5 ms·

Is it illegal in the US to sell zero-day exploits, or to package up zero-day exploits into nice usable tools? My understanding is that it is not illegal, but so

by edge17 5y ago

Is it illegal in the US to sell zero-day exploits, or to package up zero-day exploits into nice usable tools? My understanding is that it is not illegal, but something like this perhaps give the US a tool to pursue and/or prosecute individuals that engage in these types of sales when they are selling to the 'wrong' customer (the 'right' customer being NSA or other US intelligence gathering operations).

OminousWeapons 5y ago
To my knowledge, it is illegal to sell exploit kits to actors that you know are going to use the kits to commit crimes (e.g. if someone sends you an email saying "I'm looking for an exploit kit so that I can attack company X and steal their IP", you cannot legally sell to them). It is otherwise legal to sell, rent, or give away exploits to the general public or to resellers like Zerodium as long as they are not marketed as criminal tools.
- edge17 5y ago
  For sure, but in practical terms these types of dealings often have middle men and the end buyer is often not known (by design). Everything I know is from podcasts and books, so I'm not an authority on the subject - though I would point out that the enormous amount of red tape in the west tends to be something that westerners seem to project onto the rest of the world. In much of the world, things are just far more loose.
wil421 5y ago
Read the book This Is How They Tell Me the World Ends: The Cyberweapons Arms Race by Nicole Perlroth There’s a few chapters in the beginning about the history of the exploit market. Haven’t finished it yet. To my knowledge it’s not illegal to sell vulnerabilities. If you’re not a government contractor selling/contracting to the US government it would be illegal to sell exploit chains or working software that uses the exploits/malware what have you. The book touches on how they sold multiple of the same zero days to multiple agencies. It got to the point where one of the guys was like you (3 letter agencies) need to talk to each other and stop wasting taxpayer money.

by edge17 5y ago

OminousWeapons 5y ago

To my knowledge, it is illegal to sell exploit kits to actors that you know are going to use the kits to commit crimes (e.g. if someone sends you an email saying "I'm looking for an exploit kit so that I can attack company X and steal their IP", you cannot legally sell to them). It is otherwise legal to sell, rent, or give away exploits to the general public or to resellers like Zerodium as long as they are not marketed as criminal tools.

edge17 5y ago
For sure, but in practical terms these types of dealings often have middle men and the end buyer is often not known (by design). Everything I know is from podcasts and books, so I'm not an authority on the subject - though I would point out that the enormous amount of red tape in the west tends to be something that westerners seem to project onto the rest of the world. In much of the world, things are just far more loose.

wil421 5y ago

Read the book This Is How They Tell Me the World Ends: The Cyberweapons Arms Race by Nicole Perlroth There’s a few chapters in the beginning about the history of the exploit market. Haven’t finished it yet. To my knowledge it’s not illegal to sell vulnerabilities. If you’re not a government contractor selling/contracting to the US government it would be illegal to sell exploit chains or working software that uses the exploits/malware what have you. The book touches on how they sold multiple of the same zero days to multiple agencies. It got to the point where one of the guys was like you (3 letter agencies) need to talk to each other and stop wasting taxpayer money.