Hacker News Reader

Comment by edge17 | Hacker News Reader

Is it illegal in the US to sell zero-day exploits, or to package up zero-day exploits into nice usable tools? My understanding is that it is not illegal, but something like this perhaps give the US a tool to pursue and/or prosecute individuals that engage in these types of sales when they are selling to the 'wrong' customer (the 'right' customer being NSA or other US intelligence gathering operations).

View on HN

Read the book This Is How They Tell Me the World Ends: The Cyberweapons Arms Race by Nicole Perlroth

There’s a few chapters in the beginning about the history of the exploit market. Haven’t finished it yet.

To my knowledge it’s not illegal to sell vulnerabilities. If you’re not a government contractor selling/contracting to the US government it would be illegal to sell exploit chains or working software that uses the exploits/malware what have you. The book touches on how they sold multiple of the same zero days to multiple agencies. It got to the point where one of the guys was like you (3 letter agencies) need to talk to each other and stop wasting taxpayer money.

To my knowledge, it is illegal to sell exploit kits to actors that you know are going to use the kits to commit crimes (e.g. if someone sends you an email saying "I'm looking for an exploit kit so that I can attack company X and steal their IP", you cannot legally sell to them). It is otherwise legal to sell, rent, or give away exploits to the general public or to resellers like Zerodium as long as they are not marketed as criminal tools.

For sure, but in practical terms these types of dealings often have middle men and the end buyer is often not known (by design). Everything I know is from podcasts and books, so I'm not an authority on the subject - though I would point out that the enormous amount of red tape in the west tends to be something that westerners seem to project onto the rest of the world. In much of the world, things are just far more loose.

Reply on news.ycombinator.com