> Q: When does auction end? A: Unknown. When we feel is time to end. Keep bidding until we announce winner.
~~A silent penny auction :|~~
Yes, however the contents of the free sample seems very real. Without having dug into the binaries it's hard to tell, but it's hard to imagine someone wrote this to scam 1 million BTC out of the net.
Let's say you break into a server and steal 10 vulnerabilities, from an organization (e.g. the NSA) who are never going to acknowledge how many vulnerabilities they had or were stolen.
If you want to get the most in the auction, the best thing you could possibly do is to release all 10 of your vulnerabilities for free, claiming that it's just a teaser, and that you have many more. Then you take in bids and disappear. It makes no sense to only release 2 or 3 and hold back the remainder; the unreleased ones are essentially wasted because they didn't actually contribute to any bidding activity: nobody knew they existed when they were bidding. That they exist at all is a happy surprise to the winning bidder, but with no further sales, customer goodwill isn't worth anything.
There's really no incentive to actually follow through on the sale at all. The only purpose of the "goods" to the seller is to attract bids, but with nobody to verify what's actually for sale, the best strategy is to use everything for what amounts to advertising, in the hope of gaining more attention and attracting more bids.
I wouldn't dump it all at once, if I were them, though. I'd do an initial release, and them some more once the initial bids (if there are any) slow down, and keep doing that over and over until the market is entirely worn out and all the vulnerabilities have been disclosed. That's the profit-maximizing strategy, I think.
People do work for a lot less..
The block chain makes it worse because everyone can see the progress of the buyer and there's no market maker with anywhere near this level of liquidity.
Interesting to note: there has been no new Bitcoin block for the last 1 hour 23 minutes. This happens from time to time, but it is a little suspicious.
However, with that much money on the line (if that figure is correct), you could fake almost anything.
The only people who could verify if it's real are the Equation Group themself. For anyone else it's impossible to verify - it's just some names.
So: If it's real the Equation Group will bid - probably a lot. If it's fake no one will bid.
So it'll be easy to tell which it is.
Why? You have no guarantee what you're bidding for will remain private, and you don't want to give it legitimacy by bidding. Who's to say if it's real the Equation Group wouldn't bid, under the assumption that it's already out there and you have absolutely no guarantees that anyone you're dealing with would keep their word.
> So it'll be easy to tell which it is.
~~How can you tell how others have bid?~~
Some systems you can get into some you can't.
Actually if they could tie their identity to some positive reputation, the other points wouldn't be so bad (they could still attempt an exit scam).
The fact that they are so honest about the refunds actually makes me think it's not a scam, since scammers would probably lie and promise the opposite.
A government would handle this by trying to chase down the autioneers. If they wanted the data, they would buy it from Kaspersky, assuming it's real.
...The client gets infected with malware and sends the data home... to some server. The server side.
Or for the highest bidder to even know that they won.
1. All bids are paid up front, and you never get your money back, even if you aren't the highest bidder. So if people bid $50, $70, and $100, they collect $220.
2. No one can verify what is actualy up for sale before the auction.
3. There is no way for the world to know that they actualy delivered the goods after the auction.
4. There is no way for the highest bidder to know that they will actually receive the goods.
5. There is nothing stopping the auctioneers from bidding. This not only raises the price, but they still get to keep every bidders money even if the high bid is their own.
Everything about this auction is lined up to incentivize a scam.