5 ms·
Everyone is sitting on a java 0day now. They have lost a lot of value in the market since there is literally as much supply as demand. I keep reading CVEs waiti
by dsl 14y ago
Everyone is sitting on a java 0day now. They have lost a lot of value in the market since there is literally as much supply as demand. I keep reading CVEs waiting for the one I have to be discovered by someone.
- ars 14y agoWhy sit on it? Why not disclose it and have it be your name on that CVE, and not someone else?
- ibotty 14y agoa cve is not worth that much. (nothing?)
- ars 14y agoMaybe not as cash. But on a resume?
- JonnieCache 14y agoI get the impression that dsl is a pretty successful person IRL already.
- derrida 14y agoAll the more reason to disclose the 0day. If not for money or recognition, just plain simply for the users.
- ghshephard 14y agoI have a friend who tells me that good (windows) zero days, with remote execution, are worth about $50K on the market that transacts these things, with a contract to increase that value if their is no open disclosure. I.E. If your zero day remains a zero day for another six months, there is an opportunity to see further reward. I've always wondered if it's intelligence agencies, criminal organizations, police organizations, or commercial endeavors that sell services to those three bodies that are paying that kind of money for zero days. I also don't understand why people give good zero days away for free, if is really the case that there is a market in these types of properties. Anybody have actual insight into this?
- coopdog 14y agoMaybe because they don't want people's computers to be abused by people with lots of cash to spare? One can only assume they're getting more than $50k worth of value from the zero day, so something pretty dodgy must be going on
- fulafel 14y agopeople have ethics.
- notdrunkatall 14y agoThey also have to eat.
- pixl97 14y agoYou're assuming that they have to make their living 'hacking'. If instead they have an oil well in the back yard providing a steady paycheck (I live in Texas, and know people just like this), they have plenty time for non-profit endeavors.
- martinced 14y ago"I also don't understand why people give good zero days away for free..." Quite some hackers are a really special (in a good way) kind of people who are in it only for the intellectual challenge. Now food for thoughts: Rudyard Kipling once warned students against an over-concern for money, position or glory, he said: “Some day you will meet a man who cares for none of these things. Then you will know how poor you are..."
- vellum 14y ago>I've always wondered if it's intelligence agencies, criminal organizations, police organizations, or commercial endeavors that sell services to those three bodies that are paying that kind of money for zero days. According to this article: 3rd party middlemen, small security firms and large defense contractors are the ones paying for 0-days. There's also has a nice price list for Chrome, IOS, etc. http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/ http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...