4 ms·

For reference, iOS exploits are cheaper than Android exploits because iOS exploits are so plentiful[1][2]. Android being open source makes it easier for more p

For reference, iOS exploits are cheaper than Android exploits because iOS exploits are so plentiful[1][2]. Android being open source makes it easier for more parties to audit the software they run, and not just groups that are paid handsomely to exploit iOS for state sponsored hacking. [1] https://www.theregister.com/2020/05/14/zerodium_ios_flaws/ https://www.theregister.com/2020/05/14/zerodium_ios_flaws/ [2] http://zerodium.com/program.html http://zerodium.com/program.html

realusername 4y ago
More than open-source, I would say it's also due to the fact that on Android there's no homemade apps with private apis like on iOS. Apple's security model clearly excludes their own apps and that shows on the issues publicly released. Secondly, on Android, very few system components are actually tied to the OS version, and it's getting thinner after every version. On iOS it's the norm.
- deleted 4y ago
  [deleted]
marcellus23 4y ago
Your [1] is 3 years old and has quite a few caveats (temporary situation, non-Zerodium security experts don't quite seem to agree with the decision), and the diagrams in [2] don't seem to show that iOS exploits are any cheaper today. Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit". Is this still true today?
- heavyset_go 4y ago
  The Zerodium payout structure has not changed in the 3 years since that article's publication[3]. And that is the way news works. It was news 3 years ago when iOS exploits became cheaper, now it's just how the market is. > Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit". From Wired[4]: > Shwartz credits Android's increased security partly to its open-source strategy finally paying off. While Apple has kept its operating system so locked down that even benevolent security researchers have difficulty sussing out its bugs—a problem it's tried to solve with a recent expansion and opening up of its bug bounty program—Android's open-source approach has meant more eyes on its code. While that broadness initially led to more bugs, those vulnerabilities have been patched over time, slowly hardening the operating system. "So many vulnerabilities have been patched that the attack surface is decreased dramatically," says Shwartz. [3] https://web.archive.org/web/20201108190905/https://zerodium.com/program https://web.archive.org/web/20201108190905/https://zerodium..... [4] https://www.wired.com/story/android-zero-day-more-than-ios-zerodium/ https://www.wired.com/story/android-zero-day-more-than-ios-z...
  - marcellus23 4y ago
    Regardless, the diagram on the Zerodium website (at http://zerodium.com/program.html http://zerodium.com/program.html, under "ZERODIUM Payouts for Mobiles") does not seem to indicate that iOS exploits are cheaper. Am I missing something?
    - Veserv 4y ago
      The most serious category of attack, a Zero Click FCP, has Android at $2.5M and iOS at $2M. To be fair, the difference is negligible and both are only about as expensive as starting a new McDonalds and easily fall within the scope of a standard small business loan. So yeah, trivially hacking any phone in the world is only within the financial means of around 60 million people in the world.
      - mlinksva 4y ago
        The main difference on that page isn't between iOS and Android, but server/desktop and mobile. Former is cheap! Is there anywhere that tracks more current prices?
      - pseudo0 4y ago
        Zerodium buying mobile exploits for $2-2.5M does not mean that a buyer can go out shopping for an exploit and find one in that price range. Exploits are a highly illiquid market and there is going to be a big bid-ask spread. Plus a lot of middlemen are restricted in various ways in terms of who they sell to. Then there the issue of building an actual capability around the base exploit... There's a reason why we don't have thousands of NSO-like small businesses running around.
    - deleted 4y ago
      [deleted]
- dogma1138 4y ago
  What the diagram doesn’t tell you is that it is the maximum possible payment for an exploit, and to get it for Android it needs to work on far many more operating system versions than iOS as well as being independent from Google Play Services. Zerodium pays out based on the maturity of the exploit, how many versions it covers and what are its dependencies and ease of exploit.
TechBro8615 4y ago
This is a double edged sword, because while there might be fewer Android exploits discovered per year, the number of publicly-known and exploitable vulnerabilities in circulation at any given time is almost certainly lower on iOS, where most users have updated to the latest version within two weeks of its release, than on any device in the fragmented Android ecosystem, where only users of devices from proactive vendors even have the option to update their device to the latest version with upstream security patches. And that's assuming their device isn't EOL, which tends to happen more quickly to Android devices than Apple devices, despite the latter's reputation for planned obsolescence.
- realusername 4y ago
  To nuance that, Android is also much more modular in its updates than iOS, an outdated Android depends on the security flaw itself to be exploitable or not, it really depends. On iOS, the system is exploitable in 100% of the cases if not updated and keeping the system always up to date is even more critical.
- tholdem 4y ago
  I have been wondering what's the actual status of iOS updates outside of the US, or in countries where nobody uses wifi? I just checked that my SO's iOS was on 16.3.1, over 2 months old iOS version. Apple has decided that iOS should only accept downloading OS updates over wifi. In my country, for example, people don't really set up wifi at home anymore because basically everyone has unlimited cellular data. So they don't need to connect to any wifi at all. All the iOS update statistics seem to come from the US, where everyone relies on wifi. It seems that on some level, iOS suffers from the same update problem as Android, but only because Apple decided to do so for no reason. Not everyone lives in the US.
  - TechBro8615 4y ago
    Apple allows downloading updates over cellular network. However, it seems to not be allowed in every country [0]. To be more specific, I think each mobile carrier can choose whether or not to allow it on their network, and iOS enforces it. I'm not totally sure though. [0] https://osxdaily.com/2022/08/05/how-to-update-your-iphone-over-cellular-network/ https://osxdaily.com/2022/08/05/how-to-update-your-iphone-ov...

