Winner claimed in $1 million iOS 9 hacking contest

A team of security researchers may have found a way to remotely penetrate the defenses of Apple’s latest mobile OS, making them eligible for a $1 million reward.

The money was offered in a contest run by a