Zerodium, an exploit acquisition company launched this summer by the founder of the controversial French security firm Vupen, announced on Monday the start of a new bug bounty program targeting Apple’s new iOS 9 operating system.
The company says it’s prepared to pay out a total of $3 million for exploits and jailbreaks as part of the new Million Dollar iOS 9 Bug Bounty, which it advertises as the world’s biggest zero-day bug bounty program. Security researchers, jailbreak developers and reverse engineers can earn up to $1 million for exclusive iOS 9 exploits and jailbreaks.
The program is open until October 31, but Zerodium reserves the right to end it earlier if the entire $3 million amount is paid out.
“Apple iOS, like all operating system, is often affected by critical security vulnerabilities, however due to the increasing number of security improvements and the effectiveness of exploit mitigations in place, Apple’s iOS is currently the most secure mobile OS,” Zerodium said. “But don’t be fooled, secure does not mean unbreakable, it just means that iOS has currently the highest cost and complexity of vulnerability exploitation and here’s where the Million Dollar iOS 9 Bug Bounty comes into play.”
For a submission to be eligible, it must include a full chain of zero-day exploits that result in a complete bypass of iOS 9 exploit mitigations, it must allow the remote installation of an arbitrary app on a fully updated device, it must be reliable on most iPhones and iPads, and it must not require user interaction beyond opening a specially crafted website or message.
While a million dollars might seem like a lot of money for an iOS exploit considering that Apple patches tens of vulnerabilities nearly every month in its mobile operating system, the types of flaws Zerodium is looking for are very difficult to find.
Benjamin Kunz-Mejri, CEO and founder of Germany-based Vulnerability Lab, a company that has identified more than a dozen iOS flaws over the past years, has issued a warning to bug bounty hunters who might consider submitting their exploits to Zerodium.
“I would like to point out that this is not an official bug bounty program. An official bug bounty program is run by the manufacturer or a representative that is connected to the product, and must represent a part of the public industry that cooperates with the private industry,” Kunz-Mejri told SecurityWeek.
“In this case, an agency-like organization from France offers a ‘black bug bounty’ for a remote mobile device zero-day exploit. This is about surveillance, new bypass methods and evasion of controls. Vupen and their premium programs are well known for offensive security and remote exploits to attack other infrastructures. The company is far away from legal research and starts requests with unique requirements because of other internal running projects,” the researcher added. “I would not report an issue in iOS 9 to the security company to cash 3.000.000$. The reason is that Apple as a manufacturer is not cooperating or connected to the program. The zero-day exploit will be mainly used for illegal activities and surveillance.”
In addition to its iOS 9 bug bounty program, Zerodium is prepared to pay out large amounts of money for zero-day vulnerabilities in operating systems, web browsers, media players and document readers, mobile phones, web and email servers, web applications, and security or exploit mitigation bypass techniques. The company, which provides its services to both governments and corporations, has pointed out that it’s not interested in acquiring vulnerabilities affecting popular online services such as Facebook or Google.
Acquiring zero-day exploits and vulnerabilities for the development of surveillance and intelligence gathering products is not illegal — even governments have been caught doing it. The controversial Wassenaar Arrangement, which has yet to be implemented in the United States mainly due to overbroad definitions, seeks to regulate the activities of companies such as Vupen and Zerodium.
Currently, the main concern for authorities and civil liberties advocates are companies that use zero-days to build surveillance products that are sold to totalitarian governments, such as the ones in Sudan and Ethiopia.
A perfect example is Italian spyware maker Hacking Team. The company has denied selling its products and services to oppressive regimes, but files stolen recently from the company as a result of a data breach seem to show otherwise.
Related: Apple Patches Vulnerabilities in iOS, OS X, iTunes, Xcode
Related: Apple Updates “Sideloading” Process in iOS 9 to Boost App Security