Hacker News Reader

There are various security broker companies that governments work with. An unscrupulous pentester could find one, email them, and ask them if they're interested.

The trouble would be how to prove the exploit works without also revealing how it's done. The best bet would be to demo one or two out of the three exploits required to work, then talk business in exchange for the third.

View on HN

Business transactions between parties that don't trust each other is a solved problem: escrow.

Does escrow really work with secrets like this? The buyer receives the exploit and claims it doesn’t work. The seller claims it does. The money is still in escrow. How do you proceed? The escrow agent is getting a commission, they should not have access to the full secret. It’s really hard to find an escrow agent who has the skills to assess an exploit and whom both the buyer and the seller would trust not to leak it or use it for their own benefit.

You could have the inspection done by an independent.

Anyway, it's been done before by guess-who:

https://www.mitnicksecurity.com/shopping/absolute-zero-day-e...

Does escrow really work with shady black hat deals like these?

Depends on who the buyer is and yes, it does work, there are even specialized marketplaces. You'd still be dealing with the devil but you very likely will get paid.

Reply on news.ycombinator.com