Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Million Dollar iOS9 Bug Bounty

zerodium.com

Post reply on HN
Print view View original

51–60 of 80 posts

Re: Million Dollar iOS9 Bug Bounty

#51

Post by brotoss »

jbeales wrote: post #48
tptacek wrote: post #36

And all you have to do is sell your unicorn vulnerability to this company: ZERODIUM customers are major corporations in defense, technology, and finance, in need of advanced zero-day protection, as well as government organizations in need of specific and tailored cybersecurity capabilities The offer to buy RCE in PHPBB/vBulletin is a nice touch.

If I had a bug that met the criteria I'd give Apple first dibs. That way the bug would get fixed, and I'd still get my $1M.

You know very little about bug bounties and how company's handle them.

Re: Million Dollar iOS9 Bug Bounty

#52

Post by concernedctzn »

soisses wrote: post #44
concernedctzn wrote: post #23

Earlier quoted context omitted.

Yes, the stagefright vulnerability in Android ( http://arstechnica.com/security/2015/07/950-million-android-... )

The stagefright bugs gave control over the media-player daemon of Android. This daemon is not running as root, it's even jailed with SELinux, but it has some interesting permissions like microphone-access. Despite the media hype you can't root your phone with the stagefright bugs and so it wouldn't qualify for the bounty.

Some of those other interesting permissions are the ability to open arbitrary network/bluetooth sockets, read/write to external storage, and access the camera[1].

Mediaserver is not full root but it is pretty privileged. Given all of this access it wouldn't take much work to incorporate another privilege escalation bug to get root on the phone anyway, and there is zero user interaction.

[1] https://www.blackhat.com/docs/us-15/materials/us-15-Drake-St...

Re: Million Dollar iOS9 Bug Bounty

#53

Post by josu »

captainmuon wrote: post #20
Klathmon wrote: post #19

I might be missing something, but has there ever been any exploit (or string of simultaneous exploits) for iOS or android which meets all the criteria? It must be through a text message or web page, it must be remote, reliable, silent, require no interaction, must be entirely comprised of 0-day exploits throughout the whole chain, must affect multiple architectures and all supported devices, and must bypass all secur…

You used to be able to jailbreak one of the first iPhones and install Cydia just by visiting some page in Safari and clicking on a button, IIRC. I never did this myself, so my memories might be inaccurate though.

It was actually a clever "Slide to Jailbreak" rather than a click.

https://en.wikipedia.org/wiki/JailbreakMe

Re: Million Dollar iOS9 Bug Bounty

#54

Post by soisses »

concernedctzn wrote: post #52
soisses wrote: post #44

Earlier quoted context omitted.

The stagefright bugs gave control over the media-player daemon of Android. This daemon is not running as root, it's even jailed with SELinux, but it has some interesting permissions like microphone-access. Despite the media hype you can't root your phone with the stagefright bugs and so it wouldn't qualify for the bounty.

Some of those other interesting permissions are the ability to open arbitrary network/bluetooth sockets, read/write to external storage, and access the camera[1]. Mediaserver is not full root but it is pretty privileged. Given all of this access it wouldn't take much work to incorporate another privilege escalation bug to get root on the phone anyway, and there is zero user interaction. [1] https://www.blackhat.com/d…

There isn't much in the list that applications like Hangout or Chrome don't have anyway. It's still a very serious vulnerability, but the overstating is just clever marketing by a security company.

Re: Million Dollar iOS9 Bug Bounty

#55

Post by rimantas »

userbinator wrote: post #18
lawnchair_larry wrote: post #12

Sounds like ios8 will be the last jailbreakable version. Shame.

If the last 8 versions were jailbreakable I think this one will be too - eventually - but it is certainly the case that devices are becoming more secure both for and against their owners. The tension between freedom and security is definitely increasing.

OTOH, Apple TV 3 was never jailbroken, iirc. Sure, that may just mean not enough interest.

Re: Million Dollar iOS9 Bug Bounty

#57

Post by ikeboy »

Miner49er wrote: post #42
tptacek wrote: post #36

And all you have to do is sell your unicorn vulnerability to this company: ZERODIUM customers are major corporations in defense, technology, and finance, in need of advanced zero-day protection, as well as government organizations in need of specific and tailored cybersecurity capabilities The offer to buy RCE in PHPBB/vBulletin is a nice touch.

It's a win-win for Zerodium. They are getting free publicity for having the biggest bug bounty ever, and if somebody actually does submit a working exploit, they sell it to their clients for a hefty profit. I'm sure there are government agencies that would pay well over a million for the ability to infect any IOS device silently and easily.

You can sell the same exploit to multiple governments.

Re: Million Dollar iOS9 Bug Bounty

#58

Post by ikeboy »

userbinator wrote: post #18
lawnchair_larry wrote: post #12

Sounds like ios8 will be the last jailbreakable version. Shame.

If the last 8 versions were jailbreakable I think this one will be too - eventually - but it is certainly the case that devices are becoming more secure both for and against their owners. The tension between freedom and security is definitely increasing.

But who's going to release one publically when they can get $1 million for not doing so?

Re: Million Dollar iOS9 Bug Bounty

#60

Post by saurik »

soisses wrote: post #44
concernedctzn wrote: post #23

Earlier quoted context omitted.

Yes, the stagefright vulnerability in Android ( http://arstechnica.com/security/2015/07/950-million-android-... )

The stagefright bugs gave control over the media-player daemon of Android. This daemon is not running as root, it's even jailed with SELinux, but it has some interesting permissions like microphone-access. Despite the media hype you can't root your phone with the stagefright bugs and so it wouldn't qualify for the bounty.

> Despite the media hype you can't root your phone with the stagefright bugs and so it wouldn't qualify for the bounty.

Alone? No. As part of a "chain" of exploits, which is what this bounty is calling for, in concert with a privilege escalation? Yes. That bug allowed for remote and silent (due to executing in a way which would allow it to suppress notifications of the incoming message) arbitrary code execution as a user on the device, which, even as a user with minimal permissions or which has been sandboxed in some way, affords you the ability to do much much more on the device than you could before the exploit.

FWIW, the actual release included a demo of rooting a device on stage; they have a video with a similar demo. I presume the second bug they were using was an already-fixed kernel bug, but if you have something like stagefright your next step is to go hunting for such a bug. (Regardless, the question you were responding to was more about how most of the exploits people put together do not satisfy the "remote" and "silent" parts, as opposed to the "I got root" part; the latter is comparatively easy.)

https://www.youtube.com/watch?v=PxQc5gOHnKs

Post reply on HN