agoBecause a vulnerability in FB's legal admin panel (and most other vulnerabilities) doesn't interest said state actors? Anything mildly "interesting" being sold through such a program would be high treason. How do you know this "Russian website" isn't actually a CIA honeypot? Or maybe it's not a honeypot, but instead of paying you 250K you just die of heart attack in a couple of months? Or they sell your identity back to your govt. as part of some unrelated game. Bad business.
- JetSpiegel 6y agoAdvertise on RT, or something like that mostly public.
- octoberfranklin 6y agoHoneypots, I guess? At least that's what I'd set up if I were CIA/NSA. Ask Facebook to create a bunch of vulns that leave the intruder in a sandbox, sell the vulns, and watch where the attacks come from.
- spacemanmatt 6y agoThat's called selling on the dark web, and it's at least vaguely mercenary, IMO
- TimJRobinson 6y agoMany do. On Darknet Diaries Podcast they mentioned even the NSA buys zero days, and selling to them (if you're a US citizen) won't be (as?) illegal as selling to a foreign nation is.