Exploit broker Zerodium ups the ante with $500k to target Signal and WhatsApp

Re:Exploit broker Zerodium ups the ante with $500k to target... by bluddy on Wednesday August 23, 2017 @06:25PM (#15085732)

I'm not sure this isn't a "good thing", to some degree. Companies like Apple and Google offer rewards for people who find exploits in their software, but they have little incentive to raise the reward even as the exploits become more and more rare, and demand more time to find. This may give them the false impression that there are no more exploits, while in reality they just haven't incentivized people sufficiently. This company operates on the other side (of which I don't approve), but by pricing exploits more accurately (via supply and demand), it forces companies to raise their prices as well to compete.

In other words, this can be seen as part of the free market incentivizing people and companies to find and patch exploits, or for programmers to just write safer code in general.

[ Parent | on HN ]

Re:Exploit broker Zerodium ups the ante with $500k to target... by l0b0 on Thursday August 24, 2017 @05:27AM (#15088702)

Since the offer is made by a shadowy organisation, how would we know whether it indicates anything reasonable? Companies with money to spare could use it to easily discredit competitors. First, company A offers $X (where $X might be a full-term equivalent salary or more) to a shadow broker for an exploit in company B's product. Likely outcomes include:

If an exploit is found, company A can play it for what it's worth, either accusing B of negligent behaviour, sloppy coding, defunct bug award program, etc., or exploiting the bug (via anonymously hired help) for a while, possibly in such a way that company B's customers notice the issue before company B does.

If an exploit is not found company A can still accuse company B of negligent behaviour if company B hasn't matched $X in their bug awards.

If company B has done everything right company A can pull the offer, and try to convince a reporter that this indicates an exploit was found and is being used without anyone at company B noticing. Dumber stories certainly have surfaced, and the damage could be significant.

[ Parent | on HN ]

Re:Exploit broker Zerodium ups the ante with $500k to target... by confounded on Wednesday August 23, 2017 @11:38PM (#15087423)

Couldn't the same argument be made about a thriving market in ways to break into your house at night and kill you?

[ Parent | on HN ]

Re:Exploit broker Zerodium ups the ante with $500k to target... by conanbatt on Wednesday August 23, 2017 @11:52PM (#15087468)

If your home has 250 mill people using it a month, probably.

[ Parent | on HN ]

Re:Exploit broker Zerodium ups the ante with $500k to target... by QAPereo on Thursday August 24, 2017 @01:54AM (#15087892)

More like... 250m people use a given brand of lock.

[ Parent | on HN ]

Re:Exploit broker Zerodium ups the ante with $500k to target... by akvadrako on Thursday August 24, 2017 @06:01AM (#15088830)

I wouldn't trust a lock that doesn't have a $500K bounty offered for exploits.

[ Parent | on HN ]

Re:Exploit broker Zerodium ups the ante with $500k to target... by niij on Thursday August 24, 2017 @10:26AM (#15090347)

So what do you use at your house? Watching the lock pick village videos from defcon made me realize that there are no perfect locks.

[ Parent | on HN ]

Re:Exploit broker Zerodium ups the ante with $500k to target... by akvadrako on Thursday August 24, 2017 @05:45PM (#15094318)

I use a cheap lock and don't expect it to hold up against any but the most lazy attacks. I don't trust it.

[ Parent | on HN ]