Exploits give an attacker their initial access to a target’s device, what people think of as the start of the “hack”. Many governments buy exploits and like anything else, the rarer one is or the harder it was to create, the more money the seller will expect to receive for it. Many of these exploits are delivered to target’s devices via messaging apps, often referred to as “zero-click” exploits. This access is then used to read all of the messages stored in the app or to expand to everything on the device. Note that this has nothing to do with breaking or decrypting the end-to-end encryption of these apps, it’s directly gaining access to the app itself since it is not, currently anyway, possible to break the encryption used by most messaging apps today.
Since it has become more difficult for attackers to find new exploits for some of the most widely used operating systems and applications, there are companies that do nothing but act as brokers to buy and sell these exploits. Often these companies combine together individual exploits acquired from different people to form a series of them called a “chain” that allows full access to the target’s device.
It’s always interesting to watch what’s going on in the underground as well as the overt exploit broker markets, the direction pricing is going overall and which operating systems and applications are currently commanding the highest prices. Gives one a sense of where the attackers think they have things covered and where they do not.
The overt brokers (the ones with web sites and social media accounts) often overinflate how much they are offering on their web sites, to out compete other brokers offering less and attract exploit developers to go to them first. One can usually expect to be offered 25-50% less than the advertised price for most of what they’re buying. Only for the hardest to find exploits will they usually match their advertised pricing, so the higher the price they are offering, the more likely they’ll actually match it. The stuff in the middle, expect a discount. They also pay exploit developers out over a period of time, they don’t want to pay $1.5M USD for something and a day later it gets patched and becomes almost worthless. This also ensures the person selling the exploit to the broker won’t play them by then turning around and making another $1M USD from someone like Apple that buys vulnerabilities to fix them and protect users. On a $1.5M USD deal, a broker would typically pay $500K USD on day one then another $250K USD every 3 months until the full $1.5M USD is paid or the vulnerabilities are patched, whichever comes first. Often for really in demand exploit chains, such as against iMessage, there are bonuses paid out beyond the advertised price if the entire exploit chain remains unpatched beyond the one year mark, often every 3 months. This is to incentivize the exploit developer to not out it to Apple after they already were fully paid by the broker. If it’s a chain of vulnerabilities that are used and only one gets patched, then some payments might continue but at a much reduced rate.
Some exploits target a specific app first while others directly impact the operating system (e.g. iOS) and just use the app as a delivery mechanism without actually gaining remote code execution (RCE) in the app itself. For example, a vulnerability in iOS’ ImageIO library can often be triggered via iMessage, Signal, WhatsApp and Facebook Messenger without achieving RCE in the app first. Ones that are app specific typically only allow access to the data within the impacted app as well as whatever permissions it has (access to photos, camera, microphone, location, etc.) but can be used with other exploits to expand beyond the app, i.e. “break out of the sandbox”.
Looking at the chart at the end of this blog entry, the parts we’re focussing on are highlighted. You can see right away that the most in demand exploit chains, i.e. the most expensive, all target messaging apps. This is because they are often the only way to deliver an exploit to a target without their involvement (i.e. “zero-click”). It’s also because they are the easiest to use operationally, just need the target’s mobile phone number or e-mail address to message them, and because they have next to zero risk for the attacker of being caught.
ZERODIUM is offering $1.5M USD for iMessage or WhatsApp zero-click and $500K USD for Signal, Telegram or Facebook Messenger. Surprised to see ZERODIUM are not currently actively buying zero-click exploits for Signal, Telegram and Facebook Messenger. Either they already have a full chain or two and just want to buy additional segments for them for redundnancy, in case parts of the chains get patched, or it’s because a zero-click exploit that targets the OS but that is delivered via iMessage or WhatsApp can often be reused for other messaging apps. Surprised to see WhatsApp valued as highly as iMessage at the $1.5M USD mark for a zero-click version. WhatsApp must be upping their security game! Part of the reason why iMessage is so expensive is a mix of difficulty to exploit but also the fact that the vast, vast majority of iOS users have it enabled so it allows access to almost all iOS devices. Signal on the other hand might only be used by some of a government’s target set. An attacker could also use an iMessage exploit to gain full access to a device that is also running Signal and grab all of the messages that way instead.
Some security researchers we’ve spoken with that have been contacted and pitched by underground exploit brokers said they were quoting the same $1.5M USD as ZERODIUM for iMessage zero-click chains but a flat $300K USD for all other messengers (including WhatsApp) and for zero-click for all, so quite a difference from ZERODIUM.
Hoping this demonstrates how active the threat is against messenger app users, especially those that find themselves intelligence targets of certain governments, and how valuable our app’s protection is. While ZERODIUM claims to not sell to governments with a bad human rights record, there are many others in the same business that definitely do. If you’ve pissed off the Saudis, the Emiratis… any of the outed buyers of these companies, you seriously need to consider disabling and uninstalling all of your messaging apps. If you still need to message, then move to Numbers Station with the maximum protection settings enabled.
Our goal at Numbers Station is to of course protect our users but to also block and out the exploits used against them so companies like Apple can fix any vulnerabilities in their software to protect all iOS users, even those not using our app. Our longer term goal is to capture fresh exploits so rapidly that their shelf life is too short to justify their cost and the exploit broker industry reduces in size or fewer governments can afford their products. At the very least we want to change the attackers risk/reward calculation, launching attacks on thousands of users of other messaging apps may be close to zero risk of being detected and having their exploit chain outed but hitting just a single Numbers Station user could be the end of it for them.
Update: received a question concerning the $2.5M and $2M “FCP Zero Click” payouts in the chart below and how they differ from the $1.5M one. In short the attacker’s malicious software can survive a reboot of the device. For most attackers though, this isn’t a big deal to have, if they haven’t heard from the target’s device lately they just send another message to the target and re-exploit it. Once again, other messaging apps don’t address this threat at all so next to zero risk for the attacker to just keep re-exploiting as needed.
