VUPEN
More info
- Creator
- Chaouki Bekrar
- Released
- 2004–2015
- Type
- Exploit broker
- Successor
- Zerodium
A French security firm from Montpellier that openly sold undisclosed vulnerabilities to governments and turned the exploit trade into an industry with a catalogue.
Chaouki Bekrar founded VUPEN in 2004. It started out as an ordinary vulnerability advisory service, then moved into buying, building and selling zero-day exploits to government customers on a subscription basis. At Pwn2Own 2012 the team broke out of Chrome's sandbox and then declined to sell the technique to Google — it was meant for clients, not for patching.
In 2013 a freedom-of-information request revealed that the NSA held a VUPEN subscription. The company wound down in 2015, the same year Bekrar launched Zerodium in the United States. The business model moved with him; only the address changed.