#HITB2021AMS HATS: Ask Me Anything with Andrea Zapparoli Manzoni from Crowdfense

### Overview In this 'Ask Me Anything' session at HITB2021AMS HATS, Andrea Zapparoli Manzoni, representing Crowdfense, discusses the operational realities, market dynamics, and ethical risk management involved in vulnerability brokerage and the zero-day market. The discussion touches upon how remote work and the pandemic affected exploit submissions, shifting target attack surfaces, operational lifecycle and acquisition procedures, and the pressing need for a standardized multi-dimensional risk framework across the offensive cybersecurity industry.

### Key Topics - **Impact of Remote Work & Platform Operations:** Crowdfense experienced business continuity through its Vulnerability Research Hub (VRH). Despite the inability to host in-person events or network at conferences, researchers working during lockdowns submitted comparable volumes of research online, though some still resort to insecure channels like WhatsApp. - **Evolving Attack Surfaces:** Major vendor platforms (such as mobile operating systems and modern desktop browsers) have significantly increased their security defenses, raising the barrier to entry for solo exploit authors. In contrast, IoT, SCADA, IP cameras, and SOHO networking gear remain heavily insecure. While Crowdfense primarily services law enforcement and intelligence gathering (excluding cyber weapons and industrial sabotage), interest in embedded devices is emerging where relevant to field intelligence. - **Vulnerability Acquisition & Evaluation Lifecycle:** Crowdfense evaluates functional attributes, coverage, and reliability without requiring full upfront exploit code disclosure. Because reliability is paramount, fewer than 5% of submissions typically make it to operational field deployment. Crowdfense provides advance payments to review and test code, assuming the risk if an exploit burns or is patched during or shortly after acquisition. - **Shelf Life & Market Metrics:** Reflecting on Crowdfense's 2019 catalog, 93 out of 125 intelligence-grade exploits remained unpatched zero-days by the end of that year. Long shelf lives reduce customer incentives to stockpile exploits. - **Ethics, Integrators, and Risk Assessment:** Crowdfense strictly avoids selling to third-party integrators or intermediaries to maintain direct visibility over end-users. Manzoni argues that technical scoring systems like CVSS fail to capture broader societal, physical, and human risks. He advocates for an industry-wide, multi-dimensional risk assessment framework based on self-regulation.

### Technical Details - **Submission Filtering:** Out of approximately 100 submissions evaluated, roughly five pass the strict filtering criteria covering edge-case stability, cross-version coverage, and low forensic artifact generation. - **Shelf Life vs. Deployment Latency:** Integrating zero-day exploits into operational government or intelligence platforms often requires a lead time of one to three weeks. If an exploit is patched within a short timeframe (e.g., automated weekly browser patching), it loses operational utility entirely, whereas slower-patched systems may retain residual utility as n-days. - **Risk Scoring Limitations:** Technical severity metrics like CVSS cannot accurately gauge real-world harm (e.g., an exploit affecting medical wearable devices versus typical software bugs).

### Takeaways - Solo exploit development for hardened platforms is becoming economically and technically difficult, driving interest into poorly secured adjacent technologies. - Brokerages must manage substantial technical and financial risks regarding patch unpredictability and exploit shelf life. - Avoiding intermediaries and establishing multi-dimensional risk scoring are necessary steps toward responsible self-regulation in the private zero-day acquisition ecosystem.