5 ms·
And more money.
by mccr8 12y ago
And more money.
- Touche 12y agoAnd leaving the exploits in the wild for weeks/months beforehand.
- tptacek 12y agoThis is a valid criticism.
- cssmoo 12y agoPerhaps more worrying, they may have sold them elsewhere first and informed the purchaser that they have until the competition date to use it. Better business if you have to come back after the disclosure date for more holes... Nohig ethical at all going on here.
- rudolf0 12y agoMy understanding is that would violate the rules of the competition. Though of course if a competitor were to do that, odds are no one would find out.
- djrogers 12y agoWould someone willing to sell exploits on the black market really be concerned with "violating the rules of the competition"?
- rudolf0 12y agoWell, presumably they'd want to keep the money from the competition. That's definitely an incentive.
- MichaelGG 12y agoI would imagine it'd be fairly hard to the competition to know and revoke the money. Bad guys are almost certainly exploiting various undisclosed vulnerabilities. The bigger issue, I'd assume, is that by doing this competition, you've now killed that bug you previously sold. So long that was disclosed to the buyer though, I imagine you're all set.
- im2w1l 12y agoOdds are the black market guys find out. I don't know how the market works, but I'd be pretty pissed if I had bought a hole just for it to be patched soon after.
- mccr8 12y agoTo mitigate this problem, Google has recently announced that they are running a similar program year-round: http://blog.chromium.org/2015/02/pwnium-v-never-ending-pwnium.html http://blog.chromium.org/2015/02/pwnium-v-never-ending-pwniu...
- eugeneionesco 12y agoWith very lower rewards, the exploit that nettet $110k would probably be getting less than $50k
- erichurkman 12y agoBut you also minimize the risk that someone else will find and report the vulnerability before you do, negating any & all chance of earning a bounty yourself.