From Bounties to Bureaucracy
summary
Zero Day Initiative describes a vendor-agnostic bug-buying operation that purchases high-value flaws for intelligence and protection, claiming $15 million paid and ~4,000 0-days patched (over 4,500 purchases across 12 years). Data show submissions rising from under 100 to over 1,000 per quarter, buying SCADA bugs largely from Russia and even a baseband exploit from Africa, tracing gray-market pricing (exclusive exploit listings near $95,000) and demonstrating collisions with government toolkits and the effect of mitigations and export rules on researcher behavior.
AI-written summary · about
chapters (10)
- 0:00Start
- 4:07Economy in Action
- 6:14Active economy
- 9:24Lessons learned from Hacking Team
- 13:03How to buy 0-day: Vulnerability Brokers
- 23:33Browser Click-to-Play Intervention
- 23:45New Mitigations
- 25:45End of Life Announcements
- 27:29Predicting the Next
- 29:42New Regulations
related talks
50mSelling 0-Days to Governments and Offensive Security Companies
39m"Vulnerabilities for Sale - The Good, the Bad and the Ugly"
24mHacking The 0day Market
56mZero Days, Thousands of Nights: The Life & Times of Zero-Day Vulns and Their Exploits
40mTales from the Underground: The Vulnerability Weaponization Lifecycle
39mSelling 0-Days to Governments and Offensive Security Companies
45mThe Good, the Bad, and the Bounty: 10 Years of Buying Bugs at Microsoft
30mBeyond Quick Cash: Rethinking Bug Bounties for...