Exploit broker Zerodium ups the ante with $500,000 to target Signal and WhatsApp.
Zerodium, the Washington, DC-based broker that launched in 2015, said on Wednesday that it would pay $500,000 for fully functional attacks that work against Signal, WhatsApp, iMessage, Viber, WeChat, and Telegram. The broker said it would start paying the same rate for exploits against default mobile e-mail apps. Those are among the highest prices Zerodium offers. Only remote jailbreaks for Apple’s iOS devices fetch a higher fee, with $1.5 million offered for those that require no user interaction and $1 million for those that do. The jailbreak fees were announced in September 2016 and September 2015, respectively.
“Overall prices are trending up—and quite significantly in many cases, and there’s an increased focus on mobile,” Adam Caudill, a senior application security consultant at AppSec Consulting, told Ars. “The new $500k targets for messaging and default e-mail apps show what a priority attacking individuals via their devices has become (which makes sense, given the recent increase in state-sponsored malware targeting mobile devices via SMS and the like).”
One of the best-known state-sponsored attacks targeting a mobile device was exposed last year when a highly advanced iPhone attack targeted a political dissident in the United Arab Emirates. It combined three separate vulnerabilities that had remained unpatched in iOS to surreptitiously jailbreak an iPhone and install malware that could steal confidential messages from a large number of apps, including Gmail, Facebook, and WhatsApp.
The attack platform—which cost about $8 million for 300 licenses—was developed by NSO Group, an Israeli-based division of US-headquartered company Francisco Partners Management. Apple patched the vulnerabilities shortly after the attack came to light.
Zerodium has long been criticized by some as a broker that, like NSO Group, exposes dissidents, journalists, attorneys, and others to dangerous hacks by governments with no or little oversight. Zerodium officials reject that claim and say access to the exploits the company sells is tightly restricted and available to only a select number of carefully vetted organizations, mostly located in Europe and North America. Zerodium, however, has never disclosed its list of past or current customers, so the assurances are impossible to verify.
The new categories and rising prices in Wednesday’s updated list underscore the growing demand for mobile exploits, as more and more targets of interest rely on phones to send text messages and e-mail. These exploits increasingly use specific high-value apps, such as Signal, that experts say are harder to hack. The hikes are also the result of a steady stream of security protections that, over the past few years, have made phones and the apps that run on them much harder to compromise.
The Zerodium update has other noteworthy mobile additions. For the first time, the broker said it’s actively seeking attacks that exploit basebands, which are the parts of a phone that manage radio communications with a cell carrier. Over the past few years, hackers have increasingly targeted basebands because they often run proprietary firmware that’s usually not as carefully secured as other parts of the phone. Despite being distinct from most phones’ CPUs, baseband hacks can sometimes have ways of compromising the entire device. Zerodium said it will pay $150,000 for advanced baseband exploits.
Other mobile additions included $150,000 for media files or documents that can execute malicious code on a phone and $100,000 for files that bypass security sandbox protections or code-signing requirements or that exploit Wi-Fi functions. That $100,000 fee also applied to hacks that target Signalling System No. 7. The telephony signaling language that more than 800 telecommunications companies around the world use to ensure their networks interoperate is under increased scrutiny as a way to target mobile phone users. Thieves reportedly abused SS7 in May to drain bank accounts protected by two-factor authentication.
Other new exploit categories for servers and desktop computers include:
Zerodium is also increasing the prices it will pay for a range of other exploits, including:
The prices can represent a significant sum in many cases, particularly when compared to many bug bounty programs, which pay only a fraction. Then again, the attacks Zerodium buys generally require more work because they must be fully functional, as opposed to less complex proof-of-concept exploits accepted by many bounty programs. The other big drawback to submitting to Zerodium: exploit developers don’t know where their creations wind up or how, or against whom, they’re used.
The prices also provide a portal into the exploit market. Besides increased appetite for mobile attacks, Wednesday’s update shows growing demand for server-based attacks and those that work against users of the Tor privacy service. If end users didn’t already have good reason to keep their devices updated and limit attack surfaces, they sure have it now.