Recently, there have indeed been some arrests for computer attacks that capitalized on Microsoft software flaws.
For companies, the best strategy for finding software flaws is just as unsettled.
"Of course it concerns us," Mark Miller, director of the Microsoft Security Response Center, said of the online bazaar in software flaws, which it has declined to enter.
NSA hackers could probably work with its defenders on where to look for software flaws, or how to model enemy behavior, former US officials said.
As a compromise, the White House in 2014 announced a review board that would look at the severity of such software flaws government investigators wanted to keep secret.
In 2002, iDefense Labs became one of the first companies to pay for software flaws, offering just a few hundred dollars for a vulnerability.
Majia and his fellow hackers keep secret their knowledge of certain so-called zero-day vulnerabilities — software flaws — for future use, he says.
Toyota recalled the vehicles to repair gas pedals that could jam or get caught in floor mats and to fix software flaws in its high-technology braking systems.
