Hacker News Reader

Comment by saltedonion | Hacker News Reader

What is the business model of this company? Are they selling such exploits to whoever is willing to pay the most?

And does this mean Android is more secure?

If you take the press release at face value, it means Android has fewer newly-discovered vulnerabilities on the open market right now. That's probably good news for Android, but there are alternative explanations too: maybe Google is paying more for their exploits to keep them hidden, for example. Or maybe Zerodium is trying to get Apple to sign a new/bigger contract and applying pressure.

This is all, indeed, a pretty shady business. I don't think there's anything authoritative we can say from the outside.

or maybe being closed source didnt help apple in the long run

Too simplistic of an answer, though it could be part of it.

I think we wrap ourselves in a bit of false security when we say something is open source and think that automatically makes it more secure. We assume someone has looked at the source. But has anyone really? And those with the most incentive to look into these things might not be inclined to share the vulnerabilities back to the community for safety's sake, given the princely sums being offered by companies like Zerodium.

Funny how Microsoft is now saying they were "on the wrong side before" with open source.

Let that sink in...

Apple is the device to exploit right now which drove supply. Meanwhile Google, Project Zero and companies like Copperhead are actively securing Android.

This sounds really logical to me but also raises yet more questions.

How much is Zerodium charging people for these exploits if Apple isn’t paying?

Sure, they could stick the knife in if Craig Federeghi calls up to ask how much, but you’d assume it’s nothing to Apple to spin up an arms-length subsidiary with a folksy name to buy the info through.

Companies can subscribe to a feed of 0-day exploits ("Zero-Day Research Feed"), for what I assume is a hefty fee, large enough to make a profit despite millions of dollars spent on exploit acquisition.

Their website says they mostly sell to North American and European governments.

I can only assume this is for offensive purposes, since they can’t patch the kernel/software even if they know how the exploits work.

Reply on news.ycombinator.com