Zerodium is looking for zero-day exploits in ExpressVPN, NordVPN, and Surfshark Windows VPN clients

Zero-day exploit broker Zerodium announced it is looking for zero-day vulnerabilities in the Windows clients of ExpressVPN, NordVPN, and Surfshark.

Zerodium is looking to pay for zero-day exploits for vulnerabilities in the Windows clients of three virtual private network (VPN) service providers, ExpressVPN, NordVPN, and Surfshark.

The company announced with a message posted on Twitter:

VPN services allow users to protect their anonymity when accessing resources online, they allow hiding the user’s IP address by routing the connection through a network of servers used by the provider.

Zerodium is searching for information disclosure, IP address leak, or remote code execution in the Windows VPN software of the three service providers. The company is not interested in local privilege escalation.

The request is not surprising, the three providers are used by tens of millions of users worldwide, including cybercriminals. Zerodium will likely resell the zero-day exploits to law enforcement and intelligence agencies that will use them for their investigation into cybercriminal activities and operations carried out by nation-state actors.

NordVPN and Surfshark have been used by threat actors in the past.

In July, Zerodium announced it was looking for zero-day exploits for VMware vCenter Server. vCenter Server is the centralized management utility for VMware, and is used to manage virtual machines, multiple ESXi hosts, and all dependent components from a single centralized location. The company announced payouts up to $100,000 for zero-days in vCenter Server.

In June, the zero-day exploit broker announced it was looking for 0day exploits affecting the IM client tool Pidgin on Windows and Linux. The company payouts were up to $100,000 for zero-days in Pidgin, which is a free and open-source multi-platform instant messaging client.

Additional info about the Zerodium Exploit Acquisition Program is available here.

In December 2019, the virtual private network (VPN) service provider NordVPN launched a public bug bounty program operated via the HackerOne platform.

The service provider offered payouts between $100 and $5,000 for each reported vulnerability, an amount of money that is much lower than Zerodium’s offers. 

Below is a reference payout range for the vulnerabilities based on their severity levels:

• Critical: $1000-5000+ USD
• High: $500-1000 USD
• Medium: $100-500 USD
• Low: $100 USD
• None: $0 USD

The bug bounty program was covering NordVPN websites (nordvpn.com and some subdomains), Chrome and Firefox browser extensions, VPN servers, and desktop and mobile applications for all platforms.

Cleary if the payouts of the bug bounty will remain the same, all the bugs discovered in the VPN service will be reported only to Zerodium.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking,zero-day)

[adrotate banner=”5″]

[adrotate banner=”13″]