The shady world of the vulnerability researchers who find serious security holes in software, and sell them to the highest bidder.