Re:$36k Google App Engine RCE
by diminoten on Monday May 21, 2018 @08:53PM
(#17123037)
Just to trigger the proverbial trap because I'm curious, what's wrong with, "darknet Craigslist, paid in some crypto coin"?
[ Parent
| on HN ]
I think there's a trust problem with that. How do you arrange the transaction? If I offer to sell you a zero-day for X BTC or something, how do you know that my zero-day is real and exploitable, and that I will actually give it to you and nobody else? How do I know you will actually send me the BTC? How do I demo it in a way that at least proves that it works without giving away enough info to recreate it?
I guess Zerodium has enough reputation that you can be reasonably sure they'll fork over the cash after you show them your bug. Building that kind of reputation on the darknet with cryptocurrency isn't going to be easy. If there was anyone like that out there, we'd already know about them.
Nothing, but to make a complete argument you have to provide a hypothetical buyer, their price, and why they'd pay it.
Here is an angle that could work.
Known security person buys this in order to turn it in themselves for a higher bounty and increased rep.