Million Dollar iOS9 Bug Bounty • Hacker News Board

Re: Million Dollar iOS9 Bug Bounty

#31

Post by cstavish » Mon, Sep 21, 2015, 3:17 PM UTC

soared wrote: post #25

"The whole exploitation/jailbreak process should be achievable remotely, reliably, silently, and without requiring any user interaction except visiting a web page or reading a SMS/MMS (attack vectors such as physical access, bluetooth, NFC, or baseband are not eligible for the Million Dollar iOS 9 Bug Bounty. ZERODIUM may, at its sole discretion, make a distinct offer to acquire such attack vectors.)." Can someone ex…

Back when all iOS apps ran as root, and MobileSafari had a vulnerable libtiff, jailbreakme.com was "easy" by today's standards.

Re: Million Dollar iOS9 Bug Bounty

#32

Post by camillomiller » Mon, Sep 21, 2015, 3:17 PM UTC

jjoe wrote: post #13

Is this a Zerodium ad masquing the politically incorrect PR of "zerodium has 0day exploits available for sale"? I mean how else would anyone advertise availability of 0day without compromising their credibility? $1M per exploit would sure get you lots of press.

Considering the strictness of the requirements, I can think of two options:

- this is just a PR stunt, nobody will realistically deliver such a piece of code before oct. 31st.

- they know that someone in the jailbreak community is cooking something big like that and they're trying to tempt them and acquire a very interesting exploit before anybody else.

Re: Million Dollar iOS9 Bug Bounty

#33

Post by fla » Mon, Sep 21, 2015, 3:18 PM UTC

Saurik, you can do it ;)

Re: Million Dollar iOS9 Bug Bounty

#34

Post by captainmuon » Mon, Sep 21, 2015, 3:19 PM UTC

lawnchair_larry wrote: post #12

Sounds like ios8 will be the last jailbreakable version. Shame.

I wonder if we will now see more hardware-based jailbreaks.

It's a bit like with oil drilling. Once the easily accessible options are gone, people reconsider options that used to be considered too expensive to exploit or too damaging for the environment. Like fracking, oil sands, oil wells that are very deep or far up in the arctic, ...

In the case of iOS explots, maybe you'll be able to jailbreak it over the lightning connector. Maybe you'll have to open the phone and hook up the circuit board to a device. Maybe someone in china will build a robot for phone shops that'll disassemble, jailbreak, and reassemble a phone in seconds (and replace a cracked screen while it is at it). Heck, maybe it'll become economic for criminals to bribe and/or blackmail Apple engineers to put a backdoor into iOS, or to leak keys?

Re: Million Dollar iOS9 Bug Bounty

#35

Post by moviuro » Mon, Sep 21, 2015, 3:29 PM UTC

soared wrote: post #25

"The whole exploitation/jailbreak process should be achievable remotely, reliably, silently, and without requiring any user interaction except visiting a web page or reading a SMS/MMS (attack vectors such as physical access, bluetooth, NFC, or baseband are not eligible for the Million Dollar iOS 9 Bug Bounty. ZERODIUM may, at its sole discretion, make a distinct offer to acquire such attack vectors.)." Can someone ex…

Stagefright (Remote Android code execution) does exactly that http://arstechnica.com/security/2015/07/950-million-android-...

Re: Million Dollar iOS9 Bug Bounty

#36

Post by tptacek » Mon, Sep 21, 2015, 3:32 PM UTC

And all you have to do is sell your unicorn vulnerability to this company:

ZERODIUM customers are major corporations in defense, technology, and finance, in need of advanced zero-day protection, as well as government organizations in need of specific and tailored cybersecurity capabilities

The offer to buy RCE in PHPBB/vBulletin is a nice touch.

Re: Million Dollar iOS9 Bug Bounty

#37

Post by Mahn » Mon, Sep 21, 2015, 3:44 PM UTC

tptacek wrote: post #36

And all you have to do is sell your unicorn vulnerability to this company: ZERODIUM customers are major corporations in defense, technology, and finance, in need of advanced zero-day protection, as well as government organizations in need of specific and tailored cybersecurity capabilities The offer to buy RCE in PHPBB/vBulletin is a nice touch.

So, let me get this straight, this company is in the business of buying zero-day exploits and selling them to corporations and government organizations. How does this even exist? Is it legal? Can anyone buy and sell zero day exploits with total impunity?

Re: Million Dollar iOS9 Bug Bounty

#38

Post by natch » Mon, Sep 21, 2015, 3:44 PM UTC

stirlo wrote: post #4

ins0 wrote: post #3

The exploit/jailbreak must support and work reliably on the following devices (32-bit and 64-bit when applicable): - iPhone 6s / iPhone 6s Plus / iPhone 6 / iPhone 6 Plus - iPhone 5 / iPhone 5c / iPhone 5s - iPad Air 2 / iPad Air / iPad (4rd generation) / iPad (3th generation) / iPad mini 4 / iPad mini 2 So did i read this correct and the exploit must be backwards compatible in order to get the full bounty?

Seems to just be a list of iOS 9 supported devices...

iPhone 4s can run iOS 9 and is not on the list.

Re: Million Dollar iOS9 Bug Bounty

#39

Post by mbrd » Mon, Sep 21, 2015, 3:45 PM UTC

SlashmanX wrote: post #24

captainmuon wrote: post #20

Earlier quoted context omitted.

You used to be able to jailbreak one of the first iPhones and install Cydia just by visiting some page in Safari and clicking on a button, IIRC. I never did this myself, so my memories might be inaccurate though.

You're correct. jailbreak.me I think it was called

It was always amusing to visit the Apple store and see a jailbroken iPhone on display when this vulnerability worked.

Re: Million Dollar iOS9 Bug Bounty

#40

Post by tptacek » Mon, Sep 21, 2015, 3:45 PM UTC

Mahn wrote: post #37

tptacek wrote: post #36

And all you have to do is sell your unicorn vulnerability to this company: ZERODIUM customers are major corporations in defense, technology, and finance, in need of advanced zero-day protection, as well as government organizations in need of specific and tailored cybersecurity capabilities The offer to buy RCE in PHPBB/vBulletin is a nice touch.

So, let me get this straight, this company is in the business of buying zero-day exploits and selling them to corporations and government organizations. How does this even exist? Is it legal? Can anyone buy and sell zero day exploits with total impunity?

Yes, they can.