4 ms·

I remember reading somewhere that hardcore foreign teams stopped going to pwn2own once they realized that they were 1) effectively disclosing valuable zero day

I remember reading somewhere that hardcore foreign teams stopped going to pwn2own once they realized that they were 1) effectively disclosing valuable zero days in a dark room 2) to the tagert manufacturer 3) and the pwn2own organizer who happens to be indirectly sponsored by the NSA In exchange for what is pretty much just kudos and pocket change

Blue111 4y ago
Going to pwn2own is probably a good way to make sure the NSA closely follows you...
Thorrez 4y ago
What do they do with the vulnerabilities instead of going to pwn2own? If they report vulnerabilities to the manufacturer directly, how does the pay compare to the pay from pwn2own?
- _kbh_ 4y ago
  They likely sell them instead, and make a lot more money than they would have at pwn2own.
  - ackbar03 4y ago
    Well after a certain point it also becomes a national security issue
    - Blue111 4y ago
      The government would buy them if they cared?
ehhthing 4y ago
I'm active in the CTF crowd, and I think the general feeling is that you only want to burn your lower tier exploits at pwn2own. Usually these will be the exploits for things that are harder to sell to an exploit broker. You probably won't see many top tier vulnerabilities at pwn2own. Zerodium is definitely a bit too well known to have actual market pricing for vulnerabilities, but their tier graphic is pretty accurate (https://zerodium.com/program.html https://zerodium.com/program.html). Notice how most of the things hacked at pwn2own are at the bottom of this graphic. Selling to a exploit broker is pretty much always more profitable for higher tier exploits, and usually if you're in this industry and want to make bank you'll just work for a company like dfsec where you get bonuses for finding these kinds of exploits anyway.
- sureglymop 4y ago
  That looks tempting but what happens after? Can you sell your exploit and then submit a patch for it? Is an exploit intellectual property?
  - ehhthing 4y ago
    Generally, the way that you're paid if you sell to a exploit broker is in installments over time to prevent this kind of business. I'm not sure about whether it's your intellectual property or not. Can exploits be "intellectual property"? Like sure your specific PoC could be considered intellectual property, but if you were to rewrite it differently (and there is always another way to exploit a vulnerability) then I have no idea whether that would still count or not.

Blue111 4y ago

Going to pwn2own is probably a good way to make sure the NSA closely follows you...

Thorrez 4y ago

What do they do with the vulnerabilities instead of going to pwn2own? If they report vulnerabilities to the manufacturer directly, how does the pay compare to the pay from pwn2own?

_kbh_ 4y ago
They likely sell them instead, and make a lot more money than they would have at pwn2own.
- ackbar03 4y ago
  Well after a certain point it also becomes a national security issue
  - Blue111 4y ago
    The government would buy them if they cared?

ehhthing 4y ago

I'm active in the CTF crowd, and I think the general feeling is that you only want to burn your lower tier exploits at pwn2own. Usually these will be the exploits for things that are harder to sell to an exploit broker. You probably won't see many top tier vulnerabilities at pwn2own. Zerodium is definitely a bit too well known to have actual market pricing for vulnerabilities, but their tier graphic is pretty accurate (https://zerodium.com/program.html https://zerodium.com/program.html). Notice how most of the things hacked at pwn2own are at the bottom of this graphic. Selling to a exploit broker is pretty much always more profitable for higher tier exploits, and usually if you're in this industry and want to make bank you'll just work for a company like dfsec where you get bonuses for finding these kinds of exploits anyway.

sureglymop 4y ago
That looks tempting but what happens after? Can you sell your exploit and then submit a patch for it? Is an exploit intellectual property?
- ehhthing 4y ago
  Generally, the way that you're paid if you sell to a exploit broker is in installments over time to prevent this kind of business. I'm not sure about whether it's your intellectual property or not. Can exploits be "intellectual property"? Like sure your specific PoC could be considered intellectual property, but if you were to rewrite it differently (and there is always another way to exploit a vulnerability) then I have no idea whether that would still count or not.