Re:LastPass autofill exploit
by wyager on Wednesday July 27, 2016 @02:29PM
(#12175354)
>Noone is paying $100k in some imaginary black market for web exploits.
You're right, it's usually in low-mid $10ks for this sort of thing.
>low-grade consumer password manager that no enterprise or governments uses
Can't speak to government, but multiple large companies I have worked for have mandated LastPass as the password manager.
> But even then your grey market for this is tiny and most likely not going to be some criminal overlord paying out $100k in bitcoin to kids on a darknet forum.
In fact that's almost exactly what it is, except you've underestimated the price. A really juicy iOS RCE or Privesc can fetch almost half a million.
These transactions aren't usually done on forums, though. Not enough trust. There are middlemen who buy exploits from researchers and sell to the big customers.
You're right, it's usually in low-mid $10ks for this sort of thing.
>low-grade consumer password manager that no enterprise or governments uses
Can't speak to government, but multiple large companies I have worked for have mandated LastPass as the password manager.
> But even then your grey market for this is tiny and most likely not going to be some criminal overlord paying out $100k in bitcoin to kids on a darknet forum.
In fact that's almost exactly what it is, except you've underestimated the price. A really juicy iOS RCE or Privesc can fetch almost half a million.
These transactions aren't usually done on forums, though. Not enough trust. There are middlemen who buy exploits from researchers and sell to the big customers.