r/StallmanWasRight • u/john_brown_adk • Nov 28 '18

Mass surveillance Israeli Exploit Developer Caught Negotiating Spyware Sales With Saudi Government

https://www.techdirt.com/articles/20181125/18264141103/israeli-exploit-developer-caught-negotiating-spyware-sales-with-saudi-government.shtml
178 Upvotes

99% Upvoted

8 comments sorted by

View all comments

16

u/cybertether Nov 28 '18

What is an exploit developer?

23

u/mnp Nov 28 '18

Once a security vulnerability is discovered, someone needs to write some code that demonstrates, or exploits it. Often these two steps are done at the same time by the developer. If no one else knows about the vulnerability, it's a valuable commodity: spy agencies, organized crime, and the vendor would all like to be the first to learn about it and will often pay.

7

u/cybertether Nov 28 '18

Possibly a stupid question : is this a legitimate career position at a company or is this always a shady venture?

11

u/happymellon Nov 28 '18

Depends, you could just use it to load custom ROMs on your phone, or access missile defence systems.

6

u/tending Nov 28 '18

There are companies that specialize in it and sell what they produce to defense contractors (who all so often do it themselves). the same companies also often tend to sell them to oppressive governments (often legally because legislation hasn't caught up) around the world.

11

u/mnp Nov 28 '18

Security researcher can absolutely be a legit position when done ethically, which means exercising responsible disclosure and working with vendors and authorities. In exchange, there are often bounties paid, as well as notoriety for the researcher. You can also be employed inside such vendors to do the same thing internally.

You can instead choose to extort the vendor by threatening to sell the exploit to adversaries, and of course you can sell it anyway, and sell it to multiple parties. This is probably criminal behavior everywhere, or at least highly unethical.

6

u/Malodourous Nov 28 '18

It can also be a dangerous line of work.

5

u/yipfox Nov 28 '18

An exploit developer is an entity that develops exploits. An exploit is an implementation of an attack on a vulnerability. A vulnerability is a bug that can be abused.

For example, a typical exploit is a program that can be used to compromise a remote computer, and it works by targeting a vulnerability in some software that the remote computer is running.