Hacker News Reader

Comment by TheRealSteel | Hacker News Reader

Isn't the idea of a bug bounty at this scale that the monetary reward (especially combined with the lowered legal risk, but also when considered in isolation) is higher from reporting it to the vendor than from selling it on the black market? I.E. presumably Apple has done their research and one million dollars is more than they believe you'd getting selling a zero day to somebody else.

I don't work in the security field nor am I a business number cruncher, but that was the gist I had of what these programs achieved.

Edit: see Despegar's reply, I should have RTFA! However worth pointing out that there would be some incentive for researchers to go to Apple instead of a third party, which might tip the scales in their favour.

View on HN

From the article:

>Previously, a company called Zerodium was vocal about how much it will pay researchers, before handing them to its unknown government customers. In January, the secretive company announced it was offering $2 million for a remote hack of an iPhone.

So that's already more than what Apple offers. I tend to think they'll always be outbid.

Governments are strong. Wow.

I forget the influence until I see things like this.

Apologies, I did fail to RTFA in this case. Thankyou!

I don't know many people here who believe Zerodium's price list, and while I can't speak to Zerodium's payment terms, the norm appears to be tranched payments, apparently ofter over a year; selling the same bug on the grey market for "more" money (whatever it is brokers actually pay) is a gamble that the bug you've sold isn't going to die.

With those terms, they can buy a bug, report it to Apple, collect the $1m, and be off the hook to pay out the remaining payments. It seems to me this makes it much riskier to go to the black market than people here realize.

Yes, because that is exactly the sort of behavior that a business would engage in. Screwing over their suppliers and demonstrating that they offer no value whatsoever.

How would that make any sense? It is ludicrous.

Would be a nice pivot for patent troll companies. In a world where profit is king the question is not why, but when?

A nice pivot for patent companies would be somehow generating the connections and reputation to participate as brokers in this super-insular and highly technical marketplace, and then burn all that work down to fuck over an individual researcher for pocket change?

A "remote hack" generally relies on a stack of exploits. From what I recall when the last jailbreaks came about, that stack was at least 5 or so exploits deep.

So $1M/exploit is priced significantly ahead of the $2M/hack.

Interesting this also means that an entire exploitable stack now becomes worth a lot more, while any given exploit is worth a lot less. And any stack of exploits becomes much more brittle, as a patch of a single one of N exploits can knock out the use of the stack.

I’d rather a legitimate 1 million I can declare and put in my bank than 2 million from the underworld delivered in instalments in bitcoin.

Worth adding that clean money is worth more than dirty money

If the money is directly from the government, is it really dirty money?

Yes.

Different definition of “dirty”.

Yeah. I'll give you that. It's the same sort of "dirty" as a paycheck from Palantir or Facebook...

So not dirty. “Dirty” money in the traditional sense has to be “laundered” because it comes from an illegal activity.

Depends which government, I would think.

Kind of what I meant by "Especially considering the lower legal risk" but I guess there's the specific cost of laundering it too. A good point!

Are there any laws you bump into selling 0-days? Honest question, I know their are laws about the actual hacking part but is it illegal to sell the payload? Obviously this is ethically dirty money I just was curious if it's actually dirty money in a criminal sense.

If you sell a bug to someone you know is going to break the law with it, you're getting close to the line for liability. People who sell bugs to the western IC are, as I understand it, virtually always selling to broker firms designated by governments which offer a veneer of plausible deniability; selling to a well-known broker is probably not legally all that risky.

As has happened disappointingly in the past - there aren't any actual laws offering safe harbor for ethical hacking, companies just tend not to prosecute responsible disclosure... if your disclosure required you to break interstate commerce laws, run afoul of the CFAA[1] or even just violate a TOS - or even if they can convincingly argue that discovering your disclosure might have - then you can be prosecuted.

Now, people who prosecute white hacks that practice responsible disclosure are technically known as "asshole"s but the end result is that there are a ton of laws even innocent computer usage breaks so your liability for any damage to end users usually doesn't need to be considered, there's enough book to throw at people already.

[1] Essentially if you touch a computer or computing device it's quite likely you've somehow violated the CFAA, it's _stuuupid_. https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

None of this seems particularly relevant to the scenario of selling to zerodium.

This has nothing to do with hacking, so none of that applies. You're conflating attacking someone else's computer or network.

You don't need safe harbor because analyzing your own property is not a crime. Neither is telling people what you found. Also, please stop using the term responsible disclosure!

> You don't need safe harbor because analyzing your own property is not a crime.

Do you own the OS you’re breaking into?

Effectively yes. You can conduct vulnerability research on your operating system.

What if you sell it to the repair industry? There are plenty of people who want to break open Apple's walled garden, and those are not necessarily what most would consider "malicious" or "unethical".

Unfortunately the intersection of "security researcher" and "right-to-repair advocate" is probably tiny, but that would be something I'd love to see: someone finds a crack that enables a lot of third-party-repair scenarios and sells it to that industry instead of to the black-hat criminals or even back to Apple itself.

The third-party repair/aftermarket industry is huge and would love to break through the proprietariness of the ecosystem. In that light, $1M seems rather small...

> Unfortunately the intersection of "security researcher" and "right-to-repair advocate" is probably tiny

Based on personal experience, the intersection isn’t all that small.

Bug bounties merely needed market pressure for the bounties to rise.

Corporations had been unilaterally deciding what the payment for a reported bug would be. They were constantly undervaluing and wasting everyone's time. People would say the same rationale "low liability and clean money is more valuable than dirty money and needing to launder it".

Yeah, but not that much more valuable.

So now the bounties are reaching their market price.

No it's not. Money is money.

I would imagine the publicity a researcher would get from wining the 1 million is also very valuable.

There's going to be an equilibrium here dictated by how much Apple itself is willing to pay for bugs. If Apple pays more then presumably more bugs will get reported which makes the remaining unreported bugs much more valuable since they'll be relatively rare.

Depends who’s buying I imagine. Not sure about everyone else but I always picture the entities buying on the black market as singular people for some reason

When you consider it could be the likes of the three digit shoe inspectors over there in the US it could be a fair chunk of change

Who are these individuals that will pay millions of dollars for an exploit? Cyber criminals rely almost exclusively on dead bugs, frequently using exploits from the metasploit framework. That gives then sufficient access to a broad range of victims so they can generate revenue through volume.

0days are used against hardened targets. Think “Iranian nuclear facilities” rather than “grandma’s PC”

They are made up, in my head, figments of my imagination. Hence “for some reason”.

Yeah. They don’t exist. People don’t think about things rationally, they see phrases like “black market” and assume it is some sort of criminal transaction with armed guards and meetings at midnight and shit.

It is nothing like that. It is the same as freelance development work, except there are very few customers and the developer writes something that may or may not have any value.

I wonder how a company investigates black market to that levels.

Reply on news.ycombinator.com