6 ms·

If I'm a hacker and I have an Apple 0-day, why the hell would I report it to Apple if I can quickly get a tidy payment on the black market?

by throwaway20371 5y ago

twox2 5y ago
Maybe because you don't want to be an arms dealer? Or you don't want to risk prison.
- SXX 5y ago
  What law is there against selling vuln to a random person on internet? And yeah you don't really need "Black" market. There is plenty "legit" companies around the globe that absolutely immoral, but their business as legal as it's could be.
  - caeril 5y ago
    Precisely this. Zerodium will sell your bug to the FBI, who will be happy to use it to incarcerate more Americans. They'll also absolutely sell it to China, they'll just be quiet about it and use one of many Thailand-based intermediaries.
  - twox2 5y ago
    If you sell something to someone and they use it to commit a crime, you are culpable if you even had a wiff that it was going to be used for something illegal. So if you're selling 0days on the blackmarket, you can bet your ass they will come after you sooner or later. The companies that immoral & legal, have paved their own way, but since you're not going to be selling to governments directly, don't count on being able to get away with it.
    - SXX 5y ago
      Can you provide some examples in US / EU of people being charged for selling vulns on "black market"? Otherwise it's just baseless FUD. I guess far bigger problem for researcher would be to actually not being scammed while selling and this is why companies like Zerodium have their marketshare. Yeah someone could pay to you in crypto, but chances that you'll just gonna be scammed are extremely high.
      - twox2 5y ago
        It's not really baseless. There might not be a high profile "this dude sold a 0day and got arrested" case yet, but there are cases of folks selling software / hardware cracking tools getting indicted. There's also this really interesting story: https://www.wired.com/2013/03/alfred-anaya/ https://www.wired.com/2013/03/alfred-anaya/ Dude caught serious prison time just for making hidden compartments in cars and they put him away based on the fact that he knew his customers where in the drug business. Selling high impact 0days definitely seems like a risky business IMO.
- 0des 5y ago
  Not if you're selling to the agencies, it's a completely different playing field and the money is much more available.
  - twox2 5y ago
    Selling to agencies doesn't make you less of an arms dealer. It's up to you if you're ok with that or not.
throwaway98797 5y ago
That local 7-11 sure has a lot of cash and a sleepy clerk working it. How can I monetize ethics? We live in a society. We try to abide by the mores.
- akomtu 5y ago
  Apple is trying to push a censorship module (that file scanner) onto every iPhone. That would be a massive damage to our society at a scale no black hat could ever make. Apple is certainly not a bastion of ethics.
  - mtnGoat 5y ago
    true, but as the saying goes... two wrongs a right does not make.
    - akomtu 5y ago
      Is robbing a robber a crime?
      - throwaway20371 5y ago
        Yes, if the robber is a baron.
      - occamrazor 5y ago
        In fact, in most jurisdictions it is.
      - mtnGoat 5y ago
        who has the better attorney?
  - throwaway98797 5y ago
    You do you. Don’t be surprised when you get cast off into exile. Society is pedagogically just.
- throwaway20371 5y ago

If I'm a hacker and I have an Apple 0-day, why the hell would I report it to Apple if I can quickly get a tidy payment on the black market?

twox2 5y ago

Maybe because you don't want to be an arms dealer? Or you don't want to risk prison.

SXX 5y ago
What law is there against selling vuln to a random person on internet? And yeah you don't really need "Black" market. There is plenty "legit" companies around the globe that absolutely immoral, but their business as legal as it's could be.
- caeril 5y ago
  Precisely this. Zerodium will sell your bug to the FBI, who will be happy to use it to incarcerate more Americans. They'll also absolutely sell it to China, they'll just be quiet about it and use one of many Thailand-based intermediaries.
- twox2 5y ago
  If you sell something to someone and they use it to commit a crime, you are culpable if you even had a wiff that it was going to be used for something illegal. So if you're selling 0days on the blackmarket, you can bet your ass they will come after you sooner or later. The companies that immoral & legal, have paved their own way, but since you're not going to be selling to governments directly, don't count on being able to get away with it.
  - SXX 5y ago
    Can you provide some examples in US / EU of people being charged for selling vulns on "black market"? Otherwise it's just baseless FUD. I guess far bigger problem for researcher would be to actually not being scammed while selling and this is why companies like Zerodium have their marketshare. Yeah someone could pay to you in crypto, but chances that you'll just gonna be scammed are extremely high.
    - twox2 5y ago
      It's not really baseless. There might not be a high profile "this dude sold a 0day and got arrested" case yet, but there are cases of folks selling software / hardware cracking tools getting indicted. There's also this really interesting story: https://www.wired.com/2013/03/alfred-anaya/ https://www.wired.com/2013/03/alfred-anaya/ Dude caught serious prison time just for making hidden compartments in cars and they put him away based on the fact that he knew his customers where in the drug business. Selling high impact 0days definitely seems like a risky business IMO.
0des 5y ago
Not if you're selling to the agencies, it's a completely different playing field and the money is much more available.
- twox2 5y ago
  Selling to agencies doesn't make you less of an arms dealer. It's up to you if you're ok with that or not.

throwaway98797 5y ago

That local 7-11 sure has a lot of cash and a sleepy clerk working it. How can I monetize ethics? We live in a society. We try to abide by the mores.

akomtu 5y ago
Apple is trying to push a censorship module (that file scanner) onto every iPhone. That would be a massive damage to our society at a scale no black hat could ever make. Apple is certainly not a bastion of ethics.
- mtnGoat 5y ago
  true, but as the saying goes... two wrongs a right does not make.
  - akomtu 5y ago
    Is robbing a robber a crime?
    - throwaway20371 5y ago
      Yes, if the robber is a baron.
    - occamrazor 5y ago
      In fact, in most jurisdictions it is.
    - mtnGoat 5y ago
      who has the better attorney?
- throwaway98797 5y ago
  You do you. Don’t be surprised when you get cast off into exile. Society is pedagogically just.
throwaway20371 5y ago