Hacker News Reader

Comment by tptacek | Hacker News Reader

And all you have to do is sell your unicorn vulnerability to this company:

ZERODIUM customers are major corporations in defense, technology, and finance, in need of advanced zero-day protection, as well as government organizations in need of specific and tailored cybersecurity capabilities

The offer to buy RCE in PHPBB/vBulletin is a nice touch.

View on HN

So, let me get this straight, this company is in the business of buying zero-day exploits and selling them to corporations and government organizations. How does this even exist? Is it legal? Can anyone buy and sell zero day exploits with total impunity?

Yes, they can.

Sure. The buying and selling tools is not the issue (depending on where you live), it's using them.

An exploit is just an input to a bug that someone else put there. The idea of it being illegal fundamentally makes no sense.

It's a win-win for Zerodium. They are getting free publicity for having the biggest bug bounty ever, and if somebody actually does submit a working exploit, they sell it to their clients for a hefty profit. I'm sure there are government agencies that would pay well over a million for the ability to infect any IOS device silently and easily.

You can sell the same exploit to multiple governments.

I don't see why someone wouldn't sell it to them, collect the bounty, and then either release/sell it themselves. It seems like Zerodium would have very little recourse.

If I had a bug that met the criteria I'd give Apple first dibs. That way the bug would get fixed, and I'd still get my $1M.

Apple doesn't pay money for security bugs.

Ask Apple for some freebies and call it a day.

Reply on news.ycombinator.com