6 ms·
Zerodium (https://zerodium.com/program.html https://zerodium.com/program.html) pays out $2 million dollars for an iOS “full chain with persistence” exploit. $50
by jtsiskin 5y ago
Zerodium (https://zerodium.com/program.html https://zerodium.com/program.html) pays out $2 million dollars for an iOS “full chain with persistence” exploit. $500k for an iMessage RCE. Up to $100k for an iOS “information disclosure” exploit (likely what this would have fallen under). Paid for via bank wire or Bitcoin/Monero/Zcash in 1 week or less. And legal.
Next time someone finds one of these, I wonder where they will report it to….
- DSingularity 5y agoIs it moral though? What do they do with these exploits? If it is to help advance the agendas of countries like Israel and Saudi Arabia how would you feel submitting exploits to them?
- tptacek 5y agoThey sell them to the IC.
- miohtama 5y agoYou can choose between a rich murderous dictator and an arrogant IT company that does not give you a proper credit. Either way you are screwed as a security researcher :(
- deleted 5y ago[deleted]
- ethanbond 5y agoUh, if your consideration is purely what happens to you, sure. If you have any thought in your mind about what will happen to other people due to your work, then it's nowhere near the same.
- AustinDev 5y agoTrillion dollar companies are people under the US constitution and they don't seem to care about that so why should everyday citizens?
- DSingularity 5y agoBecause if everyday citizens care the policies will change.
- smoldesu 5y agoIf that was the solution to surveillance capitalism, Apple wouldn't be the biggest company in the world.
- krater23 5y agoThere is a really simple solution to this. Just not put your time in analyzing software from Apple. There is other software you could analyze. Just go to a walk or count your toes. Everything makes more sense then searching security bugs in Apple software when you care about moral.
- lccarrasco 5y agoPeople worried about the morality aspect could sell the exploit, donate the money and report the issue to the manufacturer anyways.
- doopy1 5y agoI don't think Zerodium payouts are lump sum... I believe they are staggered in order to mitigate against this stuff.
- tptacek 5y agoSo far as I know, essentially all grey market vulnerability sales are tranched, which is an important consideration when comparing bounty payouts to the grey market.
- DSingularity 5y agoWhat makes you think the seller’s donation is going to counterbalance the harm of his now-weaponized exploit?
- krater23 5y agoThe report to the manufacturer with the remark that there is a existing weaponized exploit will lead to a much faster fix. And why you are so sure that there was no weaponized exploit out there before?
- DSingularity 5y agoSo you are okay with submitting the exploit on a silver platter to people who murder dissidents because “you can’t be so sure that there wasn’t an existing weaponized exploit”?
- tptacek 5y agoZerodium doesn't list "information disclosure" for smartphones. "Information disclosure" from an email server means exfiltrating the emails. Zerodium will almost certainly not outbid Apple for the `gamed` vulnerability here (maybe for publicity).
- dpkonofa 5y agoYou seem to be the only person here who actually read the article and understands what the stakes are here. Some of these comments are delusional.
- netsec_burn 5y agoSee my comment history for a firsthand account of Zerodium.
- mettamage 5y agoHah! That was a fun read :) If you're ever in Amsterdam and feel up for drinking a beer [0] with someone interested in netsec [1], feel free to email me. [0] Or coffee, tea, your beverage of choice. [1] I did a couple of fairly good security courses and about 300 hours of hackthebox.eu. So while I'm not a professional, at least I've scripted with IDA Python and defeated fun boxes like PlayerTwo.
- dpkonofa 5y ago>iOS “information disclosure” exploit (likely what this would have fallen under) Based on what? There's nothing to suggest that this falls into the category for an "information disclosure" according to Zerodium's eligibility guidelines.
- jtsiskin 5y agoAh, when I read Complete file system read access to the Core Duet database (contains a list of contacts from Mail, SMS, iMessage, 3rd-party messaging apps and metadata about all user's interaction with these contacts (including timestamps and statistics), also some attachments (like URLs and texts)) I thought it included SMS and iMessage contents, which does very much sound like what Zerodium is looking for. But reading it again it’s not actually all text messages.