News for hackers. Stuff that matters.
Re:Ask HN: What is the best way to get paid for discovering ... by ryanlol on Wednesday July 22, 2015 @10:04PM (#9933579)
I'm quite curious as to where this $500k figure for an iOS hole is from.

Also, as someone who makes their living selling exploits I rather disagree on your claim that selling vulnerabilities is something that would have you labeled as a "pariah". I don't think I've ever seen that happen.

Re:Ask HN: What is the best way to get paid for discovering ... by dsacco on Friday July 24, 2015 @01:08AM (#9940199)
I think this requires more context - where are they selling the vulnerabilities? If they are selling them to a third party like the ZDI, then no, of course it doesn't affect their standing in the legitimate securiry industry.

However, if you sell a vulnerability to a group that will explicitly use it for malicious purposes and this becomes very well known, you'll obviously become a polarizing figure and many doors will close on you. Not all, of course. Just a lot of high value ones.

This is not to make a moral judgment - it's just a reality that a lot of organizations won't want to be associated with you if you're labeled as a blackhat. Of course, if you do that you'll find plenty of other high value doors suddenly open up.

Re:Ask HN: What is the best way to get paid for discovering ... by lawnchair_larry on Thursday July 23, 2015 @09:59AM (#9935729)
Yeah, all of those numbers are out to lunch, and the "good vs evil" is completely made up.
Re:Ask HN: What is the best way to get paid for discovering ... by dsacco on Friday July 24, 2015 @12:54AM (#9940172)
The numbers are accurate. Browse through past payments to researchers participating in the Internet Bug Bounty, Pwn2Own or Microsoft's mitigation bypass bounty.

I don't have any good citation for the going rate for a high value vulnerability on the black market, but if you look I'm sure you'll see it can easily enter the mid six figure range.

As for "good vs evil" - I never used those words. Morality is a word I used because it provides a useful context against which to judge legitimacy. You can fairly say it is unethical to sell vulnerabilities for the explicit purpose of exploitation. I don't particularly care to color it this way; I disagree with such actions but I still respect my fellow colleagues who do it.

Re:Ask HN: What is the best way to get paid for discovering ... by lawnchair_larry on Sunday July 26, 2015 @02:48AM (#9950386)
I'm familiar with those bounties, and they're galaxies out of the ranges you're quoting.