Vupen launches new zero-day acquisition firm Zerodium

Minimalist · Jul 24, 2015

In the weeks since the Hacking Team breach, the spotlight has shone squarely on the small and often shadowy companies that are in the business of buying and selling exploits nd vulnerabilities. One such company, Netragard, this week decided to get out of that business after its dealings with Hacking Team were exposed. But now there’s a new entrant in the field, Zerodium, and there are some familiar names behind it.
Click to expand...

https://threatpost.com/vupen-launches-new-zero-day-acquisition-firm-zerodium

elapsed · Jul 24, 2015

Well, that's not good.

Minimalist · Jul 24, 2015

Yes, not good at all. But you know - where there is demand, there will be supply.

Minimalist · Nov 3, 2015

Somebody really wanted this one, I guess.

Hackers win $1 million bounty for iOS 9 remote hack

A team of hackers has received a million-dollar payout for disclosing a iOS zero-day vulnerability that could allow an attacker to remotely hack any Phone.
Click to expand...

http://securityaffairs.co/wordpress/41674/hacking/hackers-zero-day-iphone.html

Minimalist · Nov 21, 2015

Zerodium price list for secret Hacking methods

The Zerodium (Zero-day broker) company has published a price list for various classes of software targets and digital intrusion methods.
Click to expand...

http://securityaffairs.co/wordpress/42136/hacking/zerodium-hacking-pricelist.html

Minimalist · Jan 5, 2016

Exploit Vendor Zerodium Puts $100,000 Bounty on Flash's New Security Feature

Zerodium, the company that buys zero-day bugs from security researchers and then sells them forward to government intelligence agencies, has put out a new bounty, this time on Adobe's Flash Player.
Click to expand...

http://news.softpedia.com/news/expl...-on-flash-s-new-security-feature-498470.shtml

Minimalist · Sep 29, 2016

Zerodium triples its IOS 10 bounty to $1.5 million

Zerodium has tripled the bounty it offers for an Apple iOS 10 remote jailbreak, boosting the reward today to $1.5 million USD, founder Chaouki Bekrar said.
Click to expand...

https://threatpost.com/zerodium-triples-its-ios-10-bounty-to-1-5-million

Minimalist · Aug 23, 2017

Zerodium, a vendor operating in the nebulous exploit acquisition market, has put a premium on zero-day vulnerabilities in secure messaging applications in a new pricing structure announced today.

Remote code execution and local privilege elevation zero days in messaging apps such as WhatsApp, Signal, Facebook Messenger, iMessage, Telegram and others can fetch $500,000 from the company’s program.
Click to expand...

https://threatpost.com/zerodium-offers-500k-for-secure-messaging-app-zero-days

Minimalist · Sep 13, 2017

The exploit acquisition vendor Zerodium is doubling down again.

Weeks after the company said it would pay $500,000 for zero days in private messaging apps such as Signal and WhatsApp, Zerodium said Wednesday it will pay twice that for a zero day in Tor Browser.

The company said it will pay up to $1 million for fully functional, unknown zero day exploits for Tor Browser on Tails Linux and Windows. Specifically, the company said it will pay $250,000 for combined remote code execution and local privilege escalation bugs that work on both Tails and Windows to root/system, or $200,000 for combined bugs in Tails or Windows. It will pay an abbreviated bounty for just RCE vulnerabilities, and vulnerabilities executed when JavaScript is allowed.
Click to expand...

https://threatpost.com/zerodium-offering-1m-for-tor-browser-zero-days

Minimalist · Jun 29, 2018

Rewards of Up to $500,000 Offered for FreeBSD, OpenBSD, NetBSD, Linux Zero-Days

Exploit broker Zerodium is offering rewards of up to $500,000 for zero-days in UNIX-based operating systems like OpenBSD, FreeBSD, NetBSD, but also for Linux distros such as Ubuntu, CentOS, Debian, and Tails.

