Hacker News Reader

Comment by jtsiskin | Hacker News Reader

Zerodium (https://zerodium.com/program.html) pays out $2 million dollars for an iOS “full chain with persistence” exploit. $500k for an iMessage RCE. Up to $100k for an iOS “information disclosure” exploit (likely what this would have fallen under). Paid for via bank wire or Bitcoin/Monero/Zcash in 1 week or less. And legal.

Next time someone finds one of these, I wonder where they will report it to….

View on HN

Zerodium doesn't list "information disclosure" for smartphones. "Information disclosure" from an email server means exfiltrating the emails. Zerodium will almost certainly not outbid Apple for the `gamed` vulnerability here (maybe for publicity).

You seem to be the only person here who actually read the article and understands what the stakes are here. Some of these comments are delusional.

Is it moral though? What do they do with these exploits? If it is to help advance the agendas of countries like Israel and Saudi Arabia how would you feel submitting exploits to them?

They sell them to the IC.

You can choose between a rich murderous dictator and an arrogant IT company that does not give you a proper credit. Either way you are screwed as a security researcher :(

Uh, if your consideration is purely what happens to you, sure. If you have any thought in your mind about what will happen to other people due to your work, then it's nowhere near the same.

Trillion dollar companies are people under the US constitution and they don't seem to care about that so why should everyday citizens?

Because if everyday citizens care the policies will change.

If that was the solution to surveillance capitalism, Apple wouldn't be the biggest company in the world.

There is a really simple solution to this. Just not put your time in analyzing software from Apple. There is other software you could analyze. Just go to a walk or count your toes. Everything makes more sense then searching security bugs in Apple software when you care about moral.

People worried about the morality aspect could sell the exploit, donate the money and report the issue to the manufacturer anyways.

I don't think Zerodium payouts are lump sum... I believe they are staggered in order to mitigate against this stuff.

So far as I know, essentially all grey market vulnerability sales are tranched, which is an important consideration when comparing bounty payouts to the grey market.

What makes you think the seller’s donation is going to counterbalance the harm of his now-weaponized exploit?

The report to the manufacturer with the remark that there is a existing weaponized exploit will lead to a much faster fix. And why you are so sure that there was no weaponized exploit out there before?

So you are okay with submitting the exploit on a silver platter to people who murder dissidents because “you can’t be so sure that there wasn’t an existing weaponized exploit”?

Ah, when I read

Complete file system read access to the Core Duet database (contains a list of contacts from Mail, SMS, iMessage, 3rd-party messaging apps and metadata about all user's interaction with these contacts (including timestamps and statistics), also some attachments (like URLs and texts))

I thought it included SMS and iMessage contents, which does very much sound like what Zerodium is looking for. But reading it again it’s not actually all text messages.

See my comment history for a firsthand account of Zerodium.

Hah! That was a fun read :)

If you're ever in Amsterdam and feel up for drinking a beer [0] with someone interested in netsec [1], feel free to email me.

[0] Or coffee, tea, your beverage of choice.

[1] I did a couple of fairly good security courses and about 300 hours of hackthebox.eu. So while I'm not a professional, at least I've scripted with IDA Python and defeated fun boxes like PlayerTwo.

>iOS “information disclosure” exploit (likely what this would have fallen under)

Based on what? There's nothing to suggest that this falls into the category for an "information disclosure" according to Zerodium's eligibility guidelines.

Reply on news.ycombinator.com