News for hackers. Stuff that matters.

A comment on Chrome exploit and sandbox escape demonstrated at CanSecWest, $60k awarded. Parent comment

Re:Chrome exploit and sandbox escape demonstrated at CanSecW... by lawnchair_larry on Wednesday March 07, 2012 @05:52PM (#3677680)
Where on earth did you get the idea that there is something illegal about selling exploits? Several companies exist that do exactly this, and they operate in public, above board.

To my knowledge, the US government is the biggest buyer of unpublished exploits. And they pay a lot more than 60k. One well-known US-based company is even run by a former NSA employee, and they're currently advertising a remote pre-authentication exploit in the latest version of MySQL.

[ Parent | on HN ]
Re:Chrome exploit and sandbox escape demonstrated at CanSecW... by rand_r on Wednesday March 07, 2012 @09:06PM (#3678298)
Ignoring the US government, what legal use would a company have for un-patched exploits?
[ Parent | on HN ]
Re:Chrome exploit and sandbox escape demonstrated at CanSecW... by trotsky on Thursday March 08, 2012 @12:45AM (#3678726)
Penetration testing is the common answer, though that job description can also be a bit of a euphemism.

It is also worth noting that breaking into the computer of a foreign national that is located overseas is often not a crime in the united states, or is at least considered very difficult to prosecute if it doesn't involve fraud, financial transfers or a few other hot buttons.

[ Parent | on HN ]
Re:Chrome exploit and sandbox escape demonstrated at CanSecW... by nikcub on Thursday March 08, 2012 @03:08AM (#3678972)
Fame, reputation, marketing, using 0day in pen-tests, etc.

This isn't new, security companies have been paying contractors for unpublished advisories and exploits for over 15 years now.

[ Parent | on HN ]
Re:Chrome exploit and sandbox escape demonstrated at CanSecW... by eli on Wednesday March 07, 2012 @09:46PM (#3678402)
Well besides the vendor you mean?
[ Parent | on HN ]
Re:Chrome exploit and sandbox escape demonstrated at CanSecW... by Sire on Wednesday March 07, 2012 @07:02PM (#3677941)
Links please.
[ Parent | on HN ]
Re:Chrome exploit and sandbox escape demonstrated at CanSecW... by lawnchair_larry on Wednesday March 07, 2012 @08:03PM (#3678143)
https://lists.immunityinc.com/pipermail/canvas/2012-February...

http://securityevaluators.com/files/papers/0daymarket.pdf

[ Parent | on HN ]