Exploit acquisition program aims to patch mobile vulnerabilities faster
Even after new mobile threats have been identified the number of devices in use means it can take time for patches to be rolled out to all users.
Mobile threat defense company Zimperium is hoping to tackle this problem with the launch of a $1.5 million bounty program to purchase N-day exploits which have been identified but are still usable on unpatched devices.
The Exploit Acquisition Program focuses on N-day vulnerabilities for Android and iOS devices. While most bug bounty programs purchase zero-days, or unknown vulnerabilities, and then develop a patch, millions of users remain at risk due to poor patch deployment processes that never reach the majority of mobile devices. By focusing on N-days, or patched vulnerabilities, Zimperium is applying pressure on the mobile industry to re-think how and when users receive security updates.
A committee made up of members of Zimperium's research team, zLabs, will evaluate remote exploits, local exploits, information disclosure exploits and other vulnerabilities for purchase. Exploits will first be released to partners and friends of the Zimperium's Handset Alliance (ZHA), which includes Samsung, Softbank, Telstra, Blackberry and more than 30 well-known handset vendors and mobile carriers around the world. For those that are not members of ZHA, Zimperium will publicly release the exploit, one to three months later, crediting the appropriate researcher.
"Unfortunately, the security patching process for mobile devices' operating systems is extremely slow, which leaves companies and individuals highly vulnerable to dozens of security threats," says Zuk Avraham, CTO and founder of Zimperium. "Through this program, our customers, partners, and the infosec community will get access to exploits and exploit techniques so that they will be able to provide better protection from existing threats."
More details of the scheme and how bug researchers can take part can be found on the Zimperium blog.
Image Credit: Alex Mit / Shutterstock