Hacker News Reader

Comment by edent | Hacker News Reader

> pretty sure it he could have gotten more tax free on the black market.

How?

I've been paid by bug bounties (although not that big) and I have no idea how I would find a trustworthy criminal to sell to.

I guess I'd need to find a forum? Unless my opsec is exemplary then I'm risking being exposed. I'd need to vet that the buyer would actually pay me and not just steal it from me. Even if they do pay me, I'd be worried that they'd blackmail me or try to extract something from me. But assuming they're good black-marketeers, I still have to explain to the authorities where this large amount of cash came from.

So how do I go about selling to the black market in a safe way?

Oh, and I don't get to write a blog post about the bug or get my name in front of other researchers and recruiters. That can be worth a huge amount - both in cash and reputation.

View on HN

Mostly the best market is intelligence agency vendors. As a US citizen, I would only be comfortable selling to US contractors. There are a bunch; if you go to conferences you probably meet the people there (look at the sponsors...).

It won't be tax-free, though; you'd probably get a 1099, but if you're smart could set it up as corp to corp and deduct a bunch of other expenses from it. Part of the sale is signing a bunch of NDAs, etc so you can't then release it to others.

How does https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act play into that?

Off the cuff, I'd guess that any official documentation would be around the sale of "research" and not "an exploit". Depending how classy the buyer was about it, there might or might not be an offline wink and nudge.

Selling exploits doesn't inherently violate the CFAA.

The CFAA makes it illegal to exceed authorized access to any 'protected computer' (in practice, basically any computer).

The exploit developer avoids violating the CFAA by developing the exploit on their own computer... because you are authorized to access your own computer.

The government doesn't violate the CFAA when using exploits because government agencies are exempt under 18 USC § 1030 (f)

Not a lawyer, do pay a lot of attention to this area for professional reasons. Answer: it doesn't, unless you (1) found the vulnerability through methods that themselves violate CFAA (for instance, by breaking into a remote computer), or (2) sold information about the vulnerability knowing that it would be used for a particular set of crimes, in which case you can get accomplice liability for those crimes.

CFAA doesn't have anything to say about vulnerability research itself. You'd be just as liable as an accomplice if you knowingly and deliberately provided free wi-fi to a hacker.

>Mostly the best market is intelligence agency vendors.

That makes me wonder - may be the original bug was really a backdoor created as a result of a deal with an intelligence agency/vendor. So, can it be that Google gets money (or more generally some kind of browny points; also interesting aspect - giving that the agencies may exploit individual engineers, it would seem to be more preferable for the company to play ball and have it organized under the company's control) for a backdoor, and once backdoor is found - pays the bug bounty. The bug bounty is thus a kind of backdoor quality control program :)

> How

There are companies that specialize in getting grey market bugs in important software, ie browsers and OSes. They are repwat players and have a reputation to actually pay out.

OK. But how do I find them? And, again, how do I assess their reputation and likelihood of paying me.

How much of a premium are they paying to make it worthwhile?

And do those companies facilitate black market transactions that would be tax-free?

I would consider it a deferred tax. You pay iff you are caught by the tax man with interest (and a potential bonus of a tax free holiday in a state sponsored facility). Better arrangements may be available if you are rich enough so you can get experts to arrange your taxes being legally deferred effectively after you died.

It’s another wrinkle GP didn’t get to. If you are paid, how to launder the money? Presumably you’d get a shiesty lawyer to buy you a nail salon ala breaking bad.

If you need all that spelled out it's probably not a market for you.

You can find some by researching. AIUI most intros are via personal connections. I'd be wary of the potential ethical implications. There is more than money to life.

Which, basically, is their whole point.

Have an established track record of finding high quality bugs and network with people in that space and you'll eventually get introduced to the right people.

I mean you just search on google... Zerodium, Crowdfense, Exodus Intelligence, etc.

Sure, I'd say the "sell it elsewhere" stuff is always a bit overly optimistic but due to the nature of this specific exploit I am pretty sure you could find a buyer offering good compensation.

Does Zerodium even exist anymore? The impression I have is that people seriously selling clientsides weren't going through any firm a typical message board thread would be talking about.

Just search for vulnerability or 0day acquisition platforms and do some research into the companies. All of them are kinda shady but there are some which only sell to Five Eyes if you want to be “moral”

You can also go through ZDI (owned by Trend Micro), but the payout will be lower. It’s in Trend Micro’s interest so they can get ahead in detections.

I can't answer your question, but one of the ways trust works is you share the vuln with an escrow person, which I think is someone on the forum with very high rep. They take the vuln from you, confirm it works, and ensure that you get paid from the end buyer.

From what I understand, they generally require complete reliable exploits. I don't think they generally buy proofs of concept, or exploits that only work some percent of the time. This specific exploit worked 80% of the time, which I'm not sure is good enough for them.

Yes, maybe the exploit could likely be modified to be more reliable. That's more work though.

You'll probably end up with 40 subscriptions to Vibe magazine.

The black market is "if you have to ask then you are already not qualified"

unless you are an agent posing questions to get people to sink themselves.

Thats what trusted middle men are for, instead of gaining rep among infosec posers on twitter you build rep under your anonymous alias. This is nothing new.

Or just sell it to the israelis.

Bahah, best description of the anime avatar people

> a trustworthy criminal

Not going to happen.

You know most criminal enterprises are based pretty much solely on trust right? Like that is how a lot of crime gets done

'There is no honor amongst thieves' is a proverb for a reason. Case in point, my nephew, who got shot at point blank range (from behind, no less) by his 'best friend'. Criminals trust each other just long enough until there is a way to get ahead at the expense of the other.

Between 'calculative trust' and 'personality based trust' there are many poles (and other varieties of trust besides), on the whole you're much better of trusting a non-criminal than a criminal.

Reply on news.ycombinator.com