Hacker News Reader

Comment by paulgb | Hacker News Reader

Fair point, but as someone not familiar with exploit markets, I do find it surprising that an exploit in a relatively niche (because desktop linux is relatively niche) IM client is worth $100,000k.

View on HN

Zerodium is a proxy for governments wanting to buy exploits. That niche IM client might be the software of choice for a child-exploitation ring or a high level ISIS commander.

Comparatively a single hellfire missile costs $150k - plus $32 million for the drone to fire it from.

The 100k exploit bounty is probably less than the yearly cost of 1 agent for many government organisations. So the target doesn't even have to be a high value ISIS terrorist to make this bounty worth it. Just save them 1 or 2 FTE somewhere and the economics already work.

The work is the work, no matter how much the project itself took to build. If it was easy for exploit developers to pull a Pidgin exploit out of their butt, they'd be cheap. The fact that it's a niche target can actually make bugs scarcer; sometimes, exploit devs can draft off the work other people have done beforehand.

Sure, my surprise is more that the demand exists at $100k, not that the supply isn't cheaper.

I get why that's surprising but I think it's important to beat that surprise out of your brain, because $100k is a rounding error for any state-level actor --- not just the US, but, like, Seychelles as well. If you have a problem that can be solved with a Pidgin exploit, it's a problem you'd fall over rushing to write a simple $100k check for.

What's so perplexing to me is why the pay grades for people in the military are so low. Take Michael Flynn, for example, the O-9 pay for a three star general is lower than what a senior software developer makes. Surely if we're spending $100k a pop for these random exploits it makes sense to spend more at the top of the military to make sure we're buying the right ones.

Also, I don't really see any possible way out of this cyberarms market. There are too many degrees of freedom to really secure anything completely and I'm continually surprised that our governments allow the sale of these munitions to non-allied foreign governments. If someone puts up a $2m dollar bounty for Tesla do we just accept this even if it means physical harm?

I think we don’t want those at the top of the military to be motivated by money.

You're missing the value of military pensions and healthcare when you speak about O9 compensation.

I would have thought the same, but the existence of this "ask" certainly would suggest there is indeed demand from a market dynamic perspective. Pidgin is cross-platform, and you could conceive that it was being used by people for various activities with OTR or OMEMO end-to-end encryption. At that point, there's a bunch of potential customers looking to pay Zerodium for a good, robust, zero-click exploit that would give them access to exfiltrate and monitor messages sent through the client.

Pidgin has, or at least had, more usage than you might think. I know that it was the typical Jabber client at Oracle a couple years ago. It's been superseded by Slack/Teams/Zoom recently, but it's not exactly rare. Also, if you were going to profile network admins or ops people that might be interesting to target for attack, they're more likely than most to be running Pidgin.

Undoubtedly some TLA has learned someone of interest is using Pidgin, and has offered a premium for an exploit to target them. TLAs have deep pockets for such things.

Pidgin is ubiquitous on darkweb drug markets and in exploit communities.

Reply on news.ycombinator.com