11 ms·

Why? Do you think zero-click exploits that can hack every phone in existence are expensive or rare? They only cost a few million dollars to find or just buy an

by Veserv 1y ago

Why? Do you think zero-click exploits that can hack every phone in existence are expensive or rare? They only cost a few million dollars to find or just buy and last I checked, a few years ago, there are multiple brokers each with tens in stock. With that much prevailing stock, you do not run the risk of suddenly not having a supply, so you do not even need to keep a material hoard for yourself. They probably just had like 3-5 at any one time with a in-house team only requiring a few million a year in funding to keep up with the expected churn. If they got more churn than expected, then they buy them retail to keep their product working. So even if we go with 9 M$ per 0-day (which is a multiple of actual cost), we would only expect them to have like 50 M$ in “assets” and a “procurement network/exploit factory” capable of keeping up with “depreciation” on-average. Seems pretty reasonable to be under 100 M$. If we went with more reasonable numbers, it would not even be that weird if it was less than 20 M$ for over 50% even at their peak.

wjnc 1y ago
I think we imagine them to sell mostly consulting and re-using those 0-days on thousands of unconnected victoms bringing in many millions for a billion dollar valuation. This is somewhat in jest, but goes to show that the value of the zero days themselves doesn’t necessarily impact valuation much. That’s just an asset. It’s the business they have on top of that and the value it extracts that determines the free cash flow that an investor would hit with a multiple.
- Veserv 1y ago
  Huh? Given their valuation, their business is barely worth more than their zero-days which are just not very expensive. People have the mistaken belief that total security compromises are challenging or expensive leading them to the mistaken belief that these companies must be valuable with valuable assets and high revenue. Hacking-for-hire is barely more than a commodity, like aluminum smelting. There are capital costs, you need technology and expertise, but it is highly fungible leading to lots of suppliers competing on cost and quality of service (turn key, white-glove, etc.) Hell, it is even cheaper to get into and stay on top than aluminum smelting since the capital costs are so much lower.

by Veserv 1y ago

wjnc 1y ago

I think we imagine them to sell mostly consulting and re-using those 0-days on thousands of unconnected victoms bringing in many millions for a billion dollar valuation. This is somewhat in jest, but goes to show that the value of the zero days themselves doesn’t necessarily impact valuation much. That’s just an asset. It’s the business they have on top of that and the value it extracts that determines the free cash flow that an investor would hit with a multiple.

Veserv 1y ago
Huh? Given their valuation, their business is barely worth more than their zero-days which are just not very expensive. People have the mistaken belief that total security compromises are challenging or expensive leading them to the mistaken belief that these companies must be valuable with valuable assets and high revenue. Hacking-for-hire is barely more than a commodity, like aluminum smelting. There are capital costs, you need technology and expertise, but it is highly fungible leading to lots of suppliers competing on cost and quality of service (turn key, white-glove, etc.) Hell, it is even cheaper to get into and stay on top than aluminum smelting since the capital costs are so much lower.