Leak uncovers global abuse of cyber-surveillance weapon

Re:Leak uncovers global abuse of cyber-surveillance weapon by netsec_burn on Sunday July 18, 2021 @01:17PM (#27874636)

It's not that cut and dry, ethics and legality are a concern for a lot of researchers such as myself that sell zerodays. In my experience the actual price difference between unethical and ethical outlets is up to 4x, not two orders of magnitude (10K vs 1M?). I can't speak for everyone of course, but even the other researchers I know refuse to sell to unethical buyers, money isn't a factor.

[ Parent | on HN ]

Re:Leak uncovers global abuse of cyber-surveillance weapon by sudosysgen on Sunday July 18, 2021 @04:02PM (#27876148)

You can almost assuredly sell exploits illegally/unethically for a serious amount if you have the right connections. We know that iOS zerodays have sold north of 2 million $.

[ Parent | on HN ]

Re:Leak uncovers global abuse of cyber-surveillance weapon by edoceo on Sunday July 18, 2021 @04:52PM (#27876563)

I don't know that. I can't find anything on G or DDG - can you point me towards some data/links?

[ Parent | on HN ]

Re:Leak uncovers global abuse of cyber-surveillance weapon by sudosysgen on Sunday July 18, 2021 @05:18PM (#27876774)

https://www.wired.com/2015/11/hackers-claim-million-dollar-b...

https://arstechnica.com/information-technology/2019/01/zerod...

https://zerodium.com/program.html [see iOS 0-click FCP]

[ Parent | on HN ]

Re:Leak uncovers global abuse of cyber-surveillance weapon by edoceo on Sunday July 18, 2021 @06:41PM (#27877331)

Thank you!

Summary: Wired report is a $1M and Ars reports three, one at $2.5M - all paid by Zerodium. Wow.

[ Parent | on HN ]

Re:Leak uncovers global abuse of cyber-surveillance weapon by dannyw on Sunday July 18, 2021 @10:45PM (#27878753)

If you have a iOS/iCloud/Google 0day, you will absolutely fetch tens of millions from it assuming it's the real deal (reliable, etc).

Google, on the other hand, regularly pays white-hats something like $100k for "arbitrary access to contents of any Gmail content".

[ Parent | on HN ]

Re:Leak uncovers global abuse of cyber-surveillance weapon by zrth on Sunday July 18, 2021 @03:33PM (#27875883)

Can you give me a feeling for wat ethical buyers would be. I'd assume bug bounties and ZDI and similar. What else?

[ Parent | on HN ]

Re:Leak uncovers global abuse of cyber-surveillance weapon by netsec_burn on Sunday July 18, 2021 @04:13PM (#27876251)

First and foremost, the original vendor is always the most ethical place to sell it. That's where you stand the best chance of having it fixed for affected users. Second to the vendor are third parties that report vulnerabilities to the vendor by selling early warnings as a service. I don't know if I would recommend ZDI, they provide zero guidance for what their payout ranges are. There are security companies that purchase zerodays to write about them for PR, which also fixes the issue. And finally there's selling it to branches of the US government with license restrictions and a blanket exclusion for the NSA.

Beyond those buyers, the lines start to blur (defense contractors, companies in countries allied with the US e.g. FVEY). I would not recommend it either. Unethical buyers have completely different interests. I know Zerodium for one is a terrible place to sell to (you may be a target), and anything that is sold to Crowdfense is likely to be used against American interests.

My take away advice is, you can choose between painting a target on your front or one on your back.

[ Parent | on HN ]

Re:Leak uncovers global abuse of cyber-surveillance weapon by zrth on Monday July 19, 2021 @06:27AM (#27880935)

When you say "one could be targeted/painting an target on one self" what does this imply? Basically that some group, most likely a nation state actor might hack my systems in the hope to see what else i have and who i am selling to?

Or rather that when i cross the wrong broader in to the wrong country that i might disappear?

[ Parent | on HN ]

Re:Leak uncovers global abuse of cyber-surveillance weapon by Aulig on Sunday July 18, 2021 @05:51PM (#27877009)

Who do companies like ZDI sell early warnings to? I don't quite understand how a vulnerability could be worth more to them than the vendor who could fix it (assuming they don't somehow abuse the vulnerability).

[ Parent | on HN ]

Re:Leak uncovers global abuse of cyber-surveillance weapon by dannyw on Sunday July 18, 2021 @10:49PM (#27878775)

Because ZDI negotiate. As a bug bounty participant in the official programs, you aren't allowed to negotiate.

ZDI, on the other hand can say: "We want $10M for this iOS zero day, or we don't report it to you." And the process of negotiation goes back and forth, but the end result is, Apple will pay considerably more to ZDI than through the direct program.

[ Parent | on HN ]

Re:Leak uncovers global abuse of cyber-surveillance weapon by zrth on Monday July 19, 2021 @06:22AM (#27880907)

Correct me if i am wrong. I think another reason why ZDI maybe could pay more is because they also have other paying customers that pay for IDS/IPS subscription.

[ Parent | on HN ]

Re:Leak uncovers global abuse of cyber-surveillance weapon by fossuser on Sunday July 18, 2021 @01:24PM (#27874684)

Thanks for being one of the good guys.

[ Parent | on HN ]