The offer, first advertised via Twitter earlier this week, is available as part of the company's latest zero-day acquisition drive. Zerodium is known for buying zero-days and selling them to government agencies and law enforcement.
Click to expand...

https://www.bleepingcomputer.com/ne...d-for-freebsd-openbsd-netbsd-linux-zero-days/

Minimalist · Jan 7, 2019

Zerodium offers $2 million for iOS zero-days

A startup company famous for purchasing zero-day exploits is increasing its bounties to anyone who discovers one in Apple operating systems or popular messaging technologies.
Click to expand...

https://www.cyberscoop.com/zerodium-ios-2-million-zero-day-whats-app-chrome/

guest · Mar 5, 2019

Zerodium offering big bucks for cloud zero-days
March 5, 2019
https://www.zdnet.com/article/hide-...odium-offering-big-bucks-for-cloud-zero-days/

Exploit vendor Zerodium announced today plans to pay a whopping $500,000 for zero-days in popular cloud technologies like Microsoft's Hyper-V and (Dell) VMware's vSphere.

With cloud services growing in adoption, especially for hosting websites and crucial IT infrastructure, the importance of both technologies has been slowly increasing in recent years.
"The exploits must work with default configs, be reliable, and lead to full access to the host," the company said on Twitter.

The company's move to hike up hypervisor exploit payouts comes after Microsoft anted up payments for Hyper-V bugs last summer when it began paying up to $250,000 for similar exploits, outbidding Zerodium and all other exploit buyers.
Click to expand...

https://twitter.com/Zerodium/status/1102911650313592835

guest · Sep 4, 2019

Zerodium Makes Android Zero Days More Expensive Than iOS
September 3, 2019
https://www.bleepingcomputer.com/ne...es-android-zero-days-more-expensive-than-ios/

Exploit broker Zerodium has updated the payouts for eligible zero-day Android and iOS exploits, with rewards for Android 0days having surpassed the ones for iOS for the first time since 2015 when the company was founded.
This change was advertised via a Twitter post which also mentions that rewards for iMessage and WhatsApp 0-click exploits have also been increased, while payouts for iOS 1-click has been decreased based on current market trends.

Zerodium also introduced new categories of exploits, with Android full chain (0-Click) exploits with persistence having a $2,500,000 price tag, while Apple iOS persistence techniques or exploits are valued at $500,000.
Even higher rewards for exceptional zero-days
The company decreased some payouts, with Apple iOS full chain (1-Click) exploits with persistence now being priced at $1,000,000 from the previous $1,500,000, while iMessage RCE + LPE (1-Click) exploits without persistence will now net security researchers willing to sell their original and previously unreported zero-days only $500,000 less than the previous bounty.
Click to expand...

iOS exploits flooding the market
Zerodium's CEO Chaouki Bekrar told BleepingComputer that "the last few months, we have observed an increase in the number of iOS exploits, mostly Safari and iMessage chains, being developed and sold by researchers from all around the world. The zero-day market is so flooded by iOS exploits that we've recently started refusing some [of] them."

Given this new market context and trends, the company decided to allocate the highest payouts to Android exploits "until Apple re-improves the security of iOS and strengthens its weakest parts which are iMessage and Safari (Webkit and sandbox)."
Click to expand...

Zerodium: Changelog / Sep 3rd, 2019 - Payouts for major mobile exploits have been modified

Minimalist · Apr 9, 2021

Zerodium triples WordPress remote code execution exploit payout

Zerodium has announced today an increased interest in exploits for the WordPress content management system that achieve remote code execution.

The exploit acquisition platform is now enticing exploit developers and sellers with a $300,000 payout, three times more than the regular price.
Click to expand...

https://www.bleepingcomputer.com/ne...rdpress-remote-code-execution-exploit-payout/

Minimalist · Oct 19, 2021

Zerodium wants zero-day exploits for Windows VPN clients

In a short tweet today, exploit broker Zerodium said that it is looking to acquire zero-day exploits for vulnerabilities in three popular virtual private network (VPN) service providers on the market.
Click to expand...

https://www.bleepingcomputer.com/ne...ts-zero-day-exploits-for-windows-vpn-clients/

Minimalist · Jan 29, 2022

Zerodium Spikes Payout for Zero-Click Outlook Zero-Days

Zerodium has jacked up its offering price for Microsoft Outlook zero-day exploits.

Act fast if you have the goods and the moral equanimity, to make up to $400,000 for a zero-click, remote code-execution (RCE) exploit.
Click to expand...

https://threatpost.com/zerodium-payout-outlook-zero-days/178089/

Log in or Sign up

Vupen launches new zero-day acquisition firm Zerodium

Minimalist Registered Member

elapsed Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

Vupen launches new zero-day acquisition firm Zerodium

Minimalist Registered Member

elapsed Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Useful Searches