In September, notorious zero-day exploits acquisition firm Zerodium announced a bounty program for security enthusiasts and hackers who could find remote jailbreak vulnerabilities and exploits affecting iOS 9-powered iPhone or iPad. The firm has announced that somebody has claimed the $1 million bounty.
The firm says that the winning team, which submitted its entry just hours before the October 31 deadline, found a number of vulnerabilities in Chrome Web browser and iOS to circumvent "almost all mitigations" and managed to get access to a remote and full browser-based (untethered) jailbreak, he told Motherboard.
The claim should be concerning for users as well as the company itself, as Zerodium now possesses a tool that can jailbreak an iPhone remotely. It's more alarming when you realise that such a sophisticated vulnerability hadn't been publicly reported since iOS 7.
Zerodium had challenged enthusiasts to find a way to remotely jailbreak a new iPhone or iPad running the latest version of iOS mobile operating system. The bounty program also required users to find an exploit using Chrome or Safari or a text or multimedia message. This would make it possible for an attacker to install any app in a victim's device.
"Making the jailbreak remotely triggerable via Safari or Chrome requires at least two to three additional exploits compared to a local jailbreak," Chaouki Bekrar, founder of Zerodium told Motherboard.
Bekrar didn't reveal the identity of the winning team, not did he reveal the exact vulnerabilities the exploit targets. Moving forward, the company would likely sell the exploit.
For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.