Zerodium is looking for zero-day exploits in ExpressVPN, NordVPN, and Surfshark Windows VPN clients

Zero-day exploit broker Zerodium announced it is looking for zero-day vulnerabilities in the Windows clients of ExpressVPN, NordVPN, and Surfshark.

Zerodium is looking to pay for zero-day exploits for vulnerabilities in the Windows clients of three virtual private network (VPN) service providers, ExpressVPN, NordVPN, and Surfshark.

The company announced with a message posted on Twitter:

VPN services allow users to protect their anonymity when accessing resources online, they allow hiding the user’s IP address by routing the connection through a network of servers used by the provider.

Zerodium is searching for information disclosure, IP address leak, or remote code execution in the Windows VPN software of the three service providers. The company is not interested in local privilege escalation.

The request is not surprising, the three providers are used by tens of millions of users worldwide, including cybercriminals. Zerodium will likely resell the zero-day exploits to law enforcement and intelligence agencies that will use them for their investigation into cybercriminal activities and operations carried out by nation-state actors.

NordVPN and Surfshark have been used by threat actors in the past.

In July, Zerodium announced it was looking for zero-day exploits for VMware vCenter Server. vCenter Server is the centralized management utility for VMware, and is used to manage virtual machines, multiple ESXi hosts, and all dependent components from a single centralized location. The company announced payouts up to $100,000 for zero-days in vCenter Server.

In June, the zero-day exploit broker announced it was looking for 0day exploits affecting the IM client tool Pidgin on Windows and Linux. The company payouts were up to $100,000 for zero-days in Pidgin, which is a free and open-source multi-platform instant messaging client.

Additional info about the Zerodium Exploit Acquisition Program is available here.

In December 2019, the virtual private network (VPN) service provider NordVPN launched a public bug bounty program operated via the HackerOne platform.

The service provider offered payouts between $100 and $5,000 for each reported vulnerability, an amount of money that is much lower than Zerodium’s offers.

Below is a reference payout range for the vulnerabilities based on their severity levels:

Critical: $1000-5000+ USD
High: $500-1000 USD
Medium: $100-500 USD
Low: $100 USD
None: $0 USD

The bug bounty program was covering NordVPN websites (nordvpn.com and some subdomains), Chrome and Firefox browser extensions, VPN servers, and desktop and mobile applications for all platforms.

Cleary if the payouts of the bug bounty will remain the same, all the bugs discovered in the VPN service will be reported only to Zerodium.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking,zero-day)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.