3 ms·
In a week, an attacker with an account-takeover exploit could attack every high-profile celebrity and likely dig up enough dirt on them to get far more than $5
by pcthrowaway 12y ago
In a week, an attacker with an account-takeover exploit could attack every high-profile celebrity and likely dig up enough dirt on them to get far more than $50,000 in hush money. Or they could go the old-fashioned route and use it to snoop on the plans of wealthy people to kidnap them and hold them for ransom. There are many, many possibilities for making money if you can gain access to anyone's facebook account, even if it is just for a week. $50,000 is not an extraordinarily large compensation for ethically disclosing an exploit of this nature by any means.
- tptacek 12y agoDo you have firsthand or even secondhand knowledge of a market for account takeover bugs where the buyers are monetizing those bugs via celebrity dirt? Do you have knowledge of markets for account takeover where buyers are directly monetizing those bugs at all? I'm not asking if you can hypothesize such a market. I'm asking if you know about one actually existing. It's been suggested to me that there is in fact at least one set of buyers for account takeover bugs. But they aren't monetizing those accounts.
- jessaustin 12y agoIf they aren't monetizing them, can you be more specific about what these hypothetical exploit buyers are doing with the pwned accounts?
- pcthrowaway 12y agoI don't, but I strongly suspect they exist. While it's not my MO, I am quite certain that a blackhat-hacker with an exploit that enables them to compromise anyone's personal account would have the idea to target wealthy/famous people for personal gain. I also don't think it's beyond reason to think they could generate more than $50,000 through malicious means. Doing it without getting caught would be the challenging part, I guess.