Payouts: what's a bug actually worth these days?

Well… So far I have only studied this as a per vulnerability. As a career choice it really depends on how many bugs you can find and where.

Let me clarify that I broaden the term “Black Market” by including any non-official channels in which a researcher can submit this bug to. This could include a program buying 0days (HP ZDI, VUPEN, etc.) as well as Tor sites or 1337-Day.

To counter your drug-dealer argument, for the researcher point of view it’s just discovering and reporting vulnerabilities. The difference is to who they are reporting them at. Of course, being an ice-cream seller in a truck and a drug dealer also have similarities, you could argue. Yes, this is indeed true, but one thing is legal and the other is not. In the Exploit world, this is (yet) different. Selling bugs to anyone is perfectly legal since they are considered products (past Jan 1st). Of course there may be export controls, but these are limited to this date.

Regarding the Per Vulnerability, in the black market you get paid (as a rule of thumb) depending on how many people this bug can impact. If it is a bug in a web application that is uniquely written for a website with medium traffic, then yes, it may be worth submitting it to the vendor. If it’s not, and it’s in something generic, for example Wordpress / Joomla, then this web app bug is worth way more. If you find a bug in installable software, then the differences can be huge. For example, a year or two ago, Mozilla was offering for FireFox Sandbox Escapes and Remote Code Execution a T-Shirt. The Black Market offered some thousand dollars. People who do this because of the money seem to have no choice here… You can get the money and then buy the T-Shirts from the e-shop… :wink:

In terms of payments through official channels, an even distribution, as mentioned before, would be good to have in all programs. That’s not about me, I donate most of the money I get, but that’s about the researchers in general. You need to find a way to attract more people to submit through these programs, and for better or worse, most researchers are after the money.

One final note regarding the “Black Market”… Buyers there usually tend to have cash so if they want to buy bugs for an Exploit Pack or for a specific attack they have in mind (corporate, govt., etc.) they are not just buying one bug. They buy 10 or 20. They will usually get paid much more for their work than the cost of these bugs and they are in need of them desperately.

1 Like