5 ms·

Are these people concerned with security or are they running a protection racket? The way you put it is starting to sound like the latter.

by kjjw 12y ago

scrollaway 12y ago
This has nothing to do with "protection racket" and downvoters are going to be in for one hell of a reality check if you don't believe that this will happen. Bounty hunters do this stuff for a living. If the company pays with $25 vouchers and the black market pays on the order of tens/hundreds of thousands, who do you think "these people" will go to?
- eli 12y ago
  I frankly don't believe you. I think you vastly overestimate how much you can sell a vulnerability for and vastly underestimate the morals of white hat hackers reporting bugs for a bounty. There are close to zero companies that pay tens/hundreds of thousands for a bug, and yet clearly bounties are being paid and not 100% of bugs end up on the black market.
  - otakucode 12y ago
    Mitnicks security company recently started a vulnerability marketplace. For vulnerabilities that meet the criteria (they have to be of a certain severity, not already known, etc), they are sold for a minimum of $100,000.
  - tcheard 12y ago
    Microsoft will pay up to $100,000 plus $50,000 bonus for defense submissions (http://technet.microsoft.com/en-us/security/dn425049 http://technet.microsoft.com/en-us/security/dn425049) Facebook has paid $12,500 for one (http://techcrunch.com/2013/09/02/security-researcher-discovers-bug-that-would-let-hackers-delete-any-photo-off-facebook/ http://techcrunch.com/2013/09/02/security-researcher-discove...) Google will pay up to $20,000 for one (http://www.google.com/about/appsecurity/reward-program/#rewards http://www.google.com/about/appsecurity/reward-program/#rewa...) Forbes even posted an article a couple years ago on the market of zero day exploits and listed prices someone could get for zero day exploits with prices in the tens/hundreds of thousands. (http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/ http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...) It should be noted that they state in this article that the groups that will buy these exploits for these prices are generally western governments.
jrochkind1 12y ago
Yes, the market for security vulnerabilities is essentially a protection racket, and everyone knows it.
pessimizer 12y ago
I'd say: "Are these people concerned with receiving income for difficult, highly specialized, valuable work, or are they running a charity?" I guess it's a matter of perspective.
- icebraining 12y ago
  Not really. We have a system for ensuring that people get paid for valuable work: they're called contracts.

Are these people concerned with security or are they running a protection racket? The way you put it is starting to sound like the latter.

by kjjw 12y ago

Are these people concerned with security or are they running a protection racket? The way you put it is starting to sound like the latter.

scrollaway 12y ago

This has nothing to do with "protection racket" and downvoters are going to be in for one hell of a reality check if you don't believe that this will happen. Bounty hunters do this stuff for a living. If the company pays with $25 vouchers and the black market pays on the order of tens/hundreds of thousands, who do you think "these people" will go to?

eli 12y ago
I frankly don't believe you. I think you vastly overestimate how much you can sell a vulnerability for and vastly underestimate the morals of white hat hackers reporting bugs for a bounty. There are close to zero companies that pay tens/hundreds of thousands for a bug, and yet clearly bounties are being paid and not 100% of bugs end up on the black market.
- otakucode 12y ago
  Mitnicks security company recently started a vulnerability marketplace. For vulnerabilities that meet the criteria (they have to be of a certain severity, not already known, etc), they are sold for a minimum of $100,000.
- tcheard 12y ago
  Microsoft will pay up to $100,000 plus $50,000 bonus for defense submissions (http://technet.microsoft.com/en-us/security/dn425049 http://technet.microsoft.com/en-us/security/dn425049) Facebook has paid $12,500 for one (http://techcrunch.com/2013/09/02/security-researcher-discovers-bug-that-would-let-hackers-delete-any-photo-off-facebook/ http://techcrunch.com/2013/09/02/security-researcher-discove...) Google will pay up to $20,000 for one (http://www.google.com/about/appsecurity/reward-program/#rewards http://www.google.com/about/appsecurity/reward-program/#rewa...) Forbes even posted an article a couple years ago on the market of zero day exploits and listed prices someone could get for zero day exploits with prices in the tens/hundreds of thousands. (http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/ http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...) It should be noted that they state in this article that the groups that will buy these exploits for these prices are generally western governments.

jrochkind1 12y ago

Yes, the market for security vulnerabilities is essentially a protection racket, and everyone knows it.

pessimizer 12y ago

I'd say: "Are these people concerned with receiving income for difficult, highly specialized, valuable work, or are they running a charity?" I guess it's a matter of perspective.

icebraining 12y ago
Not really. We have a system for ensuring that people get paid for valuable work: they're called contracts.