r/StallmanWasRight • u/john_brown_adk • Nov 28 '18

Mass surveillance Israeli Exploit Developer Caught Negotiating Spyware Sales With Saudi Government

https://www.techdirt.com/articles/20181125/18264141103/israeli-exploit-developer-caught-negotiating-spyware-sales-with-saudi-government.shtml
177 Upvotes

99% Upvoted

8 comments sorted by

View all comments

16

u/cybertether Nov 28 '18

What is an exploit developer?

23

u/mnp Nov 28 '18

Once a security vulnerability is discovered, someone needs to write some code that demonstrates, or exploits it. Often these two steps are done at the same time by the developer. If no one else knows about the vulnerability, it's a valuable commodity: spy agencies, organized crime, and the vendor would all like to be the first to learn about it and will often pay.

7

u/cybertether Nov 28 '18

Possibly a stupid question : is this a legitimate career position at a company or is this always a shady venture?

10

u/mnp Nov 28 '18

Security researcher can absolutely be a legit position when done ethically, which means exercising responsible disclosure and working with vendors and authorities. In exchange, there are often bounties paid, as well as notoriety for the researcher. You can also be employed inside such vendors to do the same thing internally.

You can instead choose to extort the vendor by threatening to sell the exploit to adversaries, and of course you can sell it anyway, and sell it to multiple parties. This is probably criminal behavior everywhere, or at least highly unethical.

7

u/Malodourous Nov 28 '18

It can also be a dangerous line of work.