Exploit Vendor Publishes 0-Day Bugs Price List, iOS Valued Above Android

[Exterminator]

Content source

http://news.softpedia.com/news/exploit-vendor-publishes-price-list-ios-valued-above-android-496449.shtml

Exploit vendor decides to go public with 0-day going rates
Having previously paid $1 million / €0.93 million for the first iOS 9 jailbreak, Zerodium has now gone one step further and published a list of prices it will dish out to security researchers and hackers for their undisclosed zero-day bugs.

For the uninitiated, Zerodium is a European company activating in the cyber-security field. The company is not selling an antivirus or managing a security platform, but it's what you'd call an exploit vendor, a company that finds security flaws in other platforms / software and then sells them to the highest bidder.

Zerodium's list of regular customers includes national spying agencies, cyber-crime groups, or even legitimate companies willing to dirty up their hands and sabotage their competition.

While Zerodium has its own staff that searches popular software for zero-day vulnerabilities, it also sometimes buys them from other companies or solitary hackers.

Mobile OS jailbreaks are the most expensive zero-days on the market
After the recent success of its iOS 9 jailbreak bug bounty, it appears that the company has decided to go on ahead and put a price list out in the open.

The price chart, presented as Mendeleev's periodic table, places iOS remote jailbreaks above all other security flaws, the company being willing to pay up to $500,000 / €466,000 for such submissions.

The second tier is for payments of up to $100,000 / €93,000, and will be dished out for similar remote jailbreakes for Android and Windows Phone handsets.

The third tier is reserved for Google Chrome, Adobe Flash, and Adobe PDF Reader. Zerodium is looking for sandbox escape methods and remote code execution bugs, being willing to pay up to $80,000 / €74,500.

The company is also searching for bugs in many more other tools, ranging from operating systems to Web servers, and from forums to mail server tech. The only condition is that all submitted bugs should be unique, and not reported or disclosed to anybody else.

 

[Solarquest]

It surprises me that this is considered legal!

 

[LabZero]

Evidently the vulnerabilities business has no limits.
Find security vulnerabilities, avoid by contacting the software house of competence and sell them it isn't ethical!

 

[thepierrezou]

It's easier to find exploit when code source is avaible, it's normal that there is less exploit found on ios.

 

[jamescv7]

These are primarily based on numerous incidents happen and how damage can be done by those vulnerabilities, where many factors can be include and one of the example is between desktop and mobile.

Mobile are somehow the next generation of not just portability but the ease of services use so having an exploit generally stops the overall progress.

 

[Deleted member 178]

This company should be on Raymond Reddington' blacklist lol.

Not ethical, sure. But the vendors should be more serious and less greedy , releasing unsecured products for better incomes.

 

[Solarquest]

Really true!
Company should be way more "serious";
Consumers should be way more alert (ed) , way more selective and "loud";
public control and fine system should be way better and with heavier fines...

 

[Cch123]

I'm not sure how the Wassenaar agreement would impact such sales. But anyway, ethical or not is up to the sellers who decide, people can't do anything to stop it.

This quote sums up the whole zeroday market: "There are two kinds of 0day researchers: those who get money, and those who get a CVE." In short, the key motivation for selling to non vendors is money