Exploit broker Zerodium ups the ante with $500k to target Signal and WhatsApp

Re:Exploit broker Zerodium ups the ante with $500k to target... by julianj on Thursday August 24, 2017 @07:34AM (#15089208)

Yeah... I recently uncovered a way to bypass the tor browser bundle proxy on some linux flavors [0]. Unfortunately, The bounty from the tor project isn't nearly as much[1], but at least I can sleep at night.

[0] https://blog.torproject.org/blog/tor-browser-703-released

[1] https://hackerone.com/torproject

[ Parent | on HN ]

Re:Exploit broker Zerodium ups the ante with $500k to target... by r3bl on Thursday August 24, 2017 @07:43AM (#15089248)

Good job!

If it's not a secret, how much did they pay to you? Seems like this could be considered, at least, a medium severity, and the top bounty they gave so far is only $500. If you don't wanna disclose that, that's perfectly understandable. I'm just curious.

[ Parent | on HN ]

Re:Exploit broker Zerodium ups the ante with $500k to target... by julianj on Thursday August 24, 2017 @10:08AM (#15090213)

I haven't received a payment yet actually -- it is still pending.

[ Parent | on HN ]

Re:Exploit broker Zerodium ups the ante with $500k to target... by gcp on Thursday August 24, 2017 @08:00AM (#15089338)

Unfortunately, The bounty from the tor project isn't nearly as much

It sounds like it's a privacy leak, but not an RCE/SBX? Especially as it's saying that the sandboxed version of Tor isn't affected.

Bit sad that you can't click the revisions on https://trac.torproject.org/projects/tor/ticket/23044#no2 to see the diff.

[ Parent | on HN ]

Re:Exploit broker Zerodium ups the ante with $500k to target... by julianj on Thursday August 24, 2017 @10:21AM (#15090303)

So I believe the max bounty without a bonus for any Tor vuln through their bug bounty program is 4k. The max for the Tor Browser Bundle is 3k.

[ Parent | on HN ]