realusername 4y ago

More than open-source, I would say it's also due to the fact that on Android there's no homemade apps with private apis like on iOS. Apple's security model clearly excludes their own apps and that shows on the issues publicly released. Secondly, on Android, very few system components are actually tied to the OS version, and it's getting thinner after every version. On iOS it's the norm.

deleted 4y ago
[deleted]

marcellus23 4y ago

Your [1] is 3 years old and has quite a few caveats (temporary situation, non-Zerodium security experts don't quite seem to agree with the decision), and the diagrams in [2] don't seem to show that iOS exploits are any cheaper today. Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit". Is this still true today?

heavyset_go 4y ago
The Zerodium payout structure has not changed in the 3 years since that article's publication[3]. And that is the way news works. It was news 3 years ago when iOS exploits became cheaper, now it's just how the market is. > Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit". From Wired[4]: > Shwartz credits Android's increased security partly to its open-source strategy finally paying off. While Apple has kept its operating system so locked down that even benevolent security researchers have difficulty sussing out its bugs—a problem it's tried to solve with a recent expansion and opening up of its bug bounty program—Android's open-source approach has meant more eyes on its code. While that broadness initially led to more bugs, those vulnerabilities have been patched over time, slowly hardening the operating system. "So many vulnerabilities have been patched that the attack surface is decreased dramatically," says Shwartz. [3] https://web.archive.org/web/20201108190905/https://zerodium.com/program https://web.archive.org/web/20201108190905/https://zerodium..... [4] https://www.wired.com/story/android-zero-day-more-than-ios-zerodium/ https://www.wired.com/story/android-zero-day-more-than-ios-z...
- marcellus23 4y ago
  Regardless, the diagram on the Zerodium website (at http://zerodium.com/program.html http://zerodium.com/program.html, under "ZERODIUM Payouts for Mobiles") does not seem to indicate that iOS exploits are cheaper. Am I missing something?
  - Veserv 4y ago
    The most serious category of attack, a Zero Click FCP, has Android at $2.5M and iOS at $2M. To be fair, the difference is negligible and both are only about as expensive as starting a new McDonalds and easily fall within the scope of a standard small business loan. So yeah, trivially hacking any phone in the world is only within the financial means of around 60 million people in the world.
    - mlinksva 4y ago
      The main difference on that page isn't between iOS and Android, but server/desktop and mobile. Former is cheap! Is there anywhere that tracks more current prices?
    - pseudo0 4y ago
      Zerodium buying mobile exploits for $2-2.5M does not mean that a buyer can go out shopping for an exploit and find one in that price range. Exploits are a highly illiquid market and there is going to be a big bid-ask spread. Plus a lot of middlemen are restricted in various ways in terms of who they sell to. Then there the issue of building an actual capability around the base exploit... There's a reason why we don't have thousands of NSO-like small businesses running around.
  - deleted 4y ago
    [deleted]
dogma1138 4y ago
What the diagram doesn’t tell you is that it is the maximum possible payment for an exploit, and to get it for Android it needs to work on far many more operating system versions than iOS as well as being independent from Google Play Services. Zerodium pays out based on the maturity of the exploit, how many versions it covers and what are its dependencies and ease of exploit.

TechBro8615 4y ago

This is a double edged sword, because while there might be fewer Android exploits discovered per year, the number of publicly-known and exploitable vulnerabilities in circulation at any given time is almost certainly lower on iOS, where most users have updated to the latest version within two weeks of its release, than on any device in the fragmented Android ecosystem, where only users of devices from proactive vendors even have the option to update their device to the latest version with upstream security patches. And that's assuming their device isn't EOL, which tends to happen more quickly to Android devices than Apple devices, despite the latter's reputation for planned obsolescence.

realusername 4y ago
To nuance that, Android is also much more modular in its updates than iOS, an outdated Android depends on the security flaw itself to be exploitable or not, it really depends. On iOS, the system is exploitable in 100% of the cases if not updated and keeping the system always up to date is even more critical.
tholdem 4y ago
I have been wondering what's the actual status of iOS updates outside of the US, or in countries where nobody uses wifi? I just checked that my SO's iOS was on 16.3.1, over 2 months old iOS version. Apple has decided that iOS should only accept downloading OS updates over wifi. In my country, for example, people don't really set up wifi at home anymore because basically everyone has unlimited cellular data. So they don't need to connect to any wifi at all. All the iOS update statistics seem to come from the US, where everyone relies on wifi. It seems that on some level, iOS suffers from the same update problem as Android, but only because Apple decided to do so for no reason. Not everyone lives in the US.
- TechBro8615 4y ago
  Apple allows downloading updates over cellular network. However, it seems to not be allowed in every country [0]. To be more specific, I think each mobile carrier can choose whether or not to allow it on their network, and iOS enforces it. I'm not totally sure though. [0] https://osxdaily.com/2022/08/05/how-to-update-your-iphone-over-cellular-network/ https://osxdaily.com/2022/08/05/how-to-update-your-iphone-ov...