"Vulnerabilities for Sale - The Good, the Bad and the Ugly"
summary
Vulnerability markets split into responsible disclosure channels and secret brokers, with concrete consequences: $30k–$3M zero-day prices drive brokers to hoard flaws rather than notify vendors, increasing risk of wormable incidents like EternalBlue/WannaCry. Exploit kits still succeed using old Flash/IE bugs as infection rates fall 70–80%; zero-day buyers often target law‑enforcement or government customers. ZDI/ZDI-like programs paid out (up to ~$1.5M), disclosed ~1,400 flaws in 2018 and provided protections ~70 days earlier, while 158 remained unpatched at disclosure.
AI-written summary · about
chapters (9)
- 0:00Start
- 2:49PwC sends 'cease and desist' letters to researchers who found critical flaw
- 3:55DJI Rewarded Bug Bounty Discovery With Legal Threats, Developer Claims
- 5:30FireEye takes security firm to court over vulnerability disclosure
- 13:32CROWDFENSE-15M USD,Funding secured
- 17:21Missing something?
- 20:083rd Party Bug Bounty Programms
- 21:18Researcher Coverage Map
- 23:58Advisories by Vendor
related talks
36mFrom Bounties to Bureaucracy
50mSelling 0-Days to Governments and Offensive Security Companies
40mTales from the Underground: The Vulnerability Weaponization Lifecycle
39mSelling 0-Days to Governments and Offensive Security Companies
56mZero Days, Thousands of Nights: The Life & Times of Zero-Day Vulns and Their Exploits
15mThink Zero Days Are Your Your Biggest Risk - Think Again
24mHacking The 0day Market
01h 20mClosing the Digital Backdoor Strengthening Vulnerability Management to Combat Spyware