undefined | Better HN

story

0 pointsmistercheph1y ago0 comments

You are just wrong about 0-day values, e.g. exploit vendor crowdfense's publicly offered rewards for mobile 0-days:

    SMS/MMS Full Chain Zero Click: from 7 to 9 M USD
    Android Zero Click Full Chain: 5 M USD
    iOS Zero Click Full Chain: from 5 to 7 M USD
    iOS (RCE + SBX): 3,5 M USD
    Chrome (RCE + LPE): from 2 to 3 M USDD
    Safari (RCE + LPE): from 2,5 to 3,5 M USD

And "large" tech companies despite having "large" security teams (and "large" scope!) are far from the only ones competent at securing devices/software against PTA. Node.js, linux, bsd's, bitcoin, RoR, firefox, curl, etc. etc. There are dozens of open source projects with 0-day values in excess of 7 figures, (and plenty of private enterprises too!) and apple and google are not in any way specially equipped (or better than others) at dealing with the most dangerous PTA's in the world just because they have the largest armies of overpaid EE/CS grads.

0 comments

vessenes1y ago

I’m past the edit window unfortunately: you’re completely right as far as I can tell.

NSO leaked pricing has not historically differentiated Android or iPhone. I’m not sure where I heard those numbers, but thanks for the correction.

Tiny tiny nit - paying the same for an exploit doesn’t mean you’ll charge the same, but in this case it looks like the value and price structures are what you describe. Sorry!

Slightly less small nit - securing hardware, os and cloud inside some security perimeter model is a lot harder than securing, say, the bitcoin client. So point taken - and, it’s hard at scale, not easy.