The market for brokering zero day exploits is a hot one. In the last three or four months this industry has taken off quite a bit. There have been many articles on major publications written about the brokering of exploits and zero day attacks (http://www.itsupportquotes.com/exploitsales/) and this market is spread across private companies, Government agencies from a handful of countries and even to malicious intent organizations and spy / espionage units.
This buying and selling of exploit activity has been going on for a while, but more companies are entering the marketplace. Because of the international presence of this marketplace there really isn’t much capability for any one Government or entity to monitor or police this trafficking. There is a great deal of money in this marketplace and one can hope that the companies and agencies that have good intent when buying the exploits are the ones that also are capable of offering the selling party the most money or the highest bid.
As this exploit marketplace matures there may be a way for Government entities to hold accountable the selling party for damages that are done from the sale of the attack. If this is the case, then I think we will see a strict policy from the sellers to sell exclusively to Gov agencies. That’s really the only hope right now that this type of marketplace will be used more for good than for bad.
