Hacker News Reader

Comment by H8crilA | Hacker News Reader

I'm surprised by how cheap the vulnerabilities market is. A good exploit, against a popular product like Chrome, selling for 100k or even $1M may sound like a lot, but it's really pennies for any top software firm. And $1M is still a lot for a vulnerability by market prices.

You can do so much damage/return with an exploit that affects > 30% of the population. Get 5 of those and sky is the limit.

View on HN

> I'm surprised by how cheap the vulnerabilities market is

I think this has a lot to do with government agencies buying any exploit they can get their hands and there is basically no market besides that. I don't know if that is illegal in the US, but it seems that government is the only buyer.

I'm wondering if hedge funds would buy something that would allow access to private data. I heard insider trading is not an unusual thing, so a polished series of exploites wrapped up as a tool with clear interface might be taken seriously.

A major vuln can probably pretty reliably blip a share price, with FAANG and similar companies' shares that's going to be a chance to make fast bucks.

> if hedge funds would buy something that would allow access to private data

Extremely unlikely. The risk/reward if found out is too lopsided. Conviction for insider trading has you pay a penalty and transform your fund into a family office -- Raj Rajaratnam going to prison for a decade is a unique exception not the rule.

Conviction for insider trading in combination with wire fraud, espionage, and all the other exploit-related charges will send everyone involved to prison for 10-20 years, pretty much guaranteed. What use is a bigger hedge fund if you have that sword of Damocles hanging over you?

Well, for what it’s worth, if you purchase an exploit and use it to hack phones and then trade on the info you steal, I don’t think there would be any insider trading charges involved.

Lots and lots of other charges but if no insider is giving you info then it wouldn’t be insider trading.

What would be 100% legal would be if you bought an exploit and then traded on the release of that exploit. Depending on the severity of the exploit it could move the stock price a bit. And, even though people wouldn’t like it, that’s kind of the point of the market. You get rewarded for helping with information and price discovery.

>transform your fund into a family office

What does this mean?

I think that not all companies are the same.

Some companies put a lot of effort in security (Apple, Google, Facebook, etc). Usually they have engineering driven cultures.

The other majority of companies see security just as a cost center that needs to be covered in order to reduce legal liabilities.

The second kind of companies do not have a bug bounty programs because they know that they have too many holes and prefer not to attract too much interest.

For those companies that may have huge capitalization and profits, paying $1M for a vulnerability is not practical.

I expect that in general all companies (including those in the first group) detect compromised accounts and services from time to time but unless they have to disclosed because the laws demand it, they prefer to avoid the bad PR and potential lawsuits.

But while I expect the first kind of companies doing a root cause analysis and improving the systems, the companies in the second group of companies usually just clean up the detected compromised systems and avoid to look too much deep because either they do not have the skills or they are afraid to find things they will have to disclose and be liable for.

Well it is also a signalling to Apple Users that they is serious about security and privacy. This helps them sell more iThings.

It depends on how an exploit is monetized; the devils is in the terms: exclusivity, duration, scope and level of access. A non-exclusively-licensed exploit that can be sold 50x for $50k/year is bank ($2.5m/yr). If I were to spend 6-9 months developing a good exploit, I wouldn't give it Apple if and only if money were the primary and sole motivation. However, it makes sense to blog about it, turn it in to Apple and leverage such a discovery into outside Angel funding for a startup... that is if Apple doesn't require onerous NDAs. If the terms from Apple weren't favorable (they're likely to be terrible), then reselling it makes sense if you were really broke or going nonprofit security disclosure route at least parlays it into cred.

Out of interest how do you get to know the market price or the market in general for this sort of thing?

If I were to discover a vulnerability is there a legal way I could cash in on it (aside from this case with Apple)?

I don’t know this market well, but I do know what a 3% dip in Apple’s stock price means, so it seems rather obvious that Apple’s incentive to know of vulnerabilities prior to their sale in an alternative market is worth a lot more than 1M.

