3 ms·

They wouldn’t, especially considering they aren’t operating anymore.

• cantrecallmypwd 2y ago
  Which was Vupen too before that. One company name is unimportant because multiple shady groups and individuals are out there buying and selling 0daya. This is definitely the case because state actors don't develop 100% them themselves and must get them from somewhere. It's a small but nonzero market of expediency.
  • saagarjha 2y ago
    I'm sure there are companies that have stepped up to fill the void. But the market for "I DDoSed your phone" doesn't really exist.
    • cantrecallmypwd 2y ago
      Except that's not true because rendering a target's device unusable temporarily and/or effectively permanently is a useful payload regardless of what you think.
      • saagarjha 2y ago
        A useful payload for whom? Point me to someone who is willing to pay for such a bug and I'll believe you. Zerodium's old payout scale didn't even list denial of service, and to my knowledge no other serious vendor does either. If I can list a bunch of people who don't care about this surely you can find one who does.
      • tptacek 2y ago
        That's not how vulnerability markets work. The idea that a broker would pay $75,000 for a phone DOS is very funny.