3 ms·

Could someone with insight give an estimate for how much you could sell an exploit like this, which let's you RCE a fair bunch of developer machines? It feels

• rabite 5y ago
  I just asked around, I immediately had someone who I've sold exploits to tell me I could field 45k for a bug like this. There's a lot of conditions to selling exploits -- the biggest being that you don't get to blog about what you sell. But it is real money.
• gostsamo 5y ago
  Just say "supply chain attacks" and the price can reach millions.
• stonepresto 5y ago
  Your feeling is correct, although as other comments have mentioned it depends greatly on how you market it and to whom. Probably well above $5-10k though. Bug bounty is good in some respects, but the people who profit the most from it are the companies and platforms. IMO it feels dirty to exploit people’s good intentions and ethics (reporting vs selling) for profits, but that’s corporations for you.
• rfoo 5y ago
  Fortunately, demand for such bugs is pretty low ^, so, $1~2k I guess. ^ this is both a good and a sad indicator, it means the bar of post-exploitation for such a bug (on developers' boxes) is "sufficiently high" that your favorite ransomware gangs are not eager to get on. OTOH it means they have way more "easier" enterprise-y targets...