Winner claimed in $1 million iOS 9 hacking contest

Bug bounty firm Zerodium will make the vulnerability information available to its customers

A team of security researchers may have found a way to remotely penetrate the defenses of Apple's latest mobile OS, making them eligible for a $1 million reward.

The money was offered in a contest run by a Washington, D.C.-based company called Zerodium, which is in the controversial business of buying and selling information about software vulnerabilities.

It congratulated the winning team on Twitter Monday, though it didn't identify the researchers, which made its claim about finding a new security hole in iOS 9 impossible to verify.

Apple officials didn't immediately have a comment.

Chaouki Bekrar, Zerodium's founder, said via email that the winning team's exploit "is still being extensively tested by Zerodium to verify and document each of the underlying vulnerabilities."

Apple's iOS is one of the most challenging for hackers to exploit and the company has engineered strong defenses around iOS that make it hard to infect with malware.

Zerodium launched its contest in September, saying it would reward the first group to come up with a remote, browser-based exploit. That means the unauthorized code had to be delivered to an iOS device by getting the user to visit a web page using Chrome or Safari, or via a text or multimedia message sent to the device, according to Zerodium's conditions.

"It's definitely very technically challenging," said Patrick Wardle, director of research with Synack, a service that matches security researchers with bug-hunting work.

Despite the difficulty, enthusiasts have found ways around Apple's defenses in the past to install unapproved apps, a process known as jailbreaking.

Jailbreakers usually want to run apps from Cydia, a store for unauthorized apps. The jailbreak exploit code is publicly available and those who developed it weren't paid.

Zerodium, however, keeps the vulnerabilities it buys close and only makes them available to clients who subscribe to its Security Research Feed.

Bekrar said the vulnerabilities found by the winning team may be reported to Apple later by Zerodium.

The reward that the company is allegedly paying shows how valuable the information could be to other companies, organizations and even nation states.

"If they’re paying a million dollars, I'm sure that means someone is willing to buy it for that or more," Wardle said in a phone interview Monday.

The flaws are known as "zero-day" vulnerabilities since Apple hasn't had time yet to develop a patch. It may be hard for Apple to figure out how to fix the flaws if more information doesn't leak out.

Wardle said the team likely found several software flaws that are used in a chain to ensure any planted code stays on an iOS 9 device even after it is rebooted.

That probably means the group has found a browser vulnerability and then another one around the core of the operating system, known as the kernel, Wardle said. A third flaw would also be needed to ensure the unauthorized code stays on the device on reboot since Apple checks for strange apps, he said.

Bekrar wouldn't reveal much detail other than that "the exploit chain includes a number of vulnerabilities affecting both Google Chrome browser and iOS, and bypassing almost all mitigations in place."

A second team also participated in the contest as well, Bekrar wrote. That team developed a partial jailbreak and may be eligible for partial reward, he said.

Bekrar also founded Vupen, a now-shuttered vulnerability broker that sold information to government agencies and other organizations.

Vupen's business model was criticized by some in the security community, who contended that sharing vulnerability information without notifying software vendors could put people at unnecessary risk if the information is abused.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?