Selling zero-day exploits has a down side

Information Security can sometimes be a funny field to work in. Some days it seems as if anybody with their hands on unpublished exploit code can sell it for all they're worth, and others it seems that they are set to become the target of law enforcement and the companies the code affects. It does help if you don't work for one of the companies that is set to be affected by the exploits you are trying to sell and aren't trying to bootstrap a competing company in the process.

The ethics of selling so called zero-day exploits and vulnerabilities has been the subject of many heated arguments, ever since the hackers/researchers and the security firms realised there was a viable commercial market for them.

In terms of disclosure, it falls somewhere between responsible disclosure and irresponsible disclosure. By withholding the details of the vulnerability until after 'co-ordinated release', the discoverer and the middleman are certainly not engaging in full disclosure and with the stated intent to keep the information out of the hands of malicious hackers, it has a responsible intent but doesn't completely comply with the concept of responsible disclosure.

A major step away from responsible disclosure is when the middleman is often profiting off the information that they have been presented with - selling it to their own clients either as raw information or as protection against the undisclosed vulnerability. It also means that the discoverer usually isn't seeing the true market value for their discovery, something that the auction house run by WabiSabiLabi is seeking to redress.

Whichever side of the argument you choose to come down on, the inevitable truth is that it isn't going to go away in the near future and there will always be a black market for valuable and attractive exploits.

In the case of the hacker sellingexploits that targeted his own employer, it wasn't the smartest move of the hacker to attempt that, but it also highlights a fear that many independent hackers/researchers have - that they will be tricked into giving up their discoveries and personal information and be publicly humiliated, hounded, or pursued by law enforcement as a result. Paranoia is almost a prerequisite and the public exposure that this case has received is sure to convince some that their exploits and vulnerability discoveries are best off going elsewhere.