Abner Stories

NY Times on the "Market" For Software Vulnerabilities

NY Times has an interesting piece today on the "market" for software vulnerabilities. Market is in quotes since there are a limited number of open market buyers and the vulnerability market is one of the few where the seller has to make a decision between selling to a good guy or bad guy. Layer in the used car effect where the vulnerability finder may have a better view of the capabilities of a new exploit than the buyer (assuming an exploit exists) and the vulnerability market is clearly an inefficient and scary place. Finally, vulnerabilities used to trade primarily in publicity currency, but now there are places where they can be sold, albeit not for enough to equal the average salary of a high end security researcher at any of the major IT or security vendors.