Why the market for zero-day vulnerabilities on the dark web is vanishing
For years the secretive market for zero-day exploits — unpatched bugs in software or hardware — thrived in the dark corners of the internet. But vulnerability sales have been all but driven off the dark web, according to experts, and now operate in the open.
The cyber intelligence firm FireEye has only recorded three zero-day sellers on the dark web so far this year, Jared Semrau, a vulnerability and exploitation manager at the firm, told Fifth Domain. That compares to the peak of at least 32 zero-day sellers in that marketplace in 2013, Semrau said.
He explained the drop-off as being caused by a combination of “people being cautious and exploit developers selling on the dark web likely being wrapped up in arrests.” Semrau also said that manufacturers have increased their bug-bounty programs, offering payouts for hackers to report rather than reveal exploits, which has contributed to the slowdown in black-market sales.
