4 ms·
Are regular bug bounty programs simply not paying enough whereby researchers decide to hold onto exploits for high paying events like Pwn2Own? How much would th
by r1ch 12y ago
Are regular bug bounty programs simply not paying enough whereby researchers decide to hold onto exploits for high paying events like Pwn2Own? How much would these kind of exploits go for on the black market?
- tptacek 12y agoPwn2Own has a lottery dynamic that the bug bounty programs don't. As for the sub rosa pricing for these exploits, it gets complicated. Among other important details: to maximize your returns you need to be a competent salesperson (you need to have the contacts to sell them to), and the best returns make you at least morally and in some cases even legally culpable for what's done with them. There's probably some headroom left for escalating valuations for browser RCEs, but they're not like an order of magnitude mispriced. Also remember you're looking at the subset of bugs with the absolute peak valuation. (I'm both ideologically opposed to bug sales and not smart enough to get RCE on Chrome, so: take this with a grain of salt).