3 ms·
Taking the 60k from Google doesn't lead to spending several years of your life in Federal prison, which is a significant risk with selling an exploit.
by khuey 15y ago
Taking the 60k from Google doesn't lead to spending several years of your life in Federal prison, which is a significant risk with selling an exploit.
- lawnchair_larry 15y agoWhere on earth did you get the idea that there is something illegal about selling exploits? Several companies exist that do exactly this, and they operate in public, above board. To my knowledge, the US government is the biggest buyer of unpublished exploits. And they pay a lot more than 60k. One well-known US-based company is even run by a former NSA employee, and they're currently advertising a remote pre-authentication exploit in the latest version of MySQL.
- Sire 15y agoLinks please.
- deleted 15y ago[deleted]
- lawnchair_larry 15y agohttps://lists.immunityinc.com/pipermail/canvas/2012-February/000014.html https://lists.immunityinc.com/pipermail/canvas/2012-February... http://securityevaluators.com/files/papers/0daymarket.pdf http://securityevaluators.com/files/papers/0daymarket.pdf
- rand_r 15y agoIgnoring the US government, what legal use would a company have for un-patched exploits?
- eli 15y agoWell besides the vendor you mean?
- trotsky 15y agoPenetration testing is the common answer, though that job description can also be a bit of a euphemism. It is also worth noting that breaking into the computer of a foreign national that is located overseas is often not a crime in the united states, or is at least considered very difficult to prosecute if it doesn't involve fraud, financial transfers or a few other hot buttons.
- nikcub 15y agoFame, reputation, marketing, using 0day in pen-tests, etc. This isn't new, security companies have been paying contractors for unpublished advisories and exploits for over 15 years now.
- trotsky 15y agoAre you familiar with anyone who has ever gone to prison for selling an exploit to a third party? What were they charged with? You may not be interested in the kind of attention you'd get from intelligence or law enforcement, but as far as I know the act itself is legal in most/all jurisdictions.
- SODaniel 15y agoIt's also fairly 'common knowledge' that taking $60k and some hacker fame from Google in a legitimate setting is a VERY legitimate way of setting yourself up for a $100k/month job at Google or any reputable infosec company. Selling exploits on the black/grey market is and will always be fast money, and a bad idea.
- trotsky 15y agoInfosec jobs that pay $1.2MM a year? The only people making close to that are the blackhats - and not many of them.