3 ms·

“Researchers find them, they sell them to us for X, we sell them to clients for Y and make the margin in between.” A glorified reseller and scumbag. Pathetic.

by vtlynch 12y ago

vijayr 12y ago
This is similar to patent trolls, no? Both don't produce anything worthwhile, buy from others and use it to intimidate others (except patent trolls do it themselves in the open, whereas he sells it to people who'll probably use it secretly)
- x1798DE 12y ago
  It's also similar to patent trolls in that the people doing it breath oxygen and have skin. In the case of patent trolls, they're leveraging asymmetries in the legal system and flaws in intellectual property laws to profit from non-meritorious lawsuits. To the extent that a market in zero-day vulnerabilities is something you want to have (I'm not sure where I stand on this, exactly), a firm with a reputation to maintain does have a role to play. They sell the exploit to Mitnick, who has an idea of which ones he'll be able to sell, and the companies buying them are able to avoid the transaction costs and risks associated with buying and then testing potential zero-day vulnerabilities submitted by arbitrary hackers and counterparties. He's playing a valuable role by mitigating risk for both the companies he approaches and the random hackers. Consider also that it's hit-or-miss when you try to contact a company about zero-day vulnerabilities whether or not they are going to pay you, ignore you or, worse, sue you. Knowing Mitnick doesn't sue people who submit bugs to him, and presumably he has lawyers vetting this operation carefully, is a significant benefit for bug-finders.
depingus 12y ago
Worse than a reseller. If you read his website, it turns out he's just a broker. He doesn't actually buy them from the researcher and then try to sell them. He just brokers a deal between the researcher and the buyer (if he can find one); taking an exorbitant fee in the process.
- dobbsbob 12y ago
  That's exactly what thegrugq does too. Tomorrow if I find an iOS bug that's exploitable I don't have a rolodex of contacts to sell it to hence the need for this service. As a middle man he can confirm the bug hasn't already been discovered and is generally trusted not to keep a copy himself and hack the planet with it after sale. This arrangement protects the seller too from revealing their exploit code to the buyer before payment. Anybody could create a Tor market for auctioned exploits but somebody has to verify the goods first or you get swamped with junk offers.

“Researchers find them, they sell them to us for X, we sell them to clients for Y and make the margin in between.” A glorified reseller and scumbag. Pathetic.

by vtlynch 12y ago

“Researchers find them, they sell them to us for X, we sell them to clients for Y and make the margin in between.” A glorified reseller and scumbag. Pathetic.

vijayr 12y ago

This is similar to patent trolls, no? Both don't produce anything worthwhile, buy from others and use it to intimidate others (except patent trolls do it themselves in the open, whereas he sells it to people who'll probably use it secretly)

x1798DE 12y ago
It's also similar to patent trolls in that the people doing it breath oxygen and have skin. In the case of patent trolls, they're leveraging asymmetries in the legal system and flaws in intellectual property laws to profit from non-meritorious lawsuits. To the extent that a market in zero-day vulnerabilities is something you want to have (I'm not sure where I stand on this, exactly), a firm with a reputation to maintain does have a role to play. They sell the exploit to Mitnick, who has an idea of which ones he'll be able to sell, and the companies buying them are able to avoid the transaction costs and risks associated with buying and then testing potential zero-day vulnerabilities submitted by arbitrary hackers and counterparties. He's playing a valuable role by mitigating risk for both the companies he approaches and the random hackers. Consider also that it's hit-or-miss when you try to contact a company about zero-day vulnerabilities whether or not they are going to pay you, ignore you or, worse, sue you. Knowing Mitnick doesn't sue people who submit bugs to him, and presumably he has lawyers vetting this operation carefully, is a significant benefit for bug-finders.

depingus 12y ago

Worse than a reseller. If you read his website, it turns out he's just a broker. He doesn't actually buy them from the researcher and then try to sell them. He just brokers a deal between the researcher and the buyer (if he can find one); taking an exorbitant fee in the process.

dobbsbob 12y ago
That's exactly what thegrugq does too. Tomorrow if I find an iOS bug that's exploitable I don't have a rolodex of contacts to sell it to hence the need for this service. As a middle man he can confirm the bug hasn't already been discovered and is generally trusted not to keep a copy himself and hack the planet with it after sale. This arrangement protects the seller too from revealing their exploit code to the buyer before payment. Anybody could create a Tor market for auctioned exploits but somebody has to verify the goods first or you get swamped with junk offers.