Yes, it is true! hack iPhone, Samsung S8, Google Pixel, Huawei Mate9 pro and you could win $500,000 in prizes from cybersecurity firm Trend Micro. Japnese cybersecurity company has announced its 2017’s edition of Mobile Pwn2Own competition which will be held at this year’s PacSec security conference in Tokyo on November 1st ad 2nd. It’s going to be the sixth annual Pwn2Own competition, in which security researchers will be given the task of finding out vulnerabilities in popular mobile devices and reporting them in exchange for financial rewards.
The company will be offering $500,000 to be won by the security experts depending on the type of exploit they find. For instance, mobile safari exploits are worth up to $40,000 and a SMS-based vulnerability could be worth $60,000. There are also additional cash bonus of between $20,000 and $50,000 for executing code with kernel privileges and if the payload remains into an operating system even after the system has rebooted.
This year’s targeted device will be mainly focused on Apple’s iPhone 7 and 7 Plus, Google Pixel and Pixel XL, Samsung Galaxy S8 and Huawei’s Mate9 Pro. All of these devices will be running the latest version of iOS or Android respectively with up-to-date security patches installed. If an individual succeeds in finding a vulnerability in any one the device, it will be then on the latest version of the Operating system and relevant to the manufacturer.
“This hunt for Zero-Days is offensive crowd sourcing of security vulnerabilities. Crowdsourced security is the ultimate solution for finding any possible security bug whether defensive or offensive, like in this case,” said Ankush Johar, director at BugsBounty.com, a crowd-sourced security platform for ethical hackers and organisations.
Johar is of view that though the firms that are willing to sell 0-days for these mobile devices to surveillance agencies are offering up to $1.5 million to researchers, these vendors themselves are hardly offering a fraction of that amount.
“This shows a discrepancy between the demand of 0-days in the market and the amount that vendors are willing to pay for securing their products. The $1.5 million offer for keeping the 0-day out of reach of the vendors highlights the heightened market demand for such security exploits.”
