Hacker News Reader

Comment by zimbatm | Hacker News Reader

> They [the DEA] can also send a suspect malware, purchase a so-called zero day vulnerability to gain control of a target device and extract the contents

Made me chuckle. Given that zero day are mostly available in black markets how can they justify to give money to criminals ?

View on HN

Ever heard of Vupen?

> VUPEN Exploits for Offensive Security As the world leader in vulnerability research, VUPEN provides extremely sophisticated and government-grade exploits specifically designed for the Intelligence and LEA community to help them achieve their offensive missions using tailored and unique codes created in-house by VUPEN for exclusive and undisclosed vulnerabilities discovered by VUPEN researchers.

Access to this service is restricted to organizations from countries members or partners of NATO, ANZUS and ASEAN.

http://www.vupen.com/english/services/lea-index.php

completely legitimate company

Zero days are sold to the government by perfectly legitimate businesses, and the crap they don't buy is what ends up either in places like ZDI or eventually the black market.

Given that high-value zero days are mostly bought by governments from defense contractors and security companies.

There. Fixed that for you.

> how can they justify to give money to criminals ?

Easy: they're both criminals.

Realpolitik. Some descriptions of the zero-day "black market" imply that the government itself is one of the bigger consumers, and various arms of the government routinely bids against itself to get exploits.

You're quite misinformed. There is relatively little zero day of value on the black market, and zero day doesn't come from criminals. And it can't really, because finding a vulnerability in someone else's code, that you had nothing to do with putting there, can't be a crime.

Maybe they were already criminals before they found the vulnerability... : P

I imagine they justify it with hand-waves to law enforcement, war on drugs/terror, national security, etc.

Reply on news.ycombinator.com