Hacker News Reader

Comment by heavyset_go | Hacker News Reader

For reference, iOS exploits are cheaper than Android exploits because iOS exploits are so plentiful[1][2].

Android being open source makes it easier for more parties to audit the software they run, and not just groups that are paid handsomely to exploit iOS for state sponsored hacking.

[1] https://www.theregister.com/2020/05/14/zerodium_ios_flaws/

[2] http://zerodium.com/program.html

View on HN

This is a double edged sword, because while there might be fewer Android exploits discovered per year, the number of publicly-known and exploitable vulnerabilities in circulation at any given time is almost certainly lower on iOS, where most users have updated to the latest version within two weeks of its release, than on any device in the fragmented Android ecosystem, where only users of devices from proactive vendors even have the option to update their device to the latest version with upstream security patches. And that's assuming their device isn't EOL, which tends to happen more quickly to Android devices than Apple devices, despite the latter's reputation for planned obsolescence.

To nuance that, Android is also much more modular in its updates than iOS, an outdated Android depends on the security flaw itself to be exploitable or not, it really depends. On iOS, the system is exploitable in 100% of the cases if not updated and keeping the system always up to date is even more critical.

I have been wondering what's the actual status of iOS updates outside of the US, or in countries where nobody uses wifi? I just checked that my SO's iOS was on 16.3.1, over 2 months old iOS version.

Apple has decided that iOS should only accept downloading OS updates over wifi. In my country, for example, people don't really set up wifi at home anymore because basically everyone has unlimited cellular data. So they don't need to connect to any wifi at all. All the iOS update statistics seem to come from the US, where everyone relies on wifi.

It seems that on some level, iOS suffers from the same update problem as Android, but only because Apple decided to do so for no reason. Not everyone lives in the US.

Apple allows downloading updates over cellular network. However, it seems to not be allowed in every country [0]. To be more specific, I think each mobile carrier can choose whether or not to allow it on their network, and iOS enforces it. I'm not totally sure though.

[0] https://osxdaily.com/2022/08/05/how-to-update-your-iphone-ov...

Your [1] is 3 years old and has quite a few caveats (temporary situation, non-Zerodium security experts don't quite seem to agree with the decision), and the diagrams in [2] don't seem to show that iOS exploits are any cheaper today.

Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit".

Is this still true today?

The Zerodium payout structure has not changed in the 3 years since that article's publication[3].

And that is the way news works. It was news 3 years ago when iOS exploits became cheaper, now it's just how the market is.

> Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit".

From Wired[4]:

> Shwartz credits Android's increased security partly to its open-source strategy finally paying off. While Apple has kept its operating system so locked down that even benevolent security researchers have difficulty sussing out its bugs—a problem it's tried to solve with a recent expansion and opening up of its bug bounty program—Android's open-source approach has meant more eyes on its code. While that broadness initially led to more bugs, those vulnerabilities have been patched over time, slowly hardening the operating system. "So many vulnerabilities have been patched that the attack surface is decreased dramatically," says Shwartz.

[3] https://web.archive.org/web/20201108190905/https://zerodium.....

[4] https://www.wired.com/story/android-zero-day-more-than-ios-z...

Regardless, the diagram on the Zerodium website (at http://zerodium.com/program.html, under "ZERODIUM Payouts for Mobiles") does not seem to indicate that iOS exploits are cheaper. Am I missing something?

The most serious category of attack, a Zero Click FCP, has Android at $2.5M and iOS at $2M. To be fair, the difference is negligible and both are only about as expensive as starting a new McDonalds and easily fall within the scope of a standard small business loan. So yeah, trivially hacking any phone in the world is only within the financial means of around 60 million people in the world.

The main difference on that page isn't between iOS and Android, but server/desktop and mobile. Former is cheap!

Is there anywhere that tracks more current prices?

Zerodium buying mobile exploits for $2-2.5M does not mean that a buyer can go out shopping for an exploit and find one in that price range. Exploits are a highly illiquid market and there is going to be a big bid-ask spread. Plus a lot of middlemen are restricted in various ways in terms of who they sell to. Then there the issue of building an actual capability around the base exploit... There's a reason why we don't have thousands of NSO-like small businesses running around.

What the diagram doesn’t tell you is that it is the maximum possible payment for an exploit, and to get it for Android it needs to work on far many more operating system versions than iOS as well as being independent from Google Play Services.

Zerodium pays out based on the maturity of the exploit, how many versions it covers and what are its dependencies and ease of exploit.

More than open-source, I would say it's also due to the fact that on Android there's no homemade apps with private apis like on iOS.

Apple's security model clearly excludes their own apps and that shows on the issues publicly released.

Secondly, on Android, very few system components are actually tied to the OS version, and it's getting thinner after every version. On iOS it's the norm.

Reply on news.ycombinator.com