Slashdot Mirror
Exploit Vendor Zerodium Puts $100,000 Bounty On Flash's New Security Feature (softpedia.com)
An anonymous reader writes: Zerodium, the company that buys zero-day bugs from security researchers and then sells them forward to government intelligence agencies, has put out a new bounty, this one on Adobe's Flash Player. The exploit vendor is offering $100,000 to the first researcher that finds a similar zero-day bug, capable of avoiding Flash's newly-released isolated heap memory protection feature. Previously, Zerodium offered $1 million to a security researcher for a zero-day bug in Apple's iOS 9 operating system.
How would their boss know?
File under 'M' for 'Manic ranting'
Does it matter which one?
File under 'M' for 'Manic ranting'
The most value from such an exploit...
... would be being able to accumulate a list of the users stupid enough to still have Flash installed! (Or allowing it to be run indiscriminately))
(If you do have it, please use a flash blocker, so that you then only click on the button to run the flash on trusted sites.)
First of all, their boss would have no way to know what an employee can or cannot afford.... at least not legally.
Secondly, not all people who would commit such an act are dumb enough to publicly flaunt illicitly acquired wealth.
File under 'M' for 'Manic ranting'
That only leaves the gaping hole that is the browser's enabled javascript engine..
... in Flash that compromises security... they would be bankrupt within a week!
With all the security holes in Flash these days, I dont get why browsers haven't made "click to play" for flash videos the default. No flash videos would run unless you activated them.
For all the ridiculous arms export regulations around encryption historically, this actually seems much more like serious arms sales. Explicitly selling vulnerabilities, other than in a bug bounty program, is organized crime.
Actually, yes I have. But how many people I have met is irrelevant to the veracity of my statement. If all people were truly that dumb, then there would be no such thing as an unsolved crime because nobody would be smart enough to get away with doing anything illegal.
File under 'M' for 'Manic ranting'
Pretty sure they pocket at least 5-10x that $100k for every sale they make to a governmental organization...
Quo usque tandem abutere, Nimbus, patientia nostra?
1+ for that suggestion. Remove the issue and enjoy the internet :)
All the documents released or made public seem to show a huge trade in and demand for access into different OS.
Stop using one of the sold and traded ways into modern OS's.
Domestic spying is now "Benign Information Gathering"
So.... yes? Okay, too bad. I'm pretty sure somebody could have claimed the hundred otherwise.
File under 'M' for 'Manic ranting'
Give it up. Nobody is having sex with you, bounty or not.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
If all people were truly that dumb, then there would be no such thing as an unsolved crime because nobody would be smart enough to get away with doing anything illegal.
What makes you think unsolved crimes are people getting away with things because they are smart?
Perhaps they just got lucky, and the investigators missed or accidentally spoiled evidence that was sitting right in front of them.
Also, perhaps they got away with it, because the team investigating their particular crime was so dumb and incompetent, and failed to investigate things they should, and/or lazy, because they reported the right lead as ruled out (based on fallacious thinking).
This is like their "we paid out (pinky in mouth) $1 million for an Apple iOS 9.1 bug".
http://www.theinquirer.net/inquirer/news/2433087/zerodium-pays-out-usd1m-for-ios-91-untethered-jailbreak
Except there's no evidence they did, but it was handy marketing for them. If they had, Apple could sue them and obtain the bug details (and $$$ in compensation) on a "tortuous interference in business" claim.
So take it with a pinch of salt.
Perhaps.... and while it is doubtlesss fair to acknowledge the existence of such incompetence, I believe it is gross underestimation of other people to assume that most who work at a technical company like Adobe are certain to be too clueless to realize that publicly flaunting wealth that might get a person in trouble with their boss is unwise.
That level of intellectual vacuity is what you'd expect from a fictional character in a comedic situation where the audience or reader is expected to laugh at the character's outlandish stupidity behind the character's choices more than it is a realistic expectation of an actual member of society. While I won't dismiss that it's certainly possible... but I wouldn't expect it to be particularly likely.
Please note, Gus Gorman from Superman 3 is *NOT* a typical example of an individual that pulls in a salary like that of an average Adobe employee.
File under 'M' for 'Manic ranting'
Secondly, not all people who would commit such an act are dumb enough to publicly flaunt illicitly acquired wealth.
But some are. This just happened yesterday:
A police spokesman said the two suspected Dutch traffickers - arrested at stunning five-star Santiago de Compostela hotel Hostal Dos Reis Catolicos on the city’s famous Obradoiro Square - had drawn attention to themselves by “throwing 500 euro notes around as if they were water.”
open chrome://plugins/ and disable it?
But in that situation, don't your beards act like some kind of velcro?
Pay my wife? She'd love it....
(rimshot)