Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to make a living (say $75k+ a year) finding and selling vulnerabilities? It doesn't matter (for the sake of this question) whether it means selling purely to a bug bounty program or through a broker.

Thank you.

share|improve this question

closed as primarily opinion-based by TildalWave, Adi, AviD Aug 19 '13 at 23:30

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

While many security-defeating questions on here are for the purposes of learning how to guard a system, I'm not sure if I see the goodness of this question...what beneficial purpose is this serving? – Katana314 Aug 19 '13 at 21:35
Answers would be opinion-based as it's not a legal job. – e-sushi Aug 19 '13 at 21:56
@e-sushi That’s actually an interesting question: isn’t it legal? Are you sure? If so, why isn’t it legal? I agree that it’s deeply immoral. But I’m having a hard time to see where it contravenes the law. – Konrad Rudolph Aug 12 '15 at 10:39
@KonradRudolph Well, just ask an average arms dealer how his/her job worked out in the end. – e-sushi Aug 12 '15 at 11:12
@e-sushi Not sure I get this: arms sale is a legal, blooming, billions-dollar business. So I’m guessing it worked out incredibly well for them. And unlike sale of exploits it is heavily regulated: I could, without much effort, point you to the relevant laws regulating arms sale. I know of no such laws concerning the sale of exploits. – Konrad Rudolph Aug 12 '15 at 11:57

Is it possible? Of course it's possible. It's also quite possible for you to make a living by regularly discovering new and novel cures to common diseases.

On the other hand, if you're asking whether or not it's likely that you will make a living by discovering exploits one after another, let's start with this: How many have you discovered so far? How much have you made in bounties off the bugs you've discovered? How much time and research has it taken you to discover each one? Judging by your current discovery rate and your income so far, how much do you expect to make by devoting your efforts full-time to this endeavor? If the answer to that question is $0, then I would recommend an alternate career path.

share|improve this answer

Only you can answer that question. What is your track record at analyzing software for flaws? How many do you find a week? Compare that to the payouts that you've seen, such as pwn2own, or Microsoft's bug bounty programs? Bottom line: if you aren't already doing it, that's your answer.

Another thing to consider is the risk: companies are under no obligation to continue to pay for bugs, so it's never going to be a guaranteed income. And once Chip and PIN fully rolls out across the globe it might make stealing credit card numbers worthless, meaning fewer criminals with less need for 0days, meaning the prices would go down.

And there's also the ethics of selling 0days to the black market - you would be placing yourself at risk of arrest. It doesn't matter if you think it's legal, if a random armchair lawyer on stackexchange thinks it's legal, or if the EFF thinks it's legal. Some politician might simply decide to make it illegal. Some cybercop might re-interpret the laws to fit their situation and drag you into court anyway. Or some other country might think it's illegal and request your extradition.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.