Hacker News Reader

Comment by throwaway20371 | Hacker News Reader

throwaway20371

If I'm a hacker and I have an Apple 0-day, why the hell would I report it to Apple if I can quickly get a tidy payment on the black market?

View on HN

That local 7-11 sure has a lot of cash and a sleepy clerk working it.

How can I monetize ethics?

We live in a society. We try to abide by the mores.

Apple is trying to push a censorship module (that file scanner) onto every iPhone. That would be a massive damage to our society at a scale no black hat could ever make. Apple is certainly not a bastion of ethics.

true, but as the saying goes... two wrongs a right does not make.

Is robbing a robber a crime?

Yes, if the robber is a baron.

In fact, in most jurisdictions it is.

who has the better attorney?

You do you. Don’t be surprised when you get cast off into exile. Society is pedagogically just.

Society's mores are pretty fungible. Who'da thunk that half of society would be fine with killing people if the alternative is sometimes wearing a paper mask and getting an injection?

Apple is not an ethical company. Why not sell your knowledge to someone who may have a good use for it, like saving lives?

Maybe because you don't want to be an arms dealer? Or you don't want to risk prison.

What law is there against selling vuln to a random person on internet? And yeah you don't really need "Black" market. There is plenty "legit" companies around the globe that absolutely immoral, but their business as legal as it's could be.

Precisely this. Zerodium will sell your bug to the FBI, who will be happy to use it to incarcerate more Americans.

They'll also absolutely sell it to China, they'll just be quiet about it and use one of many Thailand-based intermediaries.

If you sell something to someone and they use it to commit a crime, you are culpable if you even had a wiff that it was going to be used for something illegal. So if you're selling 0days on the blackmarket, you can bet your ass they will come after you sooner or later.

The companies that immoral & legal, have paved their own way, but since you're not going to be selling to governments directly, don't count on being able to get away with it.

Can you provide some examples in US / EU of people being charged for selling vulns on "black market"? Otherwise it's just baseless FUD.

I guess far bigger problem for researcher would be to actually not being scammed while selling and this is why companies like Zerodium have their marketshare.

Yeah someone could pay to you in crypto, but chances that you'll just gonna be scammed are extremely high.

It's not really baseless.

There might not be a high profile "this dude sold a 0day and got arrested" case yet, but there are cases of folks selling software / hardware cracking tools getting indicted.

There's also this really interesting story:

https://www.wired.com/2013/03/alfred-anaya/

Dude caught serious prison time just for making hidden compartments in cars and they put him away based on the fact that he knew his customers where in the drug business.

Selling high impact 0days definitely seems like a risky business IMO.

Not if you're selling to the agencies, it's a completely different playing field and the money is much more available.

Selling to agencies doesn't make you less of an arms dealer. It's up to you if you're ok with that or not.

Reply on news.ycombinator.com