3 ms·

Your [1] is 3 years old and has quite a few caveats (temporary situation, non-Zerodium security experts don't quite seem to agree with the decision), and the di

Your [1] is 3 years old and has quite a few caveats (temporary situation, non-Zerodium security experts don't quite seem to agree with the decision), and the diagrams in [2] don't seem to show that iOS exploits are any cheaper today. Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit". Is this still true today?

heavyset_go 4y ago
The Zerodium payout structure has not changed in the 3 years since that article's publication[3]. And that is the way news works. It was news 3 years ago when iOS exploits became cheaper, now it's just how the market is. > Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit". From Wired[4]: > Shwartz credits Android's increased security partly to its open-source strategy finally paying off. While Apple has kept its operating system so locked down that even benevolent security researchers have difficulty sussing out its bugs—a problem it's tried to solve with a recent expansion and opening up of its bug bounty program—Android's open-source approach has meant more eyes on its code. While that broadness initially led to more bugs, those vulnerabilities have been patched over time, slowly hardening the operating system. "So many vulnerabilities have been patched that the attack surface is decreased dramatically," says Shwartz. [3] https://web.archive.org/web/20201108190905/https://zerodium.com/program https://web.archive.org/web/20201108190905/https://zerodium..... [4] https://www.wired.com/story/android-zero-day-more-than-ios-zerodium/ https://www.wired.com/story/android-zero-day-more-than-ios-z...
- marcellus23 4y ago
  Regardless, the diagram on the Zerodium website (at http://zerodium.com/program.html http://zerodium.com/program.html, under "ZERODIUM Payouts for Mobiles") does not seem to indicate that iOS exploits are cheaper. Am I missing something?
  - Veserv 4y ago
    The most serious category of attack, a Zero Click FCP, has Android at $2.5M and iOS at $2M. To be fair, the difference is negligible and both are only about as expensive as starting a new McDonalds and easily fall within the scope of a standard small business loan. So yeah, trivially hacking any phone in the world is only within the financial means of around 60 million people in the world.
    - mlinksva 4y ago
      The main difference on that page isn't between iOS and Android, but server/desktop and mobile. Former is cheap! Is there anywhere that tracks more current prices?
    - pseudo0 4y ago
      Zerodium buying mobile exploits for $2-2.5M does not mean that a buyer can go out shopping for an exploit and find one in that price range. Exploits are a highly illiquid market and there is going to be a big bid-ask spread. Plus a lot of middlemen are restricted in various ways in terms of who they sell to. Then there the issue of building an actual capability around the base exploit... There's a reason why we don't have thousands of NSO-like small businesses running around.
  - deleted 4y ago
    [deleted]
dogma1138 4y ago
What the diagram doesn’t tell you is that it is the maximum possible payment for an exploit, and to get it for Android it needs to work on far many more operating system versions than iOS as well as being independent from Google Play Services. Zerodium pays out based on the maturity of the exploit, how many versions it covers and what are its dependencies and ease of exploit.

heavyset_go 4y ago

The Zerodium payout structure has not changed in the 3 years since that article's publication[3]. And that is the way news works. It was news 3 years ago when iOS exploits became cheaper, now it's just how the market is. > Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit". From Wired[4]: > Shwartz credits Android's increased security partly to its open-source strategy finally paying off. While Apple has kept its operating system so locked down that even benevolent security researchers have difficulty sussing out its bugs—a problem it's tried to solve with a recent expansion and opening up of its bug bounty program—Android's open-source approach has meant more eyes on its code. While that broadness initially led to more bugs, those vulnerabilities have been patched over time, slowly hardening the operating system. "So many vulnerabilities have been patched that the attack surface is decreased dramatically," says Shwartz. [3] https://web.archive.org/web/20201108190905/https://zerodium.com/program https://web.archive.org/web/20201108190905/https://zerodium..... [4] https://www.wired.com/story/android-zero-day-more-than-ios-zerodium/ https://www.wired.com/story/android-zero-day-more-than-ios-z...

marcellus23 4y ago
Regardless, the diagram on the Zerodium website (at http://zerodium.com/program.html http://zerodium.com/program.html, under "ZERODIUM Payouts for Mobiles") does not seem to indicate that iOS exploits are cheaper. Am I missing something?
- Veserv 4y ago
  The most serious category of attack, a Zero Click FCP, has Android at $2.5M and iOS at $2M. To be fair, the difference is negligible and both are only about as expensive as starting a new McDonalds and easily fall within the scope of a standard small business loan. So yeah, trivially hacking any phone in the world is only within the financial means of around 60 million people in the world.
  - mlinksva 4y ago
    The main difference on that page isn't between iOS and Android, but server/desktop and mobile. Former is cheap! Is there anywhere that tracks more current prices?
  - pseudo0 4y ago
    Zerodium buying mobile exploits for $2-2.5M does not mean that a buyer can go out shopping for an exploit and find one in that price range. Exploits are a highly illiquid market and there is going to be a big bid-ask spread. Plus a lot of middlemen are restricted in various ways in terms of who they sell to. Then there the issue of building an actual capability around the base exploit... There's a reason why we don't have thousands of NSO-like small businesses running around.
- deleted 4y ago
  [deleted]

dogma1138 4y ago

What the diagram doesn’t tell you is that it is the maximum possible payment for an exploit, and to get it for Android it needs to work on far many more operating system versions than iOS as well as being independent from Google Play Services. Zerodium pays out based on the maturity of the exploit, how many versions it covers and what are its dependencies and ease of exploit.