Re:Hacking Team: a zero-day market case study
by nickpsecurity on Sunday July 26, 2015 @12:06PM
(#9951393)
Makes sense to me.
It's because Facebook, Google, and some others run generous bug bounties / white-hat programs. Without committing a crime, people can make a lot for disclosing it directly and confidentially. Vulnerabilities can pay 5-15k and there have been 30-40k payouts. Occasionally, you'll see a blog post explaining the process from detection to payment, like: http://homakov.blogspot.com/2013/02/hacking-facebook-with-oa...
FB paid out 1.3m in 2014. http://www.zdnet.com/article/facebook-bug-bounty-program-pai...
Re:Hacking Team: a zero-day market case study
by tptacek on Sunday July 26, 2015 @11:03AM
(#9951218)
No. Facebook is probably not outbidding the black market for their vulnerabilities. I think 'grugq is exactly right: the market for serverside vulnerabilities with hours-long half lives is very thin. Facebook could pay $500 for RCE, and so long as they do everything else they currently do for security, a thriving black market would not emerge for their vulnerabilities.
It's interesting to me that there's a real market price for an Adobe Reader flaw, but that Facebook flaws have (generous) fiat prices set by Facebook.
I didn't say they're outbidding the black market, but they are quite generous and it is a legal action at that point. Makes sense to me, because they actually care about security and it's worth paying out to protect users and the brand. It also serves as a unique recruiting tool.
Re:Hacking Team: a zero-day market case study
by FireBeyond on Sunday July 26, 2015 @06:52PM
(#9952484)
Seems to me you could "quite easily" double dip.
Sell your exploit on the black market. A day later, sell it to the vendor. "Sorry, they must have found and patched it"? Just ask Facebook not to disclose your information when highlighting vulnerability payouts.
Re:Hacking Team: a zero-day market case study
by tptacek on Monday July 27, 2015 @12:01AM
(#9953248)
If you read this whole post, you'll see that buyers expect this behavior, and payments are escrowed or tranched to account for ti.
Re:Hacking Team: a zero-day market case study
by Ded7xSEoPKYNsDd on Sunday July 26, 2015 @03:11PM
(#9951909)
Google and Mozilla pay bounties for vulnerabilities in their browsers, too. Yet the market for these bugs is striving.
Is selling a vulnerability a crime? Does that depend on whom you sell it to?
Re:Hacking Team: a zero-day market case study
by tptacek on Monday July 27, 2015 @12:02AM
(#9953252)
1. No. 2. Not currently, unless you know they're using your bug to commit a crime, in which case you can assume liability for that crime by actively helping them.
Re:Hacking Team: a zero-day market case study
by groupmonoid on Sunday July 26, 2015 @04:11AM
(#9950500)
My heart wants to agree with Thomas, but I think we should remember this is a single data point and not generalize too hastily.
Is this due to the fact that the value of a Facebook XSS vuln is very low, or that the high likelihood that Facebook will notice the vulnerability (possibly from another source) and patch the issue before a profit can be realized?