As we have mentioned in previous occasions, the concept “zero-day vulnerability” refers to flaws in software never before discovered and whose exploitation does not require user of the compromised system interaction. Among the cybersecurity community, there are companies like Zerodium that buy reports on zero-day vulnerabilities, but it’s important to ask yourself: why is the interest in these security flaws?
While malicious hackers seek such vulnerabilities to cause severe large-scale damage, tech companies and some companies like Zerodium, known as “exploit brokers,” try to collaborate closely with researchers discovering these flaws to prevent their exploitation and strengthen the security of the most widely used technological ecosystems in the world.
According to cybersecurity experts, Zerodium is currently looking for the acquisition of zero-day exploits that impact some of the most commonly used software implementations today, including developments such as:
- Operating systems: Microsoft Windows, Linux, Apple macOS, among others
- Browsers: Chrome, Edge, Firefox and Safari
- Smartphones: Apple iOS in its versions 12.x and 13.x, Android 8.x and 9.x, BlackBerry 10 and Windows 10 Mobile
- Routers: ASUS, Cisco, D-Link, Huawei, Linksys, MikroTik, Netgear, TP-Link
- Email servers: Microsoft Exchange, Dovecot, Postfix, Exim and Sendmail
On the other hand, by releasing updates to its vulnerability bounty program, the company announced that now it’s willing to pay up to $2.5 million USD for vulnerabilities in the Android operating system that do not require victims’ interaction for their exploitation, the highest amount ever paid for an Android flaw. Second, the company will pay up to $2 million USD for a similar exploit on iOS, Apple’s operating system.
The popular idea, according to cybersecurity experts, is that iOS devices have always been more secure than those running Android OS, so why is Zerodium willing to pay more money for a supposedly easier to discover flaw? Cybersecurity experts mention that there are two reasons for this; first, the latest versions of the Android operating system have become more secure, so zero-days are becoming increasingly difficult to find. In addition, multiple zero-day vulnerabilities have recently been revealed on iOS, even during the beta test of the new iOS 13 system, a phenomenon that has influenced on the value that receive flaws in this system.
With the announcement of Zerodium, we can only wait for researchers to be able to discover these failures in the systems mentioned, however, there is still a disjunction for experts; in case of discovering one of these flaws, experts will have to decide whether to report directly to the affected companies, or to resort to exploit brokers, which offer better rewards but which tend to resell these reports to companies or even some government agencies.
According to experts from the International Cyber Security Institute (IICS) companies like Zerodium have been increasing the amounts they offer as a reward for these kinds of errors. The company recently announced rewards of up to $500,000 for Linux errors, as well as for multiple system distributions.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
