The numbers are accurate. Browse through past payments to researchers participating in the Internet Bug Bounty, Pwn2Own or Microsoft's mitigation bypass bounty.

The numbers are accurate. Browse through past payments to researchers participating in the Internet Bug Bounty, Pwn2Own or Microsoft's mitigation bypass bounty. I don't have any good citation for the going rate for a high value vulnerability on the black market, but if you look I'm sure you'll see it can easily enter the mid six figure range. As for "good vs evil" - I never used those words. Morality is a word I used because it provides a useful context against which to judge legitimacy. You can fairly say it is unethical to sell vulnerabilities for the explicit purpose of exploitation. I don't particularly care to color it this way; I disagree with such actions but I still respect my fellow colleagues who do it.