Hacker News Reader

Comment by CGamesPlay | Hacker News Reader

End of the post it says 51k so far. I'd expect the price to go up a LOT more, because otherwise the sane (monetary) advice becomes "report some vulnerabilities to apple, and then keep finding them and sell them to third parties".

View on HN

Yeah, that is only for 4 vulnerabilities out of 55. And 3 of them were only "High." They still have 10 (!!) more critical vulnerabilities they may receive payment on.

Also, they state in the article: "However, it appears that Apple does payments in batches and will likely pay for more of the issues in the following months."

Update: They just paid for 28 more issues, running total is now $288,500.

https://twitter.com/samwcyo/status/1314310787243167744

There are defense contractors that do exactly this. Governments pay more than Apple will ever pay, so if you are in it for the money (and don't care about the ethical repercussions), selling the discovered exploits to governments is the way to go.

Yeah I imagine you can make a lot more money selling them to state actors than to apple.

That's only true if you have no way to be put in (financial) risk by the vulnerability you're not disclosing to Apple.

If you're a security researcher, you probably know how to cover your tracks.

Yes, but the risk if you’re caught is huge.

not if you're selling them to -your- government. Then you're a patriot but also a rich patriot.

Where do security researchers sell their investigation on the black market? Links?

Zerodium is probably the closest thing to a “legitimate” acquirer of exploits, those which aren’t being disclosed to the vendor and then fixed.

any company that builds software for government tracking like NSO Group will happily pay, and have very deep pockets

The following companies buy 0-days. Each has a slightly different business model:

Zerodium - http://zerodium.com/ Azimuth Security - https://www.azimuthsecurity.com/ NSO Group - https://www.nsogroup.com/ ZDI - https://www.zerodayinitiative.com/ SSD - https://ssd-disclosure.com/

Do you? The skills involved in VR and exploit dev don't necessarily mean you're good at opsec.

True, plus "opsec life sucks" so most of us don't do it.

Reply on news.ycombinator.com