Private surveillance companies increasingly buy information about system bugs so as to crack their target's computers.