iPhone exploit bounty surges to an eye-popping $1.5 million

A controversial broker of security exploits is offering $1.5 million (£1.2 million) for attacks that work against fully patched iPhones and iPads, a bounty that's triple the size of its previous one.

Zerodium also doubled, to $200,000, the amount it will pay for attacks that exploit previously unknown vulnerabilities in Google's competing Android operating system, and the group raised the amount for so-called zeroday exploits in Adobe's Flash media player to $80,000 from $50,000. After buying the working exploits, the company then sells them to government entities, which use them to spy on suspected criminals, terrorists, enemies, and other targets.

Last year, Zerodium offered $1 million for iOS exploits, up to a total of $3 million. It dropped the price to $500,000 after receiving and paying for three qualifying submissions. On Thursday, Zerodium founder Chaouki Bekrar said the higher prices are a response to improvements the software makers—Apple and Google in particular—have devised that make their wares considerably harder to compromise.

"Prices are directly linked to the difficulty of making a full chain of exploits, and we know that iOS 10 and Android 7 are both much harder to exploit than their previous versions," he told Ars. Asked why a string of iOS exploits commanded 7.5 times the price of a comparable one for Android he said: "That means that iOS 10 chain exploits are either 7.5 x harder than Android or the demand for iOS exploits is 7.5 x higher. The reality is a mix of both."

Many pundits and reporters regularly compare the bounties offered by bug brokers to those paid by the developers, the latter of which are without exception only a small fraction of the former. Apple bounties, for instance, top out at $250,000, or a sixth of what Zerodium is offering. Google, meanwhile, pays a maximum of $38,000, or about 15 percent of Zerodium's top bounty. The pundits often point to the disparity as evidence that the companies' bug bounty programs are being outdone by the brokers.

Those arguments, however, discount a key difference between the broker-sponsored bounties and bounties funded by the software developers. To qualify for a Zerodium bounty, the chain must generally work almost flawlessly to surreptitiously give an attacker complete control over the targeted device. In the parlance of hackers, that's called a weaponized exploit. It's not enough that a researcher provides only a rough outline of the vulnerabilities with a less-than-perfect proof-of-concept exploit. The bounties paid by Apple and Google, by contrast, are much less demanding, and as a result, they generally require less work.

The comparisons also discount an important but less tangible compensation offered by developer-sponsored bounties. Many researchers are strongly opposed to bug brokers who sell their exploits to governments, many of which have little accountability and a history of abuse. (For a sense of the debate, see this Twitter thread.) In August, for example, researchers uncovered a highly weaponized chain of exploits that targeted iOS users in the wild. The attack, which was developed by a US-owned company that is estimated to have charged about $8 million for 300 licenses, was only discovered after it targeted a political dissident located in the United Arab Emirates.

In fairness, Bekrar has said the iOS used in that case had no connection to Zerodium. Still, many researchers understandably have strong objections to Zerodium and its competitors, and these individuals don't want to play any role in government spying. Bekrar has defended his business by saying that governments have a legitimate need for zerodays to achieve national security goals and to catch and prosecute criminals.

Another difference, at least when contrasting Apple with Zerodium, is that Apple's biggest bounties are largely reserved for vulnerabilities in the secure boot and secure enclave components that protect iOS users who have lost their devices or have them confiscated. Zerodium, by contrast, is most interested in remote iOS jailbreak exploits that target a Web browser or the OS kernel.

Despite the differences, Zerodium's move significantly puts upward pressure on the already sky-high prices paid for high-severity vulnerability reports. It will also ensure that an ample supply of zeroday exploits remain in the wild, despite the non-trivial strides Apple, Google, and other software makers continue to make in security their products.