13

Yes, it means that in the exploit market that kind of exploit can be sold and bought for something in that range (e.g. $25k-$50k). That website doesn't specifically talk about black market: The ongoing observation of the exploit market structure helps to collect current prices. but, if you don't report vulnerabilities to bug bounties, the market you'll ...


11

Here are several steps you could take to encourage security researchers to disclose vulnerabilities to you: Waive liability. Promise not to sue researchers who disclose vulnerabilities to you in a responsible fashion. Currently, many researchers report worrying that reporting a vulnerability to a company could get them sued, and so sometimes they just don'...


8

You can Make a Responsible Disclosure with ZDI (Zero day Initiative), They are well known for their work and you have a good opportunity to earn some money depending on how strong exploits can be plotted upon the vulnerability you have found. Many security experts submit CVE's to ZDI, Its legal and secured in case you are afraid of company to sue you. ...


7

I think the most likely outcome would be delayed patches to fixes at the behest of friendly governments. Consider: Deliberately introducing flaws is not an easy thing. Anyone from the organization could look at the code and see the flaw - so the details might leak. Continuing point one, if the flaw causes an issue for customers, that would be bad rep for ...


6

There are a variety of approaches to promote the discovery and fixing of software vulnerabilities. The most common ways to provide compensation to researchers are bug bounties (run by vendors) and vulnerability brokers (who buy and sell information on vulnerabilities applicable to popular software). These are well described in A Comparison of Market ...


6

The ethical approach is to report, confidentially, and to not combine the reporting with a request for payment to fix it, which could be seen as extortion. Explain how you found the problem, and possibly include steps to remedy what you found, but leave the fixing to them. As a Security Manager for an insurance company, I can tell you that I would be ...


4

Although the question can be seen as subjective (I agree with that and suspect that you will be flagged) there is a very objective answer: "ask the software owner how they would like disclosure managed." If they are a reputable organization they will have a formal disclosure procedure to follow, so follow it. In most cases this involves submitting a CVE ...


4

One of the methods you can use to create a baseline would be to go to sites like PacketStorm find say the last 50 vulnerabilities/exploits disclosed, then find out whether or not they have CVEs issued on Mitre. A baseline will give you just that, a baseline average. There are a few things to take into considerations: Not all exploits/vulnerabilities are ...


4

Yes, I know of a few, but companies will not be public in their efforts to search for and purchase 0-days because: 1) if publicly known, it would increase the price, and 2) it creates a greater demand, which means greater incentive for attackers to hunt for 0-days, which increases the risks for the company. That's why they use Bug Bounty programs instead. ...


4

Not all SQL errors can be exploited, however you need to investigate why the SQL error was generated. Often it's a sign of bad input validation, even when not exploitable (by you) it should be fixed. Furthermore, in production environments, error messages should be generic and not disclose any details about the error or your system's configuration.


3

Theres a few sites you can use - I'll link a few below: News Krebs On Security Kaspersky Erata Security Packet Storm Hacker News We Live Security Vulnerabilities CVEDetails OWASP EDIT: I'll update this list with more links shortly! Updated the list to reflect @Nomad 's comment


3

Vulnerabilities, in general, exist before they are found by researchers so the number already in existence but not yet known could be very high. As for known Vulnerabilities that would constitute Zero-Days where an exploit exists but are still held privately by a few people or organizations, there is really no way to know because too many of these ...


3

ZDI, and other similar programs WILL NOT accept anything without reporting on the full vulnerability. There is no sanitizing data. You either trust them, or you don't. Sample applies for all programs listed on BugCrowd. With ZDI, this is what I found has worked best to minimize the amount of time you'd need to wait: Full detailed report of the bug Proof of ...


3

The main risk of SQL errors being displayed is that if the input is vulnerable to SQL injection, it makes life far FAR easier for an attacker. They can input bad queries and the error message will tell them the source of the problem and thus give them information about the database. If the query that is erroring can not be altered by any user input, or the ...


3

You can't form good relationship with security researchers. The first problem is within your own company. When they report a bug, employees in your company go into a denialism phase, trying to prove it's not a bug. It doesn't matter how you feel, even if you are the CEO. One reason for this is that indeed, most vulns reported by security researchers are ...


3

There are several sites that support ethical disclosure. The movement is often referred to as "No More Free Bugs" A Google search for the same brought up this list of bounty/reward sites that seem legit, of course I can't vouch for all of them... http://blog.nibblesec.org/2011/10/no-more-free-bugs-initiatives.html


2

Finding people who can get a clearance and program is going to become a priority, just like in the Aerospace/Defence industry, getting people who can do engineering and get a clearance is a priority. Dead wood people who have a clearance will have job security. Some kind of certification (of people) and "flight certification" of software will be common, ...


2

Which vulnerability scanner did you use, as I know a lot of them show up as false-positives (not exploitable but still need to be addressed as a lot of the time it can give out private information such as schema information, user information, etc). Also if you want to and is applicable, it may be an idea to run SQLMap or SQLNinja on it and see what it comes ...


2

Generally with bounty programs, the more information you can provide, the more likely they are to pay out the bounty. Unfortunately, the quality of many of the exploits submitted can be very low - for instance, I know of a bounty program for a website that frequently receives warnings that javascript was viewable in the user's web browser. So, best advice ...


2

Exactly what it sounds like - it's the estimated price for an exploit of this kind. Generally a zero-day exploit (e.g. unpatched, and ideally exclusive to buyer), but not always (there is still a small market for patched bugs, where the target is known not to patch in a timely fashion). There are various "black market" sites offering exploits for sale, so ...


1

Seeing as you work at an infosec company, one word; prestige. Blog posts about discovered vulnerabilities are gold in the sphere of commercial information security. The root cause analysis gives the company the ability to showcase their expertise in one of the most respected areas of the field. Also, as someone who has found a few inconsequential CVE's, I'...


1

Honestly it really depends on the company. Every company handles their vulnerabilities differently, even some researchers who follow the process get screwed by it, just like this guy who filed a bug for Instagram. For those entered through the bug bounty program (if they have one), they will generally publish the information on their site or email to the ...


1

There is no guaranteed safe solution for dealing with found vulnerabilities. There have been recent cases where researchers have been threatened with prosecution simply for reporting a simple URL vulnerability to a bank. The bank accused them of hacking, because it was a violation of their TOS to attempt to manipulate their URL. They are under no obligation ...


1

Use the company's "about" page or "contact us" to reach out to the right person. Also try emailing abuse@company.com, support@company.com, webmaster@company.com or postmaster@company.com You could also check the company's whois page, or do an ARIN lookup and email that contact


Only top voted, non community-wiki answers of a minimum length are eligible