3 ms·

For those wanting to criticize Mitnick's actions, what I gather from the following quote is that there is an existing "industry" around finding, and selling the

For those wanting to criticize Mitnick's actions, what I gather from the following quote is that there is an existing "industry" around finding, and selling these exploits... "Researchers find them, they sell them to us for X, we sell them to clients for Y and make the margin in between." Can anyone shed light on these "researchers" and how they sell their exploits now? Or is this just a friendly way of saying "we pay hackers for exploits and then blackmail vendors"?

danielweber 12y ago
They generally don't blackmail the vendors. Someone paying $100,000 wants to get in someplace. I can't say I like the money-for-exploits thing, but one good thing is that it's made most companies be very nice to people to want to voluntarily report bugs. Silver lining and all that.
ipsin 12y ago
VUPEN is an example of how exploits are monetized. "Trusted organizations" can subscribe to their vulnerability service for a large chunk of money.