There is no easily accessible "black market" for a hack like this. As an average person what is your alternative really? Pick up the phone and call the government of Iran?

It is far more convenient (and safer) to just take the guaranteed ~$10K and move on with your life.

~10k and a minor hit of publicity. If you’re a security researcher I imagine that this is a solid boost to your reputation.

> Pick up the phone and call the government of Iran?

Would that work? Asking for a friend.

Even if it did, you wouldn’t want to do it. Someone like that can dispatch goons after the deal, to make sure they’ll be the only ones to know the hole.

Have you seen "Burn after reading"?

Yes! I was trying to think of the name of it after making this comment. Thanks.

I've deleted my comment, but will replace it with this interesting discussion:

https://news.ycombinator.com/item?id=20651210

It doesn't have to be "easily accessible" to be valuable.

Corporate espionage exists, insider trading exists (and is more common than you might think), there's any number of parties who might pay for insider info (once properly laundered) about Facebook activities.

Why would "the government of Iran" care about what Facebook is up to? Isn't FB banned in Iran?

You forget that intelligence and espionage goes both ways. Iran could use FB in some way to attack the US, just like Russia did, just as it could shield itself from FB.

Russia bought lousy ads and ran some pages like your average boring marketer, hardly an attack.

There is no market for bugs like these.

Isn’t legal involved in most business moves? Getting a wind of those ahead of a public announcement surely must be worth something ;)

A "market" needs a bit more than "is worth something".

What multiplier of the $7500 bounty would you want for the trouble of committing a crime? Who's the buyer (FB afaik doesn't buy a whole lot of publicly traded companies, so it probably needs to be someone who can get into the deals, and quickly)? How do you find them? How do you convince that buyer that your deal is worth the money and the hassle of committing a crime? How do you trust the buyer? How do you handle it if the hole gets closed before the buyer can profit? How do you value the risk it gets closed before you got your deal? Does all that work out in a way that you really don't want to take the bounty?

People buying backdoor access into companies probably happens occasionally, but it's probably not the easy high-profit thing compared to bounties many people think, but rather on the level of selling account information by the dozen for a few bucks - and for something like that you'll burn them quickly.

I believe a good way to think about the market for vulnerabilities is this:

There are markets for vulnerabilities that slot seamlessly into existing business processes. In other words, you can tend to find a buyer for a vulnerability that would replace another vulnerability already being used, that accomplishes pretty much exactly the same thing as that vulnerability. The more people run that business process, the more likely it is that there's a liquid market.

Lots of organizations have business processes that rely on browser RCEs. Generally, there aren't many organizations that have business process that rely on serverside vulnerabilities in line-of-business applications that have instantaneous half-lives, because once the patch is developed they're gone.

Interesting. I guess a real-world analogy is theft of valuables. If you steal random money, that's easy to turn into value. There's a harder to access criminal industry smelting down gold, which will equally reduce jewelry and priceless museum artifacts to material value. And a unique well-known painting is pretty much impossible to sell if you aren't already connected to a buyer with a specific interest.

Didn’t say it was easy to monetize. I do recall a bust, some time ago, of a ring that used prerelease (?) announcement pdfs already placed on publicly accessible servers (?) as a source of insider alpha.

(‘?’ because I’m on my third whiskey and about to turn in :)

Yeah, the response is purely in context of the mentions of "black market" value higher up the thread. Being able to turn potential gain for someone into actual money for you is the key issue.

In other words, how much would Pepsi pay for the secret recipe to Coke?

Pepsi would report the person to Coca Cola instead of buying the recipe.

https://thehustle.co/coca-cola-stolen-recipe

> Months earlier, when Pepsi received the trio’s initial letter, they’d promptly forwarded it to Coca-Cola, and informed them they had a leaker. In turn, Coca-Cola had brought in the FBI to conduct an undercover investigation.

> On July 5, 2006, Williams, Dimson, and Duhaney were arrested on charges of wire fraud and unlawfully stealing and selling trade secrets.

not even for nation states/APTs? Are you sure about that?

I can’t speak for Thomas- but generally you’d want to invest your money in a vuln that is rather static. Web applications with attack surfaces that are constantly changing are not a good fit for a sophisticated attack with potentially huge blowback.

Could you please elaborate?

Where are you going to go to sell it? are you going to go find some tor hidden service with a forum that you can post your exploit on and hope that somebody will give you some bitcoins for it? You think that those are not under heavy surveillance already? The "black market" for this kind of thing is way overblown. And if you think you can just go sell it to some nation state, think again. That's an easy way to end up in a federal supermax.

Sorry, I didn't write clearly. What I meant was, there is no market for RCEs in random Facebook backoffice sites.

Hedge funds that employ blackhat hackers to steal confidential information from a public company would buy it.

Except going to the black market is not legal and Facebook already knows of the exploit, so... People have been imprisoned for less.