4 ms·

This is the business model of the company that put out the $1m bounty on the remote iOS 9.1 and 9.2b jailbreak: Bekrar and Zerodium, as well as its predecessor

This is the business model of the company that put out the $1m bounty on the remote iOS 9.1 and 9.2b jailbreak: Bekrar and Zerodium, as well as its predecessor VUPEN, have a different business model. They offer higher rewards than what tech companies usually pay out, and keep the vulnerabilities secret, revealing them only to certain government customers, such as the NSA. Can anyone explain why iOS jailbreaking info would be worth more than $1m to the NSA? Also, isn't it weird that we are funding the government's ability to jailbreak iPhones? It's like a double slap in the face. I would imagine that Apple would be willing to pay at least $5m (~0.000025% of cash reserves) in order to buy the exploit and patch it in order to protect their image as one of the last "good guys" in the fight against government surveillance creep.

armitron 11y ago
This isn't just a jailbreak it's a remote exploit that they can use to fully compromise you, or anyone else with said iOS versions. They can do that by man-in-the-middling you while you browse away with Safari but other ways exist too.
tshtf 11y ago
Apple pays $0 for security bugs, of any severity. You probably won't even get a lousy t-shirt. They are kind enough to credit you by name on security updates.
deleted 11y ago
[deleted]
- thephyber 11y ago
  removed Parent edit destroyed the value of this comment.
- pavel_lishin 11y ago
  > So no selling to USA and it's allies. Huh? The US is sanctioned by the UN?
  - thephyber 11y ago
    A sanction may be either a permission or a restriction, depending on context, as the word is an auto-antonym. [1] https://en.wikipedia.org/wiki/Sanction https://en.wikipedia.org/wiki/Sanction
    - pavel_lishin 11y ago
      What a country!
- rrauenza 11y ago
  I think you have your "or" precedence incorrect. It is "sanctioned by the (United Nations or United States)" not "(sanctioned by the United Nations) or (United States)": From their FAQ: Researchers from most countries can participate in the ZERODIUM program, however, if you are a citizen/resident of a country listed on US/UN sanctions lists, you are ineligible to participate to the program.
Retric 11y ago
Until it’s patched you can sell the bug to more than one party. The NSA is around 15% of US intelligence budget and gets 10 billion / year so they do have plenty of money to spend. In the end it's not a question of getting 1+ million from the NSA it's a little from the NSA a little from China, Russia, and or Japan etc.
2trill2spill 11y ago
> Can anyone explain why iOS jailbreaking info would be worth more than $1m to the NSA? Jailbreaks are essentially reliable exploits, so any "jailbreak" if tweaked would also be a good way of installing malware or an implant in NSA parlance. This is also not just one vulnerability it's several, a remote vuln to get on the phone, a sandbox escape, a info leak to calculate the ALSR slide and a kernel exploit. This is a considerable amount of work, I'm guessing a month or so of fuzzing and manual testing, and 2 months to develop the jailbreak/exploits.
deleted 11y ago
[deleted]
celticninja 11y ago
iOS jailbreaking would be valuable not only to the NSA, these private companies will sell and re-sell the exploit to multiple parties. So buying it for $1m and then selling it to 5 or 6 governments or agencies at $0.5m a time results in a tidy little profit. Have a look at the Italian cybersecurity firm Hacking Team, they were routinely selling exploits or packages of exploits to governments around the world. There was no exclusivity agreement for these sales. As for apple paying as others have mentioned they dont pay bug bounties and usually these vulnerabilities are found by people jailbreaking iPhones, they are usually released for free and at that stage apple can patch the vulnerability for their next software version. I expect that this will be the end of free jailbreaks on apple products now, selling your exploit will become too valuable to release for free (at least remotely executable exploits will).

armitron 11y ago

This isn't just a jailbreak it's a remote exploit that they can use to fully compromise you, or anyone else with said iOS versions. They can do that by man-in-the-middling you while you browse away with Safari but other ways exist too.

tshtf 11y ago

Apple pays $0 for security bugs, of any severity. You probably won't even get a lousy t-shirt. They are kind enough to credit you by name on security updates.

deleted 11y ago

[deleted]

thephyber 11y ago
removed Parent edit destroyed the value of this comment.
pavel_lishin 11y ago
> So no selling to USA and it's allies. Huh? The US is sanctioned by the UN?
- thephyber 11y ago
  A sanction may be either a permission or a restriction, depending on context, as the word is an auto-antonym. [1] https://en.wikipedia.org/wiki/Sanction https://en.wikipedia.org/wiki/Sanction
  - pavel_lishin 11y ago
    What a country!
rrauenza 11y ago
I think you have your "or" precedence incorrect. It is "sanctioned by the (United Nations or United States)" not "(sanctioned by the United Nations) or (United States)": From their FAQ: Researchers from most countries can participate in the ZERODIUM program, however, if you are a citizen/resident of a country listed on US/UN sanctions lists, you are ineligible to participate to the program.

Retric 11y ago

Until it’s patched you can sell the bug to more than one party. The NSA is around 15% of US intelligence budget and gets 10 billion / year so they do have plenty of money to spend. In the end it's not a question of getting 1+ million from the NSA it's a little from the NSA a little from China, Russia, and or Japan etc.

2trill2spill 11y ago

> Can anyone explain why iOS jailbreaking info would be worth more than $1m to the NSA? Jailbreaks are essentially reliable exploits, so any "jailbreak" if tweaked would also be a good way of installing malware or an implant in NSA parlance. This is also not just one vulnerability it's several, a remote vuln to get on the phone, a sandbox escape, a info leak to calculate the ALSR slide and a kernel exploit. This is a considerable amount of work, I'm guessing a month or so of fuzzing and manual testing, and 2 months to develop the jailbreak/exploits.

deleted 11y ago

[deleted]

celticninja 11y ago

iOS jailbreaking would be valuable not only to the NSA, these private companies will sell and re-sell the exploit to multiple parties. So buying it for $1m and then selling it to 5 or 6 governments or agencies at $0.5m a time results in a tidy little profit. Have a look at the Italian cybersecurity firm Hacking Team, they were routinely selling exploits or packages of exploits to governments around the world. There was no exclusivity agreement for these sales. As for apple paying as others have mentioned they dont pay bug bounties and usually these vulnerabilities are found by people jailbreaking iPhones, they are usually released for free and at that stage apple can patch the vulnerability for their next software version. I expect that this will be the end of free jailbreaks on apple products now, selling your exploit will become too valuable to release for free (at least remotely executable exploits will).