> Make no mistake, Facebook has probably done this math very carefully when choosing a bounty.

Having worked at several similar companies, I'm guessing it went like this:

"How much should bounty be? Is $5K good?"

"Wow, that's nothing. At least make it something meaningful like 25 grand."

"Yeah....that's gonna be tough. How about split the difference? $15K"

"Sure."

In other words, if you wanted to game the odds, you'd start by offering it on the black market, then if there were no takers after X number of days, offer it to Facebook?

It is unlikely that there is any black market for this bug, or for the RCE that compromised Facebook's crypto secrets.

https://news.ycombinator.com/item?id=11249173

Yeap, you're right. These guys at least aren't paying a bounty for Facebook/Google bugs: https://www.zerodium.com/program.html

Like Dylan says, people will pay for web server software bugs, if the software is widely installed, because you can make money by building and grooming a fleet of compromised servers. There is a way to do it, and that way works.

There is not a good, reliable way to make money from Facebook account takeover. You can conceive of them speculatively, but that is not the same thing as knowing you can execute, or, better, already having a business process in place that is already executing, just waiting for a new bug.

Your comments make sense in the real world, where the big threat is "criminal enterprise looking to make an illicit buck".

I worry that people are too obsessed about the hypothetical specter of tremendously skilled and bored black-hats who will ruin lives for fun, rather than for a pay-off, e.g. ZF0.

>* hypothetical specter of tremendously skilled and bored black-hats who will ruin lives for fun*

I'd assume having $15k to spend is a lot more fun than any enjoyment one could have by hacking someone's facebook account.

You'd have to have a real vendetta against someone to value ruining their life at $15k.

> You'd have to have a real vendetta against someone to value ruining their life at $15k.

15k is actually cheap when compared with the costs of a private eye, a biker gang or a contract killer.

For a political hit, $15k might be a very reasonable valuation.

> You'd have to have a real vendetta against someone to value ruining their life at $15k.

You're thinking about it wrong. There is no opportunity cost in their worldview, just lulz to be had at the expense of people they deem worthy of ruination.

(I never said the people that live in the intersection of trolls and blackhats are great at financial or career planning, after all.)

Footnote on the graphic: *All payout amounts are chosen at the discretion of ZERODIUM and are subject to change or cancellation without notice.

Translation: "Show us what you got and then we'll screw you over."

Sounds like you're less likely to get screwed by an escrow service found on TOR.

Or simply publishing it first and leveraging to opportunity for contract work. I'd really hope you're able to get a commitment from ZERODIUM before giving them the details.

This comment states:

> Facebook's security team is one of the strongest and most sophisticated of any company

If that is true, how come they didn't catch this relatively obvious glitch discussed here.

No team can catch all the bugs.

As for 'obvious', hindsight, yada yada.

You forget to normalise by the uncertainty of payment in the blackhat case and the probability of repercussions.

Not to mention the possibility of selling the same thing to multiple black hat buyers.

From this article I get the impression that the bounty wasn't even known before hand. It doesn't seem like a very careful consideration from Facebook, and I would expect it to be "too low" if they're choosing the amount after someone has already disclosed the bug.

Another factor is that when you are buying on black market, you can't be sure whether you are buying real exploit or fake one. Exploit owner probably will request (irreversible) bitcoin payment, will communicate via anonymous channels and is unlikely to give out details about that exploit until he's got his money. So both sides have difficulty trusting each other. Probably solution is some trusted 3-rd party, but is there one in black market? It's hard to imagine, actually.

Even if you aren't able to receive some sort of sample proof of work (which is probably not the case with this exploit), you can still mitigate the risk by ensuring the seller has high status in the marketplace and/or is willing to use escrow (or preferably multi-sig) to ensure funds are only released upon receipt.

You totally can demonstrate it in this case, but I see how you are correct in most other cases.

" Do you have a facebook account? Name a friend, and I'll prove it to you "

Not really - a Facebook attack can be proven without revealing the details. eg. The buyer could ask "give me a list of the friends of <non-public account>" or "make a fake posting with <this content> authored by <this user>".

Problem with that us the buyer could be FB Sec. Now they have a targeted account to watch and find the vuln. themselves. Better option is to find a random famous person and do the sane thing.

3-way signed keys with 2 min necessary for accessing the BTC wallet. If memory is not playing tricks on me, you can do that with BTC. You can make a client-> seller transaction if everything is normal, else the third party can arbiter the transaction.

where do people even go to start to sell an exploit? how does that kind of stuff work?

I assume you're wondering about the black market? Traditionally, Russian and Eastern European carder forums. In the golden age of Western Union and Moneygram... More recently, dark web markets over TOR with multi-sig cryptocurrency escrow.

for exploits that don't target a single deployed instance there is a 'grey/white' market. off the top of my head: ZDI (more defence oriented. i think they distribute just signatures for intrusion detection), Zerodium (more offence oriented), Exodus Intel EIP (not really sure.. they distribute a feed)

same place as silk road.

Not sure if this is a good idea. Probably lots of undercover three-letter government agents lurking there.

Why is that a bad idea? If you sell to one of them, you will most certainly get paid in full and on time.

Or were you thinking that they would try to bust you for illegal hacking instead?