Juergen Marester, a 24-year-old French network consultant, needed seed capital to start his own computer-security company. So he turned to his off-hours hobby -- black-hat hacking -- and did what a growing number of hackers are doing: selling "odays". These are recipes and code for penetrating the software run by governments, result in minor disruptions such as a Web site's temporary paralysis. At their extreme, they grant an attacker total control over a network. According to the Electronic Frontier Foundation, it isn't illegal to offer vulnerabilities (the holes in software) and exploits (the code that does the actual penetration) for sale. What's different about Marester's case is that the seller worked for one of the companies whose code he promised to compromise. According to the consultant who snared Marester, his quarry's skills appear quite sophisticated. His wares, If they performed as advertised, could help a hacker take down machines running that particular software anywhere in the world.