Volume discounts are possible if you take several bugs. Exclusive sales are possible but the price will grow in 3 times. Internally, Hacking Team decided it was only interested in one of them, an Adobe Flash exploit.Īll prices in the list are non-exclusive. Tovis responded that he had “six ready-to-delivery exploits,” for Windows, OS X, and iOS, each priced at $30,000 to $45,000. The e-mail contained no identifying information about its sender except for the e-mail address: Hacking Team response, direct from CEO David Vincenzetti, came within 24 hours: Hi, is your company interested in buying zero-day vulnerabilities with RCE exploits for the latest versions of Flash Player, Silverlight, Java, Safari?Īll exploits allow to embed and remote execute custom payloads and demonstrate modern techniques for bypassing ASLR and DEP -like protections on Windows, OS X, and iOS without using of unreliable ROP and heap sprays. The Moscow vendor’s first e-mail, dated October 13, 2013, was short and to the point:
The chain of e-mails that follow offer a rare look into exactly how new security vulnerabilities get sold to companies and governments around the globe.
You can go from initial, unsolicited message to getting paid tens of thousands of dollars in just a matter of weeks.Īfter Hacking Team, the Italian spyware vendor, was itself hacked and 400GB of its internal data released onto BitTorrent, Ars reviewed internal e-mails from the company.
Further Reading Adobe Flash exploit that was leaked by Hacking Team goes wild patch now!If you’re a Moscow-based zero-day exploit seller, all you have to do is e-mail a spyware company like Hacking Team out of the blue.