Menu
Exploit broker places $100k bounty on bypassing Flash Player's latest defenses

Exploit broker places $100k bounty on bypassing Flash Player's latest defenses

Flash Player's new heap isolation is under attack

A little over two weeks have passed since Adobe strengthened Flash Player with new security defenses, and there's already interest in the commercial exploit market for ways around them.

Zerodium, a company that buys unpatched and unreported exploits from third-party researchers, announced on Twitter that it is offering $100,000 for exploits that bypass Flash Player's latest "heap isolation" protection. This memory defense mechanism makes exploiting certain types of security flaws much harder. These account for a large portion of the Flash Player flaws exploited by hackers in recent years to infect computers with malware.

Adobe started working on the heap isolation defense earlier this year with help from Google's Project Zero vulnerability research team, whose members reported about a third of all Flash Player flaws patched in 2015.

Google Project Zero contributed heap isolation for vectors and then Adobe extended that protection to ByteArrays, said Peleus Uhley, Adobe's principal scientist, in a blog post on Dec. 21. "In last week’s release, Adobe deployed a rewrite of our memory manager to create the foundation for widespread heap isolation which we will build on, going forward."

Throughout this month, Zerodium will pay $100,000 for every Flash Player exploit that bypasses the new heap isolation defense, as well as the program's sandbox mechanism. Exploit chains that don't include a sandbox bypass, but defeat heap isolation, will be rewarded with $65,000, the company said.

Zerodium was set up last year by Chaouki Bekrar, the founder of now defunct French vulnerability research firm Vupen Security, which was known for creating and selling exploits to governments. The company's goal is similar to that of Vupen, but instead of creating its own exploits, it acquires them from third-party researchers.

Zerodium is only interested in high-risk vulnerabilities accompanied by reliable exploits affecting modern operating systems, software and devices, and which haven't been reported to the affected vendors.

The company claims to provide the acquired vulnerability information, along with protective measures and security recommendations, to clients who subscribe to its security research service. These clients include "major corporations in defense, technology, and finance, in need of advanced zero-day protection, as well as government organizations in need of specific and tailored cybersecurity capabilities."

The high payouts offered by exploit acquisition companies like Zerodium provide a hard-to-resist incentive for researchers to not report the vulnerabilities they find to affected vendors, delaying their patching and keeping users insecure for longer times. Very few software makers can match the same rewards through their own bug bounty programs.

In September, Zerodium offered $1 million for a browser-based exploit that could compromise Apple's newly released iOS 9 mobile operating system. In November, the company announced that a team of researchers qualified for the prize.

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments