I suspect most whitehat researchers would be happier to report this vulnerability and make a nice legal reward, then delve into a black hat market for selling a vulnerability. Seems pretty win-win in this case.
Unless your name is Kevin Mitnick. Then you set up a business and play middlemen in selling them to anybody who wants to pony up for it.
"When we have a client that wants a zero-day vulnerability for whatever reason, we don’t ask, and in fact they wouldn’t tell us,” Mitnick tells WIRED in an interview. “Researchers find them, they sell them to us for X, we sell them to clients for Y and make the margin in between.”
Why wouldn't it be? Someone looks at a program that they bought and paid for, and sees that it has a mistake. They didn't write the software or put the mistake there. How can it be a crime for them to become aware of behavior in someone else's program?
Attacking others who use the software is an entirely different story of course.
