The article published by Microsoft a few months ago ago has been widely discussed. Many argue that contradictory evidence suggests conclusions different than the paper. On several levels I’d have to agree. The two most basic arguments are:
1. A sophisticated 0day or botnet platform has innate worth that’s far more valuable than data presented in the paper suggest. Having both written similar software for hire (as a pen tester) and having seen similar items sold online, I have no doubt that the report underestimates values.
2. A lemon market isn’t necessarily bad when you’re anonymous on the Internet selling virtual goods.
With the second point we begin to diverge into economic theory. I am not an economist. While I believe I can weigh economic arguements doing so would necessarily lead me astray of my strengths. However, as a Baltimore native, which has some *cough* minor criminal problems I can assure you people often buy gold at silver prices. I was admiring a co-worker’s keyboard. It sells for $150 retail. He bought it for $30, brand new, but out of the back of someone’s car.