Zerodium Offering $1M for Tor Browser Zero Days -

Zerodium Offering $1M for Tor Browser Zero Days

Credit: threatpost.com

  • About: 8 days ago
  • 3 views

The exploit acquisition vendor Zerodium is doubling down again.

Weeks after the company said it would pay $500,000 for zero days in private messaging apps such as Signal and WhatsApp, Zerodium said Wednesday it will pay twice that for a zero day in Tor Browser.

The company said it will pay up to $1 million for fully functional, unknown zero day exploits for Tor Browser on Tails Linux and Windows. Specifically, the company said it will pay $250,000 for combined remote code execution and local privilege escalation bugs that work on both Tails and Windows to root/system, or $200,000 for combined bugs in Tails or Windows. It will pay an abbreviated bounty for just RCE vulnerabilities, and vulnerabilities executed when JavaScript is allowed.

The company said that any exploits that require manipulating of Tor nodes, or exploits that would disrupt the network itself won’t be accepted. Submissions must include the full, unknown and previously unpublished, exploit, alongside a whitepaper explaining the techniques. Zerodium says an attack vector has to be a web page targeting the latest version of the browser, either in its default configuration where JavaScript is allowed to run with its security settings set to low, or in a hardened configuration where JavaScript is blocked.

Like it did when it announced the messaging app bounties, Zerodium says the Tor bounty is designed to help its government customers track criminals who use the anonymous browser.

When reached on Wednesday, a Tor Project spokesperson said the high payout was a good example of the security the browser provides. But, he also suggested participating in Zerodium’s bug bounty program could put Tor users’ lives at stake.

“We think the amount of the bounty is a testament to the security we provide. We think it’s in the best interest of all Tor users, including government agencies, for any vulnerabilities to be disclosed to us through our own bug bounty. Over 1.5 million people rely on Tor everyday to protect their privacy online, and for some it’s life or death. Participating in Zerodium’s program would put our most at-risk users’ lives at stake.”

Zerodium, launched in 2015 by VUPEN cofounder Chaouki Bekrar, has made a name for itself by offering lofty payouts for high-risk zero-day exploits. Shortly after it was founded the company offered a million-dollar bounty centered on iOS 9. It then one upped itself by offering a $1.5 million bounty for information pertaining to an iOS 10 remote jailbreak around this time last year.

The company in August said that a spike in demands from its customers, democratic and non-sanctioned governments, combined with the small attack surface of private messaging apps, led to a change in bounty pricing. Zerodium said Wednesday the fact the Tor Browser is used in “many cases” by attackers to carry out drug trafficking and child abuse has helped contributed to demand for zero days.

Unlike the private messaging app bounty, which is ongoing, the company’s Tor Browser exploit bounty is limited. Zerodium said the Tor bounty is open until November 30 at 6 p.m., or until the payout reaches $1 million.

