Hackers earn $990k for 63 zero-days exploited at Pwn2Own Toronto (opens in new tab)

I'm active in the CTF crowd, and I think the general feeling is that you only want to burn your lower tier exploits at pwn2own. Usually these will be the exploits for things that are harder to sell to an exploit broker. You probably won't see many top tier vulnerabilities at pwn2own.

Zerodium is definitely a bit too well known to have actual market pricing for vulnerabilities, but their tier graphic is pretty accurate (https://zerodium.com/program.html). Notice how most of the things hacked at pwn2own are at the bottom of this graphic.

Selling to a exploit broker is pretty much always more profitable for higher tier exploits, and usually if you're in this industry and want to make bank you'll just work for a company like dfsec where you get bonuses for finding these kinds of exploits anyway.

What do they do with the vulnerabilities instead of going to pwn2own? If they report vulnerabilities to the manufacturer directly, how does the pay compare to the pay from pwn2own?

Going to pwn2own is probably a good way to make sure the NSA closely follows you...

I'm a professional hacker. Almost all my colleagues got started by asking a simple security question like, "How do I spy on what people are browsing on my home wifi?" Then googling the current tools for it. The next step is writing either a Python script to automate the process or contribute the GitHub of the tool you used to improve it. Less than 10% of my general colleagues (and even lower % for the best colleagues) actually go to school for security. Similar to any other IT work, like getting printers connected to a network or deploying an Active Directory domain across your company. Google it then use the tools and tutorials afforded to you. Basic networking/linux/windows/programming knowledge is usually the prerequisite, but the keyword there is, "basic".

Find out where they hang out and start picking up 'how' they work

It’s probably a lot less time consuming and risky than “going to market”. Reminds me of a panel at DEFCON this year that dealt with the fact this stuff is increasingly covered under export restrictions and a lot of the ecosystem is trust based.

Some probably don’t have connections they trust to sell to, and buyers mightn’t trust the sellers to not re-sell their exploits

"The market" is highly unethical and anyone who sells exploits there is undoubtedly a black hat.

It's not the quality, it's the quantity. We are living in a new age where everything is software driven, so naturally there will be more 0-days.

Welcome to Windows secure kernel.

https://www.microsoft.com/en-us/security/blog/2020/07/08/int...