Million Dollar iOS9 Bug Bounty
zerodium.com
zerodium.com
About less people being able to afford it - this again depends on what ZERODIUM intends to do with it. They may sell it for cheap and count on a large number of sales because, again, iOS is so popular.
With regards to users flash player has more users than iOS but the exploit was cheaper, while these users might not be as valuable as iOS users neither market is what you would consider small.
And finally it's unlikely they would sell it to mass users for extremely cheap and risk it leaking. It's probably more out of desperation, Vupen has heaps of long term customers who they have promised the ability to hack phones to, it's probably embarrassing to them if they can't hack them most popular phone model out there.
"Mobile: VUPEN offered several different remote code execution and local privilege escalation exploits for Android; however, not all of them were 0day and Hacking Team deemed that the prices were too high to purchase. Though there was interest in purchasing exploits for iOS, VUPEN said they were limited to certain customers, presumably high-paying government agencies." [1]
"iOS exploit pricing: Adriel stated he was supply-constrained for iOS RCE exploits because exploit developers frequently had their own connections to sell them, and that he believed that such exploits were overpriced. An exclusive exploit sale could cost over a million dollars, [...]." [1]
> Apple iOS, like all operating system, is often affected by critical security vulnerabilities, however due to the increasing number of security improvements and the effectiveness of exploit mitigations in place, Apple's iOS is currently the most secure mobile OS. But don't be fooled, secure does not mean unbreakable, it just means that iOS has currently the highest cost and complexity of vulnerability exploitation and here's where the Million Dollar iOS 9 Bug Bounty comes into play.
BTW, I guess Flash is as popular as iOS9 (the Steam hardware survey used to show that 99.9% of the Steam users had Flash installed), yet, as stirlo says, they only paid up to $30k for Flash exploits.
You do make a great point with that Flash comparison, though.
It must be through a text message or web page, it must be remote, reliable, silent, require no interaction, must be entirely comprised of 0-day exploits throughout the whole chain, must affect multiple architectures and all supported devices, and must bypass all security checks to allow full root access.
Read more: https://books.google.com/books?id=1kDcjKcz9GwC&pg=PA9&lpg=PA...
Despite the media hype you can't root your phone with the stagefright bugs and so it wouldn't qualify for the bounty.
Mediaserver is not full root but it is pretty privileged. Given all of this access it wouldn't take much work to incorporate another privilege escalation bug to get root on the phone anyway, and there is zero user interaction.
[1] https://www.blackhat.com/docs/us-15/materials/us-15-Drake-St...
Alone? No. As part of a "chain" of exploits, which is what this bounty is calling for, in concert with a privilege escalation? Yes. That bug allowed for remote and silent (due to executing in a way which would allow it to suppress notifications of the incoming message) arbitrary code execution as a user on the device, which, even as a user with minimal permissions or which has been sandboxed in some way, affords you the ability to do much much more on the device than you could before the exploit.
FWIW, the actual release included a demo of rooting a device on stage; they have a video with a similar demo. I presume the second bug they were using was an already-fixed kernel bug, but if you have something like stagefright your next step is to go hunting for such a bug. (Regardless, the question you were responding to was more about how most of the exploits people put together do not satisfy the "remote" and "silent" parts, as opposed to the "I got root" part; the latter is comparatively easy.)
> Regardless, the question you were responding to was more about how most of the exploits people put together do not satisfy the "remote" and "silent" parts, as opposed to the "I got root" part; the latter is comparatively easy
FWIW, "throughout the whole chain" was part of the question.
ZERODIUM customers are major corporations in defense, technology, and finance, in need of advanced zero-day protection, as well as government organizations in need of specific and tailored cybersecurity capabilities
The offer to buy RCE in PHPBB/vBulletin is a nice touch.
The realization that there's a dirty, dirty underside to our standard of living seems to polarize people. Some dedicate themselves to helping. Some conclude that the world is run by gangsters, so they might as well pick a gang and profit. Most, either never realize or just decide that the problem is too big and they should focus on their own little islands of comfort.
- this is just a PR stunt, nobody will realistically deliver such a piece of code before oct. 31st.
- they know that someone in the jailbreak community is cooking something big like that and they're trying to tempt them and acquire a very interesting exploit before anybody else.
Can someone explain this part? Jailbreak from a website, sms, or mms seems ... impossible. Has this even been possible with older jailbreaks?
Someone absolutely can try and play games, but the people they sell to will do their best to determine whether that's happening and penalize them.
So did i read this correct and the exploit must be backwards compatible in order to get the full bounty?
iOS 9 has the same performance as iOS 8.4
they always give users the 'last' iOS version but I highly doubt any work will go into patching it in future.
It's a bit like with oil drilling. Once the easily accessible options are gone, people reconsider options that used to be considered too expensive to exploit or too damaging for the environment. Like fracking, oil sands, oil wells that are very deep or far up in the arctic, ...
In the case of iOS explots, maybe you'll be able to jailbreak it over the lightning connector. Maybe you'll have to open the phone and hook up the circuit board to a device. Maybe someone in china will build a robot for phone shops that'll disassemble, jailbreak, and reassemble a phone in seconds (and replace a cracked screen while it is at it). Heck, maybe it'll become economic for criminals to bribe and/or blackmail Apple engineers to put a backdoor into iOS, or to leak keys?
Or just become Apple engineers... I'm sure there's people out there who would be absolutely thrilled at the idea of working for Apple and writing code for iDevices while at the same time secretly subverting them.
(Further, I will point out that most jailbreaks don't even involve a remote and silent deployment: while there are tons of possible exploitable bugs found in WebKit all the time, Apple has sandboxed the living daylights out of that process, and a lot of the kernel bugs people find don't work even in processes that have the lightest of sandboxes. The standard stack for a jailbreak is usually something that requires the device to be pincode unlocked and plugged into a computer that the device has been told to "trust", in order to take advantage of the attack surface provided by the protocols iTunes and Xcode use to talk to the device over USB, which often will touch the filesystem in complex ways, at least indirectly if not directly as part of something like "restore a backup". If you find this kind of limited stack, you usually don't just "throw it back" and keep fishing ;P.)