Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I was checking vuldb.com, and they state in one of the boxes:
Top vulnerabilities with the highest current exploit price of the current month. The evaluation happens multiple times per day.
What do they mean by "current exploit price"?
I think it means that in the "black market" that vulnerability could cost around that, am I right? If so, how do they measure it?
More info here: https://vuldb.com/?exploits.2016
Yes, it means that in the exploit market that kind of exploit can be sold and bought for something in that range (e.g. $25k-$50k). That website doesn't specifically talk about black market:
The ongoing observation of the exploit market structure helps to collect current prices.
but, if you don't report vulnerabilities to bug bounties, the market you'll find is somewhat gray, if not definitely black, as the legality of selling exploits to a third party is dubious.
A well-known company in this sector, Zerodium, has published its payout ranges for different types of exploits: https://zerodium.com/program.html. There is also a famous 2012 Forbes article on the topic.
It is also very likely that vuldb.com crawls black market websites, in order to find more accurate information on the prices. However, there are probably market areas which cannot be easily found, such as the three/four-letter agency market (i.e. worldwide intelligence agencies, such as the NSA). It has been speculated that prices in those areas are much higher than the ones typical of the "standard" black market.
Exactly what it sounds like - it's the estimated price for an exploit of this kind. Generally a zero-day exploit (e.g. unpatched, and ideally exclusive to buyer), but not always (there is still a small market for patched bugs, where the target is known not to patch in a timely fashion).
There are various "black market" sites offering exploits for sale, so it would be relatively easy to crawl these looking for the latest prices on a regular basis. Not all exploits are sold in this way - look at the HackingTeam emails for an example of a company developing exploits to order, until they got hacked, at least...
