3 ms·

I do agree that bug bounties are too small, but isn't selling bugs on the black market illegal? I would much rather get $40 dollars for a bug and some public a

by _wldu 5y ago

I do agree that bug bounties are too small, but isn't selling bugs on the black market illegal? I would much rather get $40 dollars for a bug and some public acknowledgement (which I could use to get a better paying job) than to sell it for criminal use.

msoad 5y ago
Bitcoin solves this!
voakbasda 5y ago
Or, sell it on the black market, and use that connection to get a better job on the black market. Reputation is just as important for criminals, and crime pays better (until you get caught).
pixl97 5y ago
Assuming you live in a place where you can get a high paying job and/or leave the country to get one. Taking a US centric view on this is a great way to ensure nation states have compromised your security.
- tw04 5y ago
  So if you take a non-US centric view and assume there's no legal repercussions and the person finding the bug has no moral compass, what exactly would prevent them from sharing the bug with a nation state and you at the same time? Sure they may get slightly less from the nation state because the bug would have a shorter shelf life, but it would still make it into the wild long before every system could be patched. Paying more money isn't going to make someone do the right thing.
darkwater 5y ago
> but isn't selling bugs on the black market illegal? Noob question: is there any specific law that punishes describing how to get into a software/electronic system but not actually doing it? Something that is just not purely US-centric.
- ensignavenger 5y ago
  Here is UK specific answer, and as they point out, if you sell to some one knowing they are going to commit a crime with it, you can be considered an accomplice in many jurisdictions. https://law.stackexchange.com/questions/11552/is-it-illegal-to-create-and-sell-a-exploit-of-a-zero-day-vulnerability https://law.stackexchange.com/questions/11552/is-it-illegal-...
  - kube-system 5y ago
    Sounds like a market opportunity for middlemen in other jurisdictions.
nostoc 5y ago
How about selling legally to a state actor for 100k ? Bug bounties need to be higher, because the black market is not the only alternative.
- deleted 5y ago
  [deleted]
Debug_Overload 5y ago
The legal/ethical question is important, but I was just stressing OP's point about the disparity between bug bounties and what the actual exploits are worth. IANAL, but for the specific cases I mentioned (nation states and vendors who work with them), I think the legal aspect would be very different from selling it to regular black market cybercriminals (I used the generic "black market" in the first part of the original comment but I was mostly talking about those two cases).

by _wldu 5y ago

msoad 5y ago

Bitcoin solves this!

voakbasda 5y ago

Or, sell it on the black market, and use that connection to get a better job on the black market. Reputation is just as important for criminals, and crime pays better (until you get caught).

pixl97 5y ago

Assuming you live in a place where you can get a high paying job and/or leave the country to get one. Taking a US centric view on this is a great way to ensure nation states have compromised your security.

tw04 5y ago
So if you take a non-US centric view and assume there's no legal repercussions and the person finding the bug has no moral compass, what exactly would prevent them from sharing the bug with a nation state and you at the same time? Sure they may get slightly less from the nation state because the bug would have a shorter shelf life, but it would still make it into the wild long before every system could be patched. Paying more money isn't going to make someone do the right thing.

darkwater 5y ago

> but isn't selling bugs on the black market illegal? Noob question: is there any specific law that punishes describing how to get into a software/electronic system but not actually doing it? Something that is just not purely US-centric.

ensignavenger 5y ago
Here is UK specific answer, and as they point out, if you sell to some one knowing they are going to commit a crime with it, you can be considered an accomplice in many jurisdictions. https://law.stackexchange.com/questions/11552/is-it-illegal-to-create-and-sell-a-exploit-of-a-zero-day-vulnerability https://law.stackexchange.com/questions/11552/is-it-illegal-...
- kube-system 5y ago
  Sounds like a market opportunity for middlemen in other jurisdictions.

nostoc 5y ago

How about selling legally to a state actor for 100k ? Bug bounties need to be higher, because the black market is not the only alternative.

deleted 5y ago
[deleted]

Debug_Overload 5y ago

The legal/ethical question is important, but I was just stressing OP's point about the disparity between bug bounties and what the actual exploits are worth. IANAL, but for the specific cases I mentioned (nation states and vendors who work with them), I think the legal aspect would be very different from selling it to regular black market cybercriminals (I used the generic "black market" in the first part of the original comment but I was mostly talking about those two cases).