Zerodium gets what it wanted, can now sell it to governments

Nov 3, 2015 03:57 GMT  ·  By

Security exploit vendor Zerodium has just announced somebody won its iOS 9 Bug Bounty contest, which means someone made $1 million / €0.89 million by discovering an unknown zero-day bug in Apple's newly released iOS 9.

At the end of September, Zerodium was announcing that it was starting an international contest through which the company was agreeing to pay $3 million / €2.67 million for the first three zero-day exploits found in Apple's iOS 9.

Up to three winners were to be paid, if they came forward with an unknown, fully functional, remotely exploitable iOS 9 zero-day.

As the contest has just recently concluded, Zerodium has announced on Twitter that they've got what they wanted, and the company is now in possession of at least one iOS 9 vulnerability.

The winning bug can be exploited via a mobile browser and works on iOS 9.1 and 9.2b.

Vice reported earlier in October that at least two teams were in the running for the final prizes, but they were stuck, at that moment, in chaining different exploits together to make them work remotely. Apparently, one team found a way to do so.

The winning team's name was not made public, but we don't believe it will ever be revealed.

Just two weeks ago, Chinese hackers Pangu announced the first-ever iOS 9 jailbreak, but their method was not remotely exploitable.