Zero-days for hacking WhatsApp are now worth millions of dollars

techcrunch.com

27 points·rntn··9 comments

That just means that it’s very difficult to make a 0 day. If anything this is validation of how hard it is to break WhatsApp.

I wonder. The article mentions an image rendering library exploit. I'm guessing WhatsApp doesn't write their own so the source code is probably available somewhere.

Apps really need to stop processing exotic formats in unsafe languages. Every phone zero day I hear about is related to media processing.

> Apps really need to stop processing exotic formats in unsafe languages. Every phone zero day I hear about is related to media processing.

Yeah, but JPEG-XL ... /s I guess that releasing every year a new library version, without fixing the old bugs, also doesn't help.

Putting aside ethics, I wouldn't want to sell a zero day to a Russian company because if they swindle you, there's no recourse.

One, it seems reasonable to assume that an entity willing to pay $1+ million for a zero-day will generally want to buy another one not too far in the future. The recourse would be no longer selling to them.

Two, there wouldn't be much recourse against any entity in the market for $1+ million zero days, just look at Pegasus' customers.

So it’s good I’m not using it :)

you are using a browser which has zero day vulnerabilities nonetheless.

What do you mean? If they were easy to make they wouldn’t be worth millions.

big target

Reply on news.ycombinator.com