3 ms·
I wonder how much this would be worth for Zerodium
by Alifatisk 1y ago
I wonder how much this would be worth for Zerodium
- kingforaday 1y agoI know the thread is saying $0 because Zerodium doesn't exist anymore, but there are others. This [0] one for a full chain mobile iOS is at $15M. I agree with tptacek though, the airdrop would reduce the value but you may still be in the low 7 figure range for 0 click RCE. 0. https://advance-sec.com/#bounty https://advance-sec.com/#bounty
- tptacek 1y agoI don't think this is real. "Full chain Linux desktop" for $10MM? Uh huh. We recorded a podcast with Mark Dowd a year ago where he said nobody actually gets "list prices" for iOS full chain at $2.5MM (you can make considerably more than that by selling to multiple parties and by selling maintenance) --- and that's iOS, the highest-valued vulnerabilities.
- gruez 1y ago$0, given it's patched in ios 18.6.2
- crossroadsguy 1y agoBefore that obviously. Possibly pc meant to ask if the “finder” would have gone to them instead of dealing with Apple directly.
- tptacek 1y agoThe AirDrop requirement probably decreases its value substantially, but I think all these kinds of questions are kind of tricky to reason about: https://news.ycombinator.com/item?id=43025038 https://news.ycombinator.com/item?id=43025038 This might be a weird corner case where Apple would outbid the grey market, but generally even though Apple comes in lower than the grey market (for these very specific kinds of vulnerabilities), the term sheets are different, and the rest of the terms tend to favor going with Apple.
- rafram 1y agoAnd given that Zerodium has shut down.
- anon6362 1y agoIts website still works and there's a gpg key, so it's a "shutdown" rather than shutdown.
- tptacek 1y ago$0, since I don't think Zerodium still exists.