Re:I Hacked into Facebook's Legal Department Admin Panel
by detaro on Saturday December 12, 2020 @04:48PM
(#25402044)
Interesting. I guess a real-world analogy is theft of valuables. If you steal random money, that's easy to turn into value. There's a harder to access criminal industry smelting down gold, which will equally reduce jewelry and priceless museum artifacts to material value. And a unique well-known painting is pretty much impossible to sell if you aren't already connected to a buyer with a specific interest.
There are markets for vulnerabilities that slot seamlessly into existing business processes. In other words, you can tend to find a buyer for a vulnerability that would replace another vulnerability already being used, that accomplishes pretty much exactly the same thing as that vulnerability. The more people run that business process, the more likely it is that there's a liquid market.
Lots of organizations have business processes that rely on browser RCEs. Generally, there aren't many organizations that have business process that rely on serverside vulnerabilities in line-of-business applications that have instantaneous half-lives, because once the patch is developed they're gone.