A new US$500,000 iOS bug bounty beats Apple's offer

Security firm Exodus Intelligence will give between $5,000 and $500,000 for zero-day vulnerabilities relating to iOS

Comments

A security firm is offering up to US$500,000 for information on zero-day vulnerabilities in iOS, surpassing Apple's bug bounty just days after it was announced.

On Tuesday, Texas-based Exodus Intelligence said it will give between $5,000 and $500,000 for zero-day vulnerabilities relating to iOS version 9.3 and higher.

These zero-days are software flaws that have gone undetected by Apple, making them potentially very valuable, especially for cyber criminals who can use them to hack iPhones.

Exodus’s announcement might draw interest away from Apple’s own bug bounty program, which was unveiled last week.

Apple is giving as much as $200,000 for critical vulnerabilities in iOS. To ensure it receives quality results, Apple initially is only inviting a few dozen security researchers to participate. That doesn’t mean Apple will turn away other researchers. Non-invitees can also submit vulnerabilities to the company and receive a reward.

It’s the first time Apple has announced a bug bounty program. Other tech giants including Google and Microsoft have offered them for years as a way to encourage hackers to turn over bugs rather than sell details of them to bad actors.

However, zero-day vulnerabilities are also valuable to private security companies. Exodus Intelligence makes its business by alerting clients of critical threats before the software providers and hackers even know of them.

The company claims it can warn clients of the flaws up to two years in advance. Its bug bounty program is also offering rewards for zero-day vulnerabilities relating to Google Chrome and Microsoft’s Edge browser.

Exodus Intelligence isn’t the only private security firm to offer a high bounty for bugs. Last year, Zerodium said it would pay out $1 million for an exclusive, browser-based way to compromise Apple’s iOS.

The reward has expired, but Zerodium still offers $500,000 rewards for zero-day vulnerabilities relating to iOS.

These flaws can also be useful to law enforcement authorities. For example, the FBI reportedly paid hackers to use an unknown iOS flaw to access a terrorist's locked iPhone.