2 ms·
Where on earth did you get the idea that there is something illegal about selling exploits? Several companies exist that do exactly this, and they operate in pu
by lawnchair_larry 15y ago
Where on earth did you get the idea that there is something illegal about selling exploits? Several companies exist that do exactly this, and they operate in public, above board.
To my knowledge, the US government is the biggest buyer of unpublished exploits. And they pay a lot more than 60k. One well-known US-based company is even run by a former NSA employee, and they're currently advertising a remote pre-authentication exploit in the latest version of MySQL.
- Sire 15y agoLinks please.
- deleted 15y ago[deleted]
- lawnchair_larry 15y agohttps://lists.immunityinc.com/pipermail/canvas/2012-February/000014.html https://lists.immunityinc.com/pipermail/canvas/2012-February... http://securityevaluators.com/files/papers/0daymarket.pdf http://securityevaluators.com/files/papers/0daymarket.pdf
- rand_r 15y agoIgnoring the US government, what legal use would a company have for un-patched exploits?
- eli 15y agoWell besides the vendor you mean?
- trotsky 15y agoPenetration testing is the common answer, though that job description can also be a bit of a euphemism. It is also worth noting that breaking into the computer of a foreign national that is located overseas is often not a crime in the united states, or is at least considered very difficult to prosecute if it doesn't involve fraud, financial transfers or a few other hot buttons.
- nikcub 15y agoFame, reputation, marketing, using 0day in pen-tests, etc. This isn't new, security companies have been paying contractors for unpublished advisories and exploits for over 15 years now.