The legitimate vulnerability market: the secretive world of 0-day exploit sales

Trading of 0-day computer exploits between hackers has been taking place for as long as computer exploits have existed. A black market for these exploits has developed around their illegal
use. Recently, a trend has developed toward buying and selling these exploits as a source of
legitimate income for security researchers. However, this emerging “0-day market” has some
unique aspects that make this particularly difficult to accomplish in a fair manner. These problems, along with possible solutions will be discussed. These issues will be illustrated by following two case studies of attempted sales of 0-day exploits.