iOS

Develop an iOS 9 Zero-day exploit and earn $1 million

posted by Alan F. / Sep 21, 2015, 5:59 PM

Develop a way to hack into iOS 9 and earn $1 million

Amid revelations that a rogue version of Xcode, downloaded from Baidu, helped spread malware to 39 iOS apps, a security company known as Zerodium says that it will pay $1 million for a method that can hack into iOS 9. The latest version of Apple's mobile OS was just pushed out by the tech titan last week. The company says that it will be willing to pay the $1 million more than once, but says that it won't payout more than $3 million.

To claim the $1 million 'prize', a person must submit a technique to Zerodium that will remotely take control of an iPhone or iPad running iOS 9. This can be achieved through the use of a web page that targets the default configuration of mobile Safari or Google Chrome, or through a web page that targets any app reachable via the browser, or via a text message. The bug cannot be disclosed to Apple or be publicly revealed. The company will end up selling these techniques to governments or corporations. Zerodium founder Chaouki Bekrar also founded French hacking Vupen, which develops "intrusion software" and sells it to government agencies world-wide.

"Due to the increasing number of security improvements and the effectiveness of exploit mitigations in place, Apple’s iOS is currently the most secure mobile OS. But don’t be fooled, secure does not mean unbreakable, it just means that iOS has currently the highest cost and complexity of vulnerability exploitation and here’s where the Million Dollar iOS 9 Bug Bounty comes into play.-Zerodium website

Zerodium’s main goal is to capture the most advanced zero-day exploits and the highest risk vulnerabilities which are discovered, held, or sometimes stockpiled by talented researchers around the globe."-Chaouki Bekrar, founder, Zerodium

Zerodium, which was launched this summer, sells what is known as Zero-day vulnerabilities to both governments and corporations. According to Bekrar, once an exploit is sold to an agency by Vupen, he has no way of knowing how it is used or who it is shared with. "We do the best we can to ensure it won’t go outside that agency," Bekrar said back in 2012. "But if you sell weapons to someone, there’s no way to ensure that they won’t sell to another agency."

The million dollar offer is open until October 31st, 2015, or until $3 million is paid out by Zerodium.

Thanks for the tip!

source: Zerodium via WIRED

Options

13 Comments

1. kajam

Posts: 220; Member since: Jun 24, 2015

Will apple is going to be in trouble

posted on Sep 21, 2015, 6:20 PM 5

2. AlikMalix unregistered

Is iOS that difficult to crack? Up to $3 million just to pass thru Apple's verification process? Why not for android? Oh wait... (This is way too easy to troll). This article just made me feel more safer knowing that it takes that much just to find a remote exploit. Or: the U.S. Government could not force Apple to give up users data. It shows to prove that iOS is that secure. I'm impressed.

posted on Sep 21, 2015, 6:49 PM 7

4. HighOnAndroidFTW

Posts: 185; Member since: Apr 26, 2015

Android isn't built with the sole purpose in mind if keeping it locked up like Apple. They trust you with a little leash... so you just can't be an idiot about using information from unknown sources. Look at the article 3 Above this one. 35 malware apps in the apple store

posted on Sep 21, 2015, 8:20 PM 3

5. HighOnAndroidFTW

Correction 85...lmao

posted on Sep 21, 2015, 8:21 PM 1

6. Napalm_3nema

Posts: 2236; Member since: Jun 14, 2013

Yes, and how many of those were the result of an iOS exploit? Zero. The only reason there are 35, 85, whatever malicious apps in the App Store is that some developers used a malware infected version of Xcode instead of using the version straight from the developer, Apple. One word for you that doesn't involve unknown sources: Stagefright.

posted on Sep 21, 2015, 10:24 PM 1

8. AlikMalix unregistered

Dude, Android isn't built to give YOU a little leash, you have no real control really until you root your phone. Android is built with "a little leash" so that any manufacturer can use it for their devices. It was built as a sole purpose to collect YOUR information for Google's main product - Advertising. (I do understand that the information is mostly anonymous and it's only to provide you with targeted ads - nothing wrong with that). But the "extra" leash is for Manufacturers, NOT YOU. Changing icons and fonts isn't really control I would shout about (but if that's your thing, more power to you). Real control comes from sticking it to the carriers who cannot add their bloat that you cant get rid of. It's also sticking it to developers who cannot force some app to use your camera when you dont want it to, or some game to access your contacts when it doesnt need it - control is in YOUR hands with iOS - you tell apps what they're allowed to do, and what apps can talk to other apps. You never get stupid ads in your notifications. You never end up wondering why certain apps are running in background when you never launched them. You can choose to download (or not) an update when it's available, not just sit there and hope that the ones who really have control over YOUR device: the carriers, wonder when or if they ever release an update (specifically when security is involved like Stagefright). I'm sorry, but I think we have a different perception of what "control" really is, but that's ok, you got custom icons.... You're a winner!

posted on Sep 22, 2015, 2:22 AM 1

13. iHateFans

Posts: 6; Member since: Nov 06, 2013

couple of days ago apple app store with news focus that it full of bug app and it affected badly and apple now successfully got rid of it with this paid contest that's the apple advertisement power........ and media totally sucked

posted on Sep 23, 2015, 9:39 AM 0

3. Saioofi

Posts: 326; Member since: May 23, 2014

http://www.iphonehacks.com/2015/09/untethered-ios-9-jailbreak-demoed-video.html LOL

posted on Sep 21, 2015, 6:55 PM 3

9. AlikMalix unregistered

So, that's a jailbrake, it requires you to physically take my phone, somehow creep thru my lockscreen (good luck), then have it long enough to jailbrake the thing before I "remote-lock" yo ass. They article is talking about hacking remotely, kinda like you can do with Stagefright. Try again.

posted on Sep 22, 2015, 2:40 AM 2

10. magnanimus

Posts: 565; Member since: Mar 29, 2013

Doesn't remote lock require internet connection on the iPhone? I mean, the thief could switch off the internet connection

posted on Sep 22, 2015, 12:08 PM 0

11. AlikMalix unregistered

Yes but they still have to get thru a password protected screen to turn the Internet off (which will take a while even if the thief is successful). He can turn off the phone itself, but as soon as he turns it on remotelock will be activated.

posted on Sep 22, 2015, 12:23 PM 0

7. Michael.Parker

Posts: 273; Member since: Aug 22, 2015

If they released the exploit to the public and Apple I'm all for it, but selling it to governments so they can spy on people? Oh f#@k no I don't want that happening.