4 ms·

This is purely market value. If iOS simply had less users, the price would be lower. So I think your conclusion of it being more secure because of this is incor

This is purely market value. If iOS simply had less users, the price would be lower. So I think your conclusion of it being more secure because of this is incorrect. About less people being able to afford it - this again depends on what ZERODIUM intends to do with it. They may sell it for cheap and count on a large number of sales because, again, iOS is so popular.

xoail 11y ago
I disagree. Less users also mean low price for bounty since the media is not paying attention. It is a fair conclusion that a reward as big as $1M is imposed since it has been proven (so far) that iOS platform is quite secure.
stirlo 11y ago
Yeah I was suggesting this may even be below market value as selling to Vupen is probably considered more acceptable than selling on the black market for a likely even higher price. With regards to users flash player has more users than iOS but the exploit was cheaper, while these users might not be as valuable as iOS users neither market is what you would consider small. And finally it's unlikely they would sell it to mass users for extremely cheap and risk it leaking. It's probably more out of desperation, Vupen has heaps of long term customers who they have promised the ability to hack phones to, it's probably embarrassing to them if they can't hack them most popular phone model out there.
w23j 11y ago
Hacking Team: a zero-day market case study [1] seems to support the idea that iOS exploits are scarce. Especially compared to Android (when using your "less users" perspective). "Mobile: VUPEN offered several different remote code execution and local privilege escalation exploits for Android; however, not all of them were 0day and Hacking Team deemed that the prices were too high to purchase. Though there was interest in purchasing exploits for iOS, VUPEN said they were limited to certain customers, presumably high-paying government agencies." [1] "iOS exploit pricing: Adriel stated he was supply-constrained for iOS RCE exploits because exploit developers frequently had their own connections to sell them, and that he believed that such exploits were overpriced. An exclusive exploit sale could cost over a million dollars, [...]." [1] [1] https://news.ycombinator.com/item?id=9949818 https://news.ycombinator.com/item?id=9949818
jgome 11y ago
Did you read the announcement? > Apple iOS, like all operating system, is often affected by critical security vulnerabilities, however due to the increasing number of security improvements and the effectiveness of exploit mitigations in place, Apple's iOS is currently the most secure mobile OS. But don't be fooled, secure does not mean unbreakable, it just means that iOS has currently the highest cost and complexity of vulnerability exploitation and here's where the Million Dollar iOS 9 Bug Bounty comes into play. BTW, I guess Flash is as popular as iOS9 (the Steam hardware survey used to show that 99.9% of the Steam users had Flash installed), yet, as stirlo says, they only paid up to $30k for Flash exploits.
- MatekCopatek 11y ago
  I was replying to stirlo's deduction, which I felt was wrong, not the original announcement. You do make a great point with that Flash comparison, though.

xoail 11y ago

I disagree. Less users also mean low price for bounty since the media is not paying attention. It is a fair conclusion that a reward as big as $1M is imposed since it has been proven (so far) that iOS platform is quite secure.

stirlo 11y ago

Yeah I was suggesting this may even be below market value as selling to Vupen is probably considered more acceptable than selling on the black market for a likely even higher price. With regards to users flash player has more users than iOS but the exploit was cheaper, while these users might not be as valuable as iOS users neither market is what you would consider small. And finally it's unlikely they would sell it to mass users for extremely cheap and risk it leaking. It's probably more out of desperation, Vupen has heaps of long term customers who they have promised the ability to hack phones to, it's probably embarrassing to them if they can't hack them most popular phone model out there.

w23j 11y ago

Hacking Team: a zero-day market case study [1] seems to support the idea that iOS exploits are scarce. Especially compared to Android (when using your "less users" perspective). "Mobile: VUPEN offered several different remote code execution and local privilege escalation exploits for Android; however, not all of them were 0day and Hacking Team deemed that the prices were too high to purchase. Though there was interest in purchasing exploits for iOS, VUPEN said they were limited to certain customers, presumably high-paying government agencies." [1] "iOS exploit pricing: Adriel stated he was supply-constrained for iOS RCE exploits because exploit developers frequently had their own connections to sell them, and that he believed that such exploits were overpriced. An exclusive exploit sale could cost over a million dollars, [...]." [1] [1] https://news.ycombinator.com/item?id=9949818 https://news.ycombinator.com/item?id=9949818

jgome 11y ago

Did you read the announcement? > Apple iOS, like all operating system, is often affected by critical security vulnerabilities, however due to the increasing number of security improvements and the effectiveness of exploit mitigations in place, Apple's iOS is currently the most secure mobile OS. But don't be fooled, secure does not mean unbreakable, it just means that iOS has currently the highest cost and complexity of vulnerability exploitation and here's where the Million Dollar iOS 9 Bug Bounty comes into play. BTW, I guess Flash is as popular as iOS9 (the Steam hardware survey used to show that 99.9% of the Steam users had Flash installed), yet, as stirlo says, they only paid up to $30k for Flash exploits.

MatekCopatek 11y ago
I was replying to stirlo's deduction, which I felt was wrong, not the original announcement. You do make a great point with that Flash comparison, though.