4 ms·

I've always thought that the companies coded the "zero day exploits" in, and then sold them for profit.

• ivraatiems 4y ago
  I'm not saying it never happens, and I don't want to assume anything about your background, but I think most people who work in software would agree there's no need. Plenty of problems get in on their own.
  • dylan604 4y ago
    RSA weaker key set to default perhaps?
  • skrtskrt 4y ago
    yep if that were your goal it would be way more cost effective to get a zero day from just not trying that hard with security practices. Not having any security knowledge on the team. Not patching/upgrading dependencies with security bugs.
    • ivraatiems 4y ago
      And then you have plausible deniability! I think we're hitting on a new business model here...
• PeterisP 4y ago
  It doesn't make sense from numbers perspective, there's simply not that much potential for profit there. In general, the sale price of a zero-day or ten in some popular product is tiny compared to, for example, the marketing budget of that product. That money is significant from the perspective of a particular employee (i.e. if they personally would get the money) or for a specialized consulting company, but it's a drop in the ocean for the large companies actually making the products. So we should expect some backdoors intentionally placed by rogue employees (either for financial motivation or at the behest of some government) but not knowingly placed by the organizations - unless in cooperation with their host government, not for financial reasons.
  • deleted 4y ago
    [deleted]
• samatman 4y ago
  Unlikely. I do suspect the number of 0days which were deliberately added by plants from Five Eyes or elsewhere is not zero.