5 ms·

Nobody’s phone is really that secure... but an iPhone vulnerability costs more than an average Bay Area house, while an Android vulnerability is more like the c

Nobody’s phone is really that secure... but an iPhone vulnerability costs more than an average Bay Area house, while an Android vulnerability is more like the cost of cleaning that house once. Edit: turns out the figure for an Android vulnerability is off by several orders of magnitude. What a garbage article!

dman 8y ago
Any stats/references to back that up? And does this extend to first party devices from Google as well?
- ikeboy 8y ago
  It's in TFA
  - dman 8y ago
    I was hoping to see if there are stats which show a variance in bounties for various Android phone manufacturers.
aaronharnly 8y ago
The article (which says in 2016 Zerodium offered up to $1.5 million for an iOS zero day and only $200 for android) seems to have a typo. The source it links to [1] quotes $1.5 million for iOS and $200,000 for Android, which makes more intuitive sense. Going to Zerodium itself [2] shows the same (in their rather weird little chart[3] at the bottom): They’ll pay up to $1.5million for a zero-click iOS remote jailbreak, and $200,000 for an Android Chrome RCE with sandbox escape. [1] https://arstechnica.com/information-technology/2016/09/1-5-million-bounty-for-iphone-exploits-is-sure-to-bolster-supply-of-0days/ https://arstechnica.com/information-technology/2016/09/1-5-m... [2] https://zerodium.com/program.html https://zerodium.com/program.html [3] https://zerodium.com/images/zerodium_prices_mobiles.png https://zerodium.com/images/zerodium_prices_mobiles.png
- mikeash 8y ago
  Thanks. What a horrible typo.
lupire 8y ago
Consider deleting your false statement, now that aaronharnly has posted a correction.
- mikeash 8y ago
  Better to draw attention to the fact that the article is making that false statement. I added an edit.
- colejohnson66 8y ago
  You can’t delete comments once there’s a reply
blattimwind 8y ago
It's just a missing "k".
tonyztan 8y ago
Google also has a bug bounty program for Pixels, paying up to $200,000. https://www.google.com/about/appsecurity/android-rewards/ https://www.google.com/about/appsecurity/android-rewards/

dman 8y ago

Any stats/references to back that up? And does this extend to first party devices from Google as well?

ikeboy 8y ago
It's in TFA
- dman 8y ago
  I was hoping to see if there are stats which show a variance in bounties for various Android phone manufacturers.

aaronharnly 8y ago

The article (which says in 2016 Zerodium offered up to $1.5 million for an iOS zero day and only $200 for android) seems to have a typo. The source it links to [1] quotes $1.5 million for iOS and $200,000 for Android, which makes more intuitive sense. Going to Zerodium itself [2] shows the same (in their rather weird little chart[3] at the bottom): They’ll pay up to $1.5million for a zero-click iOS remote jailbreak, and $200,000 for an Android Chrome RCE with sandbox escape. [1] https://arstechnica.com/information-technology/2016/09/1-5-million-bounty-for-iphone-exploits-is-sure-to-bolster-supply-of-0days/ https://arstechnica.com/information-technology/2016/09/1-5-m... [2] https://zerodium.com/program.html https://zerodium.com/program.html [3] https://zerodium.com/images/zerodium_prices_mobiles.png https://zerodium.com/images/zerodium_prices_mobiles.png

mikeash 8y ago
Thanks. What a horrible typo.

lupire 8y ago

Consider deleting your false statement, now that aaronharnly has posted a correction.

mikeash 8y ago
Better to draw attention to the fact that the article is making that false statement. I added an edit.
colejohnson66 8y ago
You can’t delete comments once there’s a reply

blattimwind 8y ago

It's just a missing "k".

tonyztan 8y ago

Google also has a bug bounty program for Pixels, paying up to $200,000. https://www.google.com/about/appsecurity/android-rewards/ https://www.google.com/about/appsecurity/android-rewards/