O corretor de vulnerabilidade bem conhecida, Zerodium, actualizou a sua lista de preços, e agora, pela primeira vez na história exploits para Android são mais caros que exploits para iOS.EuS researchers have the opportunity to earn on 0-day bugs for Android, cujo funcionamento não requer interação do usuário, até $2,500,000. façanhas semelhantes para custo iOS $2,000,000.
portanto, Zerodium raised the rewards for such exploits for Android by almost 12 times compared to last year (Recordando, earlier problems in the Google operating system could bring no more than $200,000). For vulnerabilities of a smaller caliber, the cost has increased by Mais que 100 vezes. The announcement was definitely timed to coincide with the official release of Android 10, which also took place yesterday, setembro 3, 2019.
Além disso, the vulnerability broker raised the cost of exploits for messengers, regardless on which OS they are running. Now the RCE and LPE problems in WhatsApp and iMessage are estimated at $1,500,000, even if the exploit does not allow maintaining presence in the system after a reboot.
If the problem requires user interaction, the price for the exploit chain reduced to $1,000,000 for bugs in WhatsApp and up to $500,000 for bugs in iMessage. Ano passado, such vulnerabilities would bring researchers no more than $500,000.
o chefe de Zerodium, Chauki Bekrar, contou ZDNet reporters that raising prices, his company only responds to market trends.
The fact is that the Zerodium business model (because of which the company was repeatedly subjected to harsh criticism) is such that the company keeps information about 0-day found independently and bought from third parties in secret, while reselling them to large companies, government organizations and law enforcement agencies structures. Por exemplo, the NSA or the military. portanto, the price increase can be explained by the interest that Zerodium clients (Isso é, law enforcement agencies and government agencies around the world) are showing to Android problems.
Bekrar says that due to the large fragmentation of the Android device market, the company is primarily interested in bugs in the devices Google, Samsung, Huawei and Sony, although other brands will also not be ignored.
“In the past few months, we have seen an increase in the number of exploits for iOS, mainly for Safari and iMessage, which are created and sold by researchers from around the world. The 0-day market saturated with exploits for iOS that recently we even started to abandon some of them. Por outro lado, thanks to Google and Samsung’s security teams, Android’s security is improving with each new release, so developing complete exploit chains for Android has become a complex and time-consuming task, outperforming even creating zero-click exploits that do not require user interaction”, says Bekrar, explaining the price increase.
Beckrar notes that Android exploits will be valued higher than iOS exploits until Apple improves iOS security and strengthens its weaknesses, such as iMessage and Safari (Webkit and sandbox).