3 ms·
I wonder if people “double dip” by first offloading vulnerabilities to black market. Then claim the bug bounty later on. - find vuln (0day to you) - sell splo
by xyst 2y ago
I wonder if people “double dip” by first offloading vulnerabilities to black market. Then claim the bug bounty later on.
- find vuln (0day to you)
- sell sploit on black market (0day for black market
- months later, confirm if vulnerability has not been patched
- if not patched, submit bug report and claim as new 0-day. “0day” for company. But it’s really been in the wild for 180-days
- google sends $250K check but “researcher” also received $750K on the black market
In addition to double dipping, can these high bounties also act as a way for employees to pad their salaries?
- “accidentally” introduce bug in patch. Very easy to do an “xz/jia tan” like attack. Maybe slip it in a massive change request
- let buddy know this vulnerability exists. Then have them claim the bounty.
- months later have accomplice send cryto/nft/cash
Probably can’t do this too often though.
- XorNot 2y agoNo, they don't. HN posters are unreasonably confident that it's quick and easy to sell things on the dark net for huge profits.
- altcognito 2y agoShocker, people who take advantage of other people aren’t usually trustworthy or particularly generous - now I realize the counter example here is going to be malware companies that allegedly release keys after receiving the bounty payment but this is hardly a counter example.
- WatchDog 2y agoApparently when you sell a vulnerability to a broker, the payment will be a structured settlement spread out over some period of time. I'm not sure what the valuation for a KVM bug would be, or over what period it would be paid, but I guess you could wait long enough for the majority of the payment to be received before submitting it for a bounty.