4 ms·
I'm curious how selling a multi-million dollar 0-day to a shady company actually works in practice. Like how does the seller demonstrate that their exploit wor
by 83 3y ago
I'm curious how selling a multi-million dollar 0-day to a shady company actually works in practice. Like how does the seller demonstrate that their exploit works and isn't already in ShadyCo's catalog without giving up how it works
(at which point ShadyCo could just not pay them and recreate it).
- shuntress 3y agoThe same way everything works: trust
- pclmulqdq 3y agoApparently an escrow arrangement is used by some of these companies. You disclose vague details in exchange for an offer, and once you agree, they escrow the money and then you release the artifacts.
- 83 3y agoSurely NSO doesn't say "hand over your exploit and if we don't already have it we'll give you millions - you can trust us". And I would argue most trade is not based on trust, except for maybe trust in the legal system and repercussions if someone tries to screw you over.
- j0hnyl 3y agoNot sure about NSO specifically, but this actually is how it works. If they screw someone over others won't sell their 0days. Except they don't pay the $2MM up front, they pay out based on a pre-agreed upon lifespan of the exploit. First you provide a description of the exploit, then you get an estimate, then you have provide the exploit for vetting and the payout has multiple cliffs similar to equity vesting in a company. This way you can't sell them a an exploit for $2MM and go play robinhood by reporting it to the vendor once the check clears.
- 83 3y agoThank you, this is the kind of insight I was looking for.
- brookst 3y agoAnd the related concept, reputation. If NSO had a reputation for screwing 0-day finders, their supply would dry up