Exploit broker places $100k bounty on bypassing Flash Player’s latest defenses

A little over two weeks have passed since Adobe strengthened Flash Player with new security defenses, and there’s already interest in the commercial exploit market for ways around them.

Zerodium, a company that buys unpatched and unreported exploits from third-party researchers, announced on Twitter that it is offering $100,000 for exploits that bypass Flash Player’s latest “heap isolation” protection. This memory defense mechanism makes exploiting certain types of security flaws much harder. These account for a large portion of the Flash Player flaws exploited by hackers in recent years to infect computers with malware.

[ ALSO ON CSO: Critical Flash Player updates patch 23 flaws ]

Adobe started working on the heap isolation defense earlier this year with help from Google’s Project Zero vulnerability research team, whose members reported about a third of all Flash Player flaws patched in 2015.

Google Project Zero contributed heap isolation for vectors and then Adobe extended that protection to ByteArrays, said Peleus Uhley, Adobe’s principal scientist, in a blog post on Dec. 21. “In last week’s release, Adobe deployed a rewrite of our memory manager to create the foundation for widespread heap isolation which we will build on, going forward.”

Throughout this month, Zerodium will pay $100,000 for every Flash Player exploit that bypasses the new heap isolation defense, as well as the program’s sandbox mechanism. Exploit chains that don’t include a sandbox bypass, but defeat heap isolation, will be rewarded with $65,000, the company said.

Zerodium was set up last year by Chaouki Bekrar, the founder of now defunct French vulnerability research firm Vupen Security, which was known for creating and selling exploits to governments. The company’s goal is similar to that of Vupen, but instead of creating its own exploits, it acquires them from third-party researchers.

Zerodium is only interested in high-risk vulnerabilities accompanied by reliable exploits affecting modern operating systems, software and devices, and which haven’t been reported to the affected vendors.

The company claims to provide the acquired vulnerability information, along with protective measures and security recommendations, to clients who subscribe to its security research service. These clients include “major corporations in defense, technology, and finance, in need of advanced zero-day protection, as well as government organizations in need of specific and tailored cybersecurity capabilities.”

The high payouts offered by exploit acquisition companies like Zerodium provide a hard-to-resist incentive for researchers to not report the vulnerabilities they find to affected vendors, delaying their patching and keeping users insecure for longer times. Very few software makers can match the same rewards through their own bug bounty programs.

In September, Zerodium offered $1 million for a browser-based exploit that could compromise Apple’s newly released iOS 9 mobile operating system. In November, the company announced that a team of researchers qualified for the prize.