Valuing something in terms of its short-term impact on stock doesn't make any sense. An iOS vulnerability is worth a lot, but that the stock price dipped 3% is more of a sign of the market being fickle and reacting to any bad/good news about the company on a given day than 3% of Apple's worth being lost in any meaningful sense.

Following this line of thinking leads to some pretty absurd conclusions, like 7% of Tesla's value being predicated on Elon Musk not smoking a joint[1].

1. https://www.cnbc.com/2018/09/07/tesla-sinks-8percent-after-b...

First paragraph:

> Shares of Tesla plunge after news of a pair of C-suite executive resignations and a bizarre video showing CEO Elon Musk smoking pot on a podcast.

Some stuff on the internet: https://zerodium.com/program.html

Also I heard in person, so I cannot quote.

Not sure how legal this is, but there are even vulnerabilities brokers, who set you up with buyers.

Interesting... they do not seem to be interested to processors exploits.

Well it doesn't cost much to put it up there (among the list of things they seek), now that we know it's feasible even against big players.

And even your estimates are way higher than that of typical "warez forum."

100k exploits most likely what has been resold few times over before it reached the "professional infosec" space

Eh, I think that’s a bit presumptuous. There can be honor among thieves.

>>I'm surprised by how cheap the vulnerabilities market is.

I presume that it is a legal minefield, selling 0days and extortion are first cousins, at least. If you could hold a bid, no doubt an Arab country would pay $50 Mil for one...but they buy them from companies that sell "software" and services.

Agreed. People talking in the top-rated comments of this thread seem to think 1M is a lot of money for a vulnerability that could cost Apple lifetime customer value 10-100x the amount they’re offering in bounty.

So the question is, assuming you have a valid exploit, could you not convince Apple to pay more than $1m?

If you found an unfound gaping crater of an exploit somewhere -- how much would that be worth to them? Likely a lot more than $1m. I'm sure you could negotiate that number up, a lot.

The problem is that technically finding the exploit at all is in violation of the CFAA. Once you approach Apple with the exploit, you're then skating on their goodwill. Trying to play hardball probably won't go well for you.

Well how would you otherwise monetize the exploit? You could sell it on the black market, but I doubt you'd be able to make 1M off of it. Then again I don't know the black market so you could?

But bug bounties like this are competing with the shadier markets. I suspect they found out the shady companies are offering more than their existing bug bounty program did.

Quite simply if you have your name on apple.com that says they paid you $1m under this program you just walk into any VC office in SF or Tel Aviv and say "how much have you got?"

As Warren Buffet says there is plenty of money to be made in the centre

This is silly. Apple is going to have bugs almost no matter what they do, as will Google and Microsoft.

It makes sense to invest way over the top if you can kill bug classes outright --- and Apple does this, too. For example, people that were doing DMA hardware attacks against macOS a couple years ago are now on Apple's payroll, designing hardware to defend against those attacks. That's a meaningful serious investment in defense. Rewriting their kernel in a memory safe language would be another example (one they haven't done yet).

Massively outbidding the current spot price for a bug doesn't accomplish anything like that. Think about who they're really bidding against. They can drive the price of bugs way up, and they are doing that gradually, but there will still be a price and people selling them.

The important thing they're doing on this is making unlocked devices available for researchers, and lowering the bar for research for people who would never sell to brokers.

I took the downvote, and I agree with everything you've said here. Thanks for your reply.

The NSA or any other agency would pay you 10x that if you go to them instead of report it.

I’m assuming you know from experience.

If one million for hacking or accessing an iphone is more than the real world value, there wouldn't exists business dedicated to unlock protected iphones or hack them, but they do and make business with countries while earning millions.

I'm absolutely sure that saudi arabia would pay much more than that for an exploit like that and I don't need to have experience doing it, it's common sense.

Reply on news.ycombinator.com