Menu
Exploit broker places $100k bounty on bypassing Flash Player's latest defenses

Exploit broker places $100k bounty on bypassing Flash Player's latest defenses

Flash Player's new heap isolation is under attack

A little over two weeks have passed since Adobe strengthened Flash Player with new security defenses, and there's already interest in the commercial exploit market for ways around them.

Zerodium, a company that buys unpatched and unreported exploits from third-party researchers, announced on Twitter that it is offering $100,000 for exploits that bypass Flash Player's latest "heap isolation" protection. This memory defense mechanism makes exploiting certain types of security flaws much harder. These account for a large portion of the Flash Player flaws exploited by hackers in recent years to infect computers with malware.

Adobe started working on the heap isolation defense earlier this year with help from Google's Project Zero vulnerability research team, whose members reported about a third of all Flash Player flaws patched in 2015.

Google Project Zero contributed heap isolation for vectors and then Adobe extended that protection to ByteArrays, said Peleus Uhley, Adobe's principal scientist, in a blog post on Dec. 21. "In last week’s release, Adobe deployed a rewrite of our memory manager to create the foundation for widespread heap isolation which we will build on, going forward."

Throughout this month, Zerodium will pay $100,000 for every Flash Player exploit that bypasses the new heap isolation defense, as well as the program's sandbox mechanism. Exploit chains that don't include a sandbox bypass, but defeat heap isolation, will be rewarded with $65,000, the company said.

Zerodium was set up last year by Chaouki Bekrar, the founder of now defunct French vulnerability research firm Vupen Security, which was known for creating and selling exploits to governments. The company's goal is similar to that of Vupen, but instead of creating its own exploits, it acquires them from third-party researchers.

Zerodium is only interested in high-risk vulnerabilities accompanied by reliable exploits affecting modern operating systems, software and devices, and which haven't been reported to the affected vendors.

The company claims to provide the acquired vulnerability information, along with protective measures and security recommendations, to clients who subscribe to its security research service. These clients include "major corporations in defense, technology, and finance, in need of advanced zero-day protection, as well as government organizations in need of specific and tailored cybersecurity capabilities."

The high payouts offered by exploit acquisition companies like Zerodium provide a hard-to-resist incentive for researchers to not report the vulnerabilities they find to affected vendors, delaying their patching and keeping users insecure for longer times. Very few software makers can match the same rewards through their own bug bounty programs.

In September, Zerodium offered $1 million for a browser-based exploit that could compromise Apple's newly released iOS 9 mobile operating system. In November, the company announced that a team of researchers qualified for the prize.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments