News for hackers. Stuff that matters.

A comment on Leak uncovers global abuse of cyber-surveillance weapon. Parent comment

Re:Leak uncovers global abuse of cyber-surveillance weapon by Aulig on Sunday July 18, 2021 @05:51PM (#27877009)
Who do companies like ZDI sell early warnings to? I don't quite understand how a vulnerability could be worth more to them than the vendor who could fix it (assuming they don't somehow abuse the vulnerability).
[ Parent | on HN ]
Re:Leak uncovers global abuse of cyber-surveillance weapon by dannyw on Sunday July 18, 2021 @10:49PM (#27878775)
Because ZDI negotiate. As a bug bounty participant in the official programs, you aren't allowed to negotiate.

ZDI, on the other hand can say: "We want $10M for this iOS zero day, or we don't report it to you." And the process of negotiation goes back and forth, but the end result is, Apple will pay considerably more to ZDI than through the direct program.

[ Parent | on HN ]
Re:Leak uncovers global abuse of cyber-surveillance weapon by zrth on Monday July 19, 2021 @06:22AM (#27880907)
Correct me if i am wrong. I think another reason why ZDI maybe could pay more is because they also have other paying customers that pay for IDS/IPS subscription.
[ Parent | on HN ]