Hacker News Reader

Comment by Alifatisk | Hacker News Reader

I wonder how much this would be worth for Zerodium

$0, given it's patched in ios 18.6.2

Before that obviously. Possibly pc meant to ask if the “finder” would have gone to them instead of dealing with Apple directly.

The AirDrop requirement probably decreases its value substantially, but I think all these kinds of questions are kind of tricky to reason about:

https://news.ycombinator.com/item?id=43025038

This might be a weird corner case where Apple would outbid the grey market, but generally even though Apple comes in lower than the grey market (for these very specific kinds of vulnerabilities), the term sheets are different, and the rest of the terms tend to favor going with Apple.

And given that Zerodium has shut down.

Its website still works and there's a gpg key, so it's a "shutdown" rather than shutdown.

I know the thread is saying $0 because Zerodium doesn't exist anymore, but there are others. This [0] one for a full chain mobile iOS is at $15M. I agree with tptacek though, the airdrop would reduce the value but you may still be in the low 7 figure range for 0 click RCE.

0. https://advance-sec.com/#bounty

I don't think this is real. "Full chain Linux desktop" for $10MM? Uh huh.

We recorded a podcast with Mark Dowd a year ago where he said nobody actually gets "list prices" for iOS full chain at $2.5MM (you can make considerably more than that by selling to multiple parties and by selling maintenance) --- and that's iOS, the highest-valued vulnerabilities.

$0, since I don't think Zerodium still exists.

Reply on news.ycombinator.com