4 ms·

What is the business model of this company? Are they selling such exploits to whoever is willing to pay the most? And does this mean Android is more secure?

newacct583 6y ago
If you take the press release at face value, it means Android has fewer newly-discovered vulnerabilities on the open market right now. That's probably good news for Android, but there are alternative explanations too: maybe Google is paying more for their exploits to keep them hidden, for example. Or maybe Zerodium is trying to get Apple to sign a new/bigger contract and applying pressure. This is all, indeed, a pretty shady business. I don't think there's anything authoritative we can say from the outside.
- softwarejosh 6y ago
  or maybe being closed source didnt help apple in the long run
  - whynotminot 6y ago
    Too simplistic of an answer, though it could be part of it. I think we wrap ourselves in a bit of false security when we say something is open source and think that automatically makes it more secure. We assume someone has looked at the source. But has anyone really? And those with the most incentive to look into these things might not be inclined to share the vulnerabilities back to the community for safety's sake, given the princely sums being offered by companies like Zerodium.
  - smokelegend 6y ago
    Funny how Microsoft is now saying they were "on the wrong side before" with open source. Let that sink in...
  - joemazerino 6y ago
    Apple is the device to exploit right now which drove supply. Meanwhile Google, Project Zero and companies like Copperhead are actively securing Android.
- headmelted 6y ago
  This sounds really logical to me but also raises yet more questions. How much is Zerodium charging people for these exploits if Apple isn’t paying? Sure, they could stick the knife in if Craig Federeghi calls up to ask how much, but you’d assume it’s nothing to Apple to spin up an arms-length subsidiary with a folksy name to buy the info through.
axlee 6y ago
Companies can subscribe to a feed of 0-day exploits ("Zero-Day Research Feed"), for what I assume is a hefty fee, large enough to make a profit despite millions of dollars spent on exploit acquisition.
- saltedonion 6y ago
  Their website says they mostly sell to North American and European governments. I can only assume this is for offensive purposes, since they can’t patch the kernel/software even if they know how the exploits work.
deleted 6y ago
[deleted]

newacct583 6y ago

If you take the press release at face value, it means Android has fewer newly-discovered vulnerabilities on the open market right now. That's probably good news for Android, but there are alternative explanations too: maybe Google is paying more for their exploits to keep them hidden, for example. Or maybe Zerodium is trying to get Apple to sign a new/bigger contract and applying pressure. This is all, indeed, a pretty shady business. I don't think there's anything authoritative we can say from the outside.

softwarejosh 6y ago
or maybe being closed source didnt help apple in the long run
- whynotminot 6y ago
  Too simplistic of an answer, though it could be part of it. I think we wrap ourselves in a bit of false security when we say something is open source and think that automatically makes it more secure. We assume someone has looked at the source. But has anyone really? And those with the most incentive to look into these things might not be inclined to share the vulnerabilities back to the community for safety's sake, given the princely sums being offered by companies like Zerodium.
- smokelegend 6y ago
  Funny how Microsoft is now saying they were "on the wrong side before" with open source. Let that sink in...
- joemazerino 6y ago
  Apple is the device to exploit right now which drove supply. Meanwhile Google, Project Zero and companies like Copperhead are actively securing Android.
headmelted 6y ago
This sounds really logical to me but also raises yet more questions. How much is Zerodium charging people for these exploits if Apple isn’t paying? Sure, they could stick the knife in if Craig Federeghi calls up to ask how much, but you’d assume it’s nothing to Apple to spin up an arms-length subsidiary with a folksy name to buy the info through.

axlee 6y ago

Companies can subscribe to a feed of 0-day exploits ("Zero-Day Research Feed"), for what I assume is a hefty fee, large enough to make a profit despite millions of dollars spent on exploit acquisition.

saltedonion 6y ago
Their website says they mostly sell to North American and European governments. I can only assume this is for offensive purposes, since they can’t patch the kernel/software even if they know how the exploits work.

deleted 6y ago

[deleted]