Categories: Breaking NewsHacking

Zerodium offers $100,000 for bypass Flash Player heap isolation

The zero-day exploit broker Zerodium is offering up to $100,000 to security experts who can provide an exploit for bypassing the Flash heap isolation.

Once again, the zero-day exploit trader Zerodium is in the headlines, this time the company is offering $100,000 for the Flash Exploit Mitigation bypass. Adobe announced in December the introduction of several

Recently Adobe announced the introduction of several new security improvements for Flash Player, the enhancements were designed with the collaboration of important players in the security industry, including Microsoft and Google.

“With the December release of Flash Player, we introduced several new security enhancements. Player mitigations we shipped earlier this year, many of these projects were the result of collaboration with the security community and our partners.” states the announcement issued by Adobe.

One of the most important enhancement for the mitigation of exploits is the heap isolation.

The hackers of the Google Project Zero were the first to work on the heap isolation, they detailed their significant Flash exploit mitigations in a blog post back in July, just after the release of the Flash Player 18.0.0.209.

The experts at the Google Project Zero discovered one-third of Flash Player vulnerabilities in 2015.

Adobe released roughly 30 security updates for Flash Player last year, hundreds of security flaws have been fixed, but many of them were exploited in the wild by hackers in targeted attacks.

The Zerodium firm posted a tweet announcing that this month it is offering $100,000 for an exploit that allow an attacker to bypass the Flash Player heap isolation with a sandbox escape. The company also offers $65,000 for the same hack without a sandbox escape.

On November 18th, 2015, Zerodium published a price list for various classes of software targets and digital intrusion methods that have been purchased from cyber criminals and hackers and offered for sale to its customers that include intelligence and government agencies.

The chart describes the sums Zerodium pays for the techniques, it is one of the most comprehensive views into the provocative and dark market for covert hacking activities.

“The first rule of [the] 0days biz is to never discuss prices publicly. So guess what: We’re going to publish our acquisition price list.” said Chaouki Bekrar, CEO of Zerodium.

According to the Zerodium’s zero-day price list, a Flash Player remote code execution exploit is paid $80,000 when combined with a sandbox escape.

In September Zerodium offered a million dollar prize to any person that finds unknown, unpatched bug in iOS 9 with the main purpose to jailbreak iThings.

In November, a team of hackers has received a million-dollar payout for disclosing a iOS zero-day vulnerability to Zerodium, that now can remotely hack any Phone.

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Zerodium, zero-day, heap isolation)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Cisco addressed high-severity flaws in IOS and IOS XE software

Cisco addressed multiple vulnerabilities in IOS and IOS XE software that can be exploited to…

7 hours ago

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Google's Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively…

14 hours ago

Google addressed 2 Chrome zero-days demonstrated at Pwn2Own 2024

Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…

1 day ago

INC Ransom stole 3TB of data from the National Health Service (NHS) of Scotland

The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…

1 day ago

CISA adds Microsoft SharePoint bug disclosed at Pwn2Own to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint vulnerability disclosed at the…

1 day ago

The DDR Advantage: Real-Time Data Defense

This is the advantage of Data Detection and Response (DDR) for organizations aiming to build…

2 days ago

This website uses cookies.