Follow Us on Twitter

Related stories with Zerodium Offering $1M for Tor Browser Zero Days

EU lost up to 5.4 billion euros in tax revenues from Google, Facebook - report -World News
EU lost up to 5.4 billion euros in tax revenues from Google, Facebook - report 8 days ago
BRUSSELS (Reuters) - European Union states could have lost 5.4 billion euros (£4.87 billion) in tax revenues from Google and Facebook between 2013 and 2015, according to a report of the EU lawmaker responsible for a corporate tax reform that could raise
Aircel-Maxis FIPB clearance: CBI summons Karti Chidambaram -World News
Aircel-Maxis FIPB clearance: CBI summons Karti Chidambaram 8 days ago
Two weeks after CBI questioned him for alleged corruption in Foreign Investment Promotion Board (FIPB) clearance given to INX Media, the agency has now asked former finance minister P Chidambaram’s son Karti Chidambaram to join for questioning in connec
Former BJP MP Tarun Vijay gifts Sitharaman a portrait of Indian maritime power icon Rajendra Chola -World News
Former BJP MP Tarun Vijay gifts Sitharaman a portrait of Indian maritime power icon Rajendra Chola 8 days ago
Tarun Vijay, President of Students and Youth for Thiruvalluvar and former MP, presented the magnificent portrait of Rajendra Chola, the great icon of India's maritime power and naval empire to Union defence minister Nirmala Sitaraman at her south block of
BMWBLOG Partnering with Michelin for $100 off on a set of tires -World News
BMWBLOG Partnering with Michelin for $100 off on a set of tires 8 days ago
As you might already know, we’re big fans of Michelin, here at BMWBLOG. The French tire manufacturer has been BMW’s tire company of choice for … The article BMWBLOG Partnering with Michelin for $100 off on a set of tires appeared first
Fake bomb threats sweep Russia, forcing thousands to evacuate landmark buildings -World News
Fake bomb threats sweep Russia, forcing thousands to evacuate landmark buildings 8 days ago
Dozens of landmark buildings and transport hubs in Russia have been evacuated because of fake bomb threats made by unknown telephone callers. Citing security service officials, Russian media said up to 30,000 people were ordered to leave major buildings i
Belgian religious group defies Pope Francis for allowing euthanasia in its hospitals -World News
Belgian religious group defies Pope Francis for allowing euthanasia in its hospitals 8 days ago
A Belgian religious congregation is defying Pope Francis’ order to stop allowing euthanasia in its psychiatric hospitals, saying that its decision to do so is fully consistent with Catholic doctrine. In a statement, the Belgian branch of the Brother
Meet the 525 horsepower Shelby Baja Raptor, the Cobra of trucks -World News
Meet the 525 horsepower Shelby Baja Raptor, the Cobra of trucks 8 days ago
Filed under: Aftermarket,Ford,Truck,Off-Road,Performance There are a number of upgrades to the suspension, too.Continue reading Meet the 525 horsepower Shelby Baja Raptor, the Cobra of trucks Meet the 525 horsepower Shelby
2017 Frankfurt Motor Show: Observations on the Ferrari Portofino, Honda Urban EV and more -World News
2017 Frankfurt Motor Show: Observations on the Ferrari Portofino, Honda Urban EV and more 8 days ago
Filed under: Green,Frankfurt Motor Show,Audi,BMW,Ferrari,Mercedes-Benz,Tesla,Technology,Convertible,Luxury,Performance Automakers find themselves at the intersection of disruption and opportunity.Continue reading 2017 Frankfurt M
Elderly Man Pushes Suspect Off Roof, Ends Police Standoff -World News
Elderly Man Pushes Suspect Off Roof, Ends Police Standoff 8 days ago
LA PUENTE, Calif. (AP) — An 83-year-old man ended a police standoff that lasted for hours when he pushed a suspected burglar off his roof in La Puente. Los Angeles County Sheriff’s Department officials say the male suspect was jumping from rooftop
Berkeley Loosens Rules on Police Pepper-Spraying Protesters -World News
Berkeley Loosens Rules on Police Pepper-Spraying Protesters 8 days ago
BERKELEY, Calif. (AP) — For the first time in 20 years, police in the city of Berkeley can use pepper spray on violent demonstrators. The City Council voted 6-3 Tuesday to allow police to use pepper spray to repel attacks on officers and others during t
Our Souls at Night Trailer and Key Art for the Redford/Fonda Film -World News
Our Souls at Night Trailer and Key Art for the Redford/Fonda Film 8 days ago
Robert Redford and Jane Fonda's fourth film together debuts on Netflix September 29 The post Our Souls at Night Trailer and Key Art for the Redford/Fonda Film appeared first on ComingSoon.net.
Airport Sleep Pods are Providing a Respite for Stranded Passengers -World News
Airport Sleep Pods are Providing a Respite for Stranded Passengers 8 days ago
Is this the next generation in the evolution of airport hotels? -Deanna Ting