Zero day exploits, = BIG $

CloneRanger · Jun 12, 2012

From a few months ago, but some may have missed "these particular write ups", i did

Shopping For Zero-Days: A Price List For Hackers' Secret Software Exploits

A clever hacker today has to make tough choices. Find a previously unknown method for dismantling the defenses of a device like an iPhone or iPad, for instance, and you can report it to Apple and present it at a security conference to win fame and lucrative consulting gigs. Share it with HP’s Zero Day Initiative instead and earn as much as $10,000 for helping the firm shore up its security gear. Both options also allow Apple to fix its bugs and make the hundreds of millions of iPhone and iPad users more secure.

But any hacker who happens to know one Bangkok-based security researcher who goes by the handle “the Grugq”–or someone like him–has a third option: arrange a deal through the pseudonymous exploit broker to hand the exploit information over to a government agency, don’t ask too many questions, and get paid a quarter of a million dollars–minus the Grugq’s 15% commission.

*

He says there are now “more buyers, deeper pockets,” that the time for a purchase has accelerated from months to weeks, and he’s being approached by sellers with around 12 to 14 zero-day exploits every month compared to just four to six a few years ago

http://www.forbes.com/sites/andygre...ice-list-for-hackers-secret-software-exploits
Click to expand...

Interesting to note half way through 2012, what Grugq said in 2007 !

Where Is Hacking Now? A Chat with Grugq

An interview with noted anti-forensic researcher The Grugq turns into a broad-ranging discussion about the state of hacking and cracking.

The Grugq: Well, in 2000 there were loads of good exploits which would take maybe a week to find and develop. These days it might take six months to find and develop one. That is a huge change in value.

CSO: Why so long now?

The Grugq: It is harder to find good bugs and develop good exploits for them

http://www.csoonline.com/article/216370/where-is-hacking-now-a-chat-with-grugq?page=3
Click to expand...

Further reading

Zero-day” exploit sales should be key point in cybersecurity debate

Last week, Forbes’ Andy Greenberg investigated a dangerous but largely underreported problem in Internet security: the sale of zero-day exploits to customers not intending to fix the flaws. Zero-day exploits are hacking techniques that take advantage of software vulnerabilities that haven’t been disclosed to the developer or the public. Some companies have built successful businesses by discovering security flaws in software such as operating systems and popular browsers like Google Chrome and Microsoft Internet Explorer, and then selling zero-day exploits to high-paying customers—which are often governments.

https://www.eff.org/deeplinks/2012/...ales-should-be-key-point-cybersecurity-debate
Click to expand...

Mrkvonic · Jun 12, 2012

Supply & demand, it's all business.
Mrk

Log in or Sign up

Zero day exploits, = BIG $

CloneRanger Registered Member

Mrkvonic Linux Systems Expert

Log in or Sign up

Zero day exploits, = BIG $

CloneRanger Registered Member

Mrkvonic Linux Systems Expert

Useful Searches