Eliciting Information on the Vulnerability Black Market from Interviews

Threats to computing prompted by software vulnerabilities are abundant and costly for those affected. Adding to this problem is the emerging vulnerability black markets (VBMs), since they become places to trade malware and exploits. VBMs are discussed based on information derived from interviews with security researchers. The effort is enriched by further examination of documents surrounding the disclosure of four selected vulnerabilities cases. The result suggests that the VBMs is bifurcated into two distinct parts; the skilled-hacker and the script-kiddie VBMs with a possible link between them, where the latter become places to sell malware or exploit kits after the zero day vulnerability have circulated through several hands and might have decreasing value.