3 ms·

Yes. You would be hard pressed to find any company in the entire world that could prevent attackers with a mere $1M budget. Banks, power plants, car companys, c

by Veserv 3y ago

Yes. You would be hard pressed to find any company in the entire world that could prevent attackers with a mere $1M budget. Banks, power plants, car companys, cybersecurity companys, factorys, you name it, almost certainly less than $1M. In fact, probably under $100K, but $1M is a safe upper bound. At a $10M budget there are zero. In fact, no CISO I have ever heard from has ever said that is even possible for a perfect implementation (i.e. they have free reign to implement everything they want as long as it does not make the company non-functional, but they get to be judge, jury, and executioner in that analysis). So yeah, given “perfectly implemented” security a $70M ransom has a guaranteed 700% ROI, but in practice closer to a over 7000% ROI.

lyu07282 3y ago
I imagine many independent security researchers can live quite comfortably just selling 0days on the "free market".
- Veserv 3y ago
  Not really if you live in a high cost-of-living (HCOL) country. Vulnerability weaponization is a very globalized industry and sufficiently easy that there is a oversupply from LCOL countrys. The real money is in deployment and usage as that requires the much rarer and more local criminal and money laundering skill sets.
  - _kbh_ 3y ago
    > Not really if you live in a high cost-of-living (HCOL) country. Vulnerability weaponization is a very globalized industry and sufficiently easy that there is a oversupply from LCOL countrys. The real money is in deployment and usage as that requires the much rarer and more local criminal and money laundering skill sets. A single iOS or Android full chain still goes for between, 2-2.5 million USD. https://zerodium.com/images/zerodium_prices_mobiles.png https://zerodium.com/images/zerodium_prices_mobiles.png https://zerodium.com/images/zerodium_prices.png https://zerodium.com/images/zerodium_prices.png if someone was skilled they could easily live in a HCOL area making 1-1.25 million USD a year.
    - pclmulqdq 3y ago
      A full chain is a difficult attack to create, and probably worth a lot more than $2.5 million - beyond the reach of one person. You need at least two novel, serious exploits. That's why they are so valuable.
      - _kbh_ 3y ago
        > A full chain is a difficult attack to create, and probably worth a lot more than $2.5 million - beyond the reach of one person. You need at least two novel, serious exploits. That's why they are so valuable. Depends if you're publicly selling via Zerodium as much, but if you sell privately it might be worth more. > beyond the reach of one person It's going to be difficult but I don't think its beyond one person, but even if it was you could easily just go for a less difficult tier to make less money more often. The real problem would be how lumpy the payments would be, you'd effectively get nothing until you found something and most people cannot afford to that.

by Veserv 3y ago

lyu07282 3y ago

I imagine many independent security researchers can live quite comfortably just selling 0days on the "free market".

Veserv 3y ago
Not really if you live in a high cost-of-living (HCOL) country. Vulnerability weaponization is a very globalized industry and sufficiently easy that there is a oversupply from LCOL countrys. The real money is in deployment and usage as that requires the much rarer and more local criminal and money laundering skill sets.
- _kbh_ 3y ago
  > Not really if you live in a high cost-of-living (HCOL) country. Vulnerability weaponization is a very globalized industry and sufficiently easy that there is a oversupply from LCOL countrys. The real money is in deployment and usage as that requires the much rarer and more local criminal and money laundering skill sets. A single iOS or Android full chain still goes for between, 2-2.5 million USD. https://zerodium.com/images/zerodium_prices_mobiles.png https://zerodium.com/images/zerodium_prices_mobiles.png https://zerodium.com/images/zerodium_prices.png https://zerodium.com/images/zerodium_prices.png if someone was skilled they could easily live in a HCOL area making 1-1.25 million USD a year.
  - pclmulqdq 3y ago
    A full chain is a difficult attack to create, and probably worth a lot more than $2.5 million - beyond the reach of one person. You need at least two novel, serious exploits. That's why they are so valuable.
    - _kbh_ 3y ago
      > A full chain is a difficult attack to create, and probably worth a lot more than $2.5 million - beyond the reach of one person. You need at least two novel, serious exploits. That's why they are so valuable. Depends if you're publicly selling via Zerodium as much, but if you sell privately it might be worth more. > beyond the reach of one person It's going to be difficult but I don't think its beyond one person, but even if it was you could easily just go for a less difficult tier to make less money more often. The real problem would be how lumpy the payments would be, you'd effectively get nothing until you found something and most people cannot afford to that.