Hacking Team: a zero-day market case study

Re:Hacking Team: a zero-day market case study by tptacek on Sunday July 26, 2015 @11:03AM (#9951218)

No. Facebook is probably not outbidding the black market for their vulnerabilities. I think 'grugq is exactly right: the market for serverside vulnerabilities with hours-long half lives is very thin. Facebook could pay $500 for RCE, and so long as they do everything else they currently do for security, a thriving black market would not emerge for their vulnerabilities.

It's interesting to me that there's a real market price for an Adobe Reader flaw, but that Facebook flaws have (generous) fiat prices set by Facebook.

[ Parent | on HN ]

Re:Hacking Team: a zero-day market case study by gfosco on Sunday July 26, 2015 @03:11PM (#9951908)

I didn't say they're outbidding the black market, but they are quite generous and it is a legal action at that point. Makes sense to me, because they actually care about security and it's worth paying out to protect users and the brand. It also serves as a unique recruiting tool.

[ Parent | on HN ]

Re:Hacking Team: a zero-day market case study by FireBeyond on Sunday July 26, 2015 @06:52PM (#9952484)

Seems to me you could "quite easily" double dip.

Sell your exploit on the black market. A day later, sell it to the vendor. "Sorry, they must have found and patched it"? Just ask Facebook not to disclose your information when highlighting vulnerability payouts.

[ Parent | on HN ]

Re:Hacking Team: a zero-day market case study by tptacek on Monday July 27, 2015 @12:01AM (#9953248)

If you read this whole post, you'll see that buyers expect this behavior, and payments are escrowed or tranched to account for ti.

[ Parent | on HN ]