4 ms·

It's always interesting to read about these things. It's amazing to me how hard it is to find a bug like this. Also interesting, zerodium would pay up to $2mil

It's always interesting to read about these things. It's amazing to me how hard it is to find a bug like this. Also interesting, zerodium would pay up to $2million for something like this, and even more now on Android.

arkadiyt 7y ago
It'd be capped at $1.5 million [1] since he didn't get persistence, but still very impressive. [1]: https://zerodium.com/program.html https://zerodium.com/program.html
- OrgNet 7y ago
  > [1]: https://zerodium.com/program.html https://zerodium.com/program.html warning, scrolljacking... Firefox should really fix that bug, like they did with the "new" popups.
  - OrgNet 7y ago
    I have never seen one instance where it was beneficial to the user... some of these programmers (minority) really think that they know better
  - Thorrez 7y ago
    If you use NoScript the site is perfectly viewable and has no scrolljacking.
alpb 7y ago
What's the business model of zerodium? Do they sell them on black market somehow? Why is it able to pay $2M if they weren't going to be able to extort more bounty from Apple (which at that point the security researcher herself can go to Apple, as well?)
- jtokoph 7y ago
  This is the first I’ve heard of them but they seem to be based in DC and have government clients. I’m guessing they are funded by the US government to acquire vulnerabilities to use against targets as well as defend from being sold to other countries first.
  - alpb 7y ago
    That sounds grossly unethical. While the US somehow defends itself from being sold to other countries first (which it still might be), it probably also acquires them to attack/spy on its own citizens as there's been precedents about this, and no indication of policy change to stop it.
    - bigiain 7y ago
      > it probably also acquires them to attack/spy on its own citizens Or possibly, "to spy on foreign nationals and to share with FVEY partners - who'll do the spying on US citizens, because doing it themselves would be illegal"... :sigh:
      - lern_too_spel 7y ago
        Asking other countries spy on US citizens is also illegal. You are spreading a rumor that has no basis in fact.
    - jnwatson 7y ago
      What do you think the CIA and CyberCom do for a living? Buying vulns/exploits is just a little government outsourcing.
      - StuffedParrot 7y ago
        Ethically, comparing to the CIA is about lowest bar possible.
        deleted 7y ago
        [deleted]
- tptacek 7y ago
  Commercial vulnerability brokers don't pay out up front; they pay in monthly tranches, and stop paying when the vulnerability stops working. It's not an apples-apples comparison with bounty payouts.
  - wyxuan 7y ago
    What's the incentive to go to cellebrite rather than Apple? Cellebrite offers more but Apple does lump sum, from what I can tell.
  - Polylactic_acid 7y ago
    I guess thats what stops you selling it to multiple orgs.

arkadiyt 7y ago

It'd be capped at $1.5 million [1] since he didn't get persistence, but still very impressive. [1]: https://zerodium.com/program.html https://zerodium.com/program.html

OrgNet 7y ago
> [1]: https://zerodium.com/program.html https://zerodium.com/program.html warning, scrolljacking... Firefox should really fix that bug, like they did with the "new" popups.
- OrgNet 7y ago
  I have never seen one instance where it was beneficial to the user... some of these programmers (minority) really think that they know better
- Thorrez 7y ago
  If you use NoScript the site is perfectly viewable and has no scrolljacking.

alpb 7y ago

What's the business model of zerodium? Do they sell them on black market somehow? Why is it able to pay $2M if they weren't going to be able to extort more bounty from Apple (which at that point the security researcher herself can go to Apple, as well?)

jtokoph 7y ago
This is the first I’ve heard of them but they seem to be based in DC and have government clients. I’m guessing they are funded by the US government to acquire vulnerabilities to use against targets as well as defend from being sold to other countries first.
- alpb 7y ago
  That sounds grossly unethical. While the US somehow defends itself from being sold to other countries first (which it still might be), it probably also acquires them to attack/spy on its own citizens as there's been precedents about this, and no indication of policy change to stop it.
  - bigiain 7y ago
    > it probably also acquires them to attack/spy on its own citizens Or possibly, "to spy on foreign nationals and to share with FVEY partners - who'll do the spying on US citizens, because doing it themselves would be illegal"... :sigh:
    - lern_too_spel 7y ago
      Asking other countries spy on US citizens is also illegal. You are spreading a rumor that has no basis in fact.
  - jnwatson 7y ago
    What do you think the CIA and CyberCom do for a living? Buying vulns/exploits is just a little government outsourcing.
    - StuffedParrot 7y ago
      Ethically, comparing to the CIA is about lowest bar possible.
      - deleted 7y ago
        [deleted]
tptacek 7y ago
Commercial vulnerability brokers don't pay out up front; they pay in monthly tranches, and stop paying when the vulnerability stops working. It's not an apples-apples comparison with bounty payouts.
- wyxuan 7y ago
  What's the incentive to go to cellebrite rather than Apple? Cellebrite offers more but Apple does lump sum, from what I can tell.
- Polylactic_acid 7y ago
  I guess thats what stops you selling it to multiple orgs.