4 ms·
ZDI, like Apple, doesn't tell you the average price of the vulnerabilities you can sell to them when you email them (yes, Apple has example payout ranges, but t
by netsec_burn 5y ago
ZDI, like Apple, doesn't tell you the average price of the vulnerabilities you can sell to them when you email them (yes, Apple has example payout ranges, but they aren't clear on classification). At Pwn2Own, ZDI paid roughly half of what Apple should pay. When you consider Apple themselves are 1/4th the market price, thereby making ZDI 1/8th, it becomes impossible to work to them. I raised my concerns with ZDI, no reply.
I submitted some details (nothing technical, just the classification and affected platforms) of my vulnerability to Zerodium. Two days later someone tried to hack into all of my personal accounts and failed due to 2FA, and not many people have the email I used when I communicated with them. I've found other buyers outside the US, but I had ethical concerns and decided against them (at a 300K min loss).
- petercooper 5y agoThis isn't a judgment, by the way. I'm naive about this area and genuinely curious. I've found other buyers outside the US, but I had ethical concerns and decided against them (at a 300K min loss). What type of buyers exist who are unable to fix the vulnerability (in this case, who are not Apple or the affected vendor or do not collaborate with Apple, etc.) but might be considered ethical to sell to?
- 0des 5y agoCome on, we both know the score here.. There is no ethical purchaser.
- petercooper 5y agoThat was my assumption, but my netsec knowledge could be written on a stamp, so who knows! ;-) I imagine some people think being rewarded for finding vulnerabilities is unethical entirely, but there seems to be a huge dose of pragmatism around the space.
- netsec_burn 5y agoAnswered here: https://news.ycombinator.com/item?id=27875883 https://news.ycombinator.com/item?id=27875883
- petercooper 5y agoThanks - that was helpful.
- AlexAndScripts 5y agoWestern intelligence agencies?
- manquer 5y agoIn theory a large corp netsec team may buy zero days vulnerabilites and then either disable the affected systems or engage directly with the vendor. Alternatively depending on how nationalistic someone feels NSA could be a eithical buyer for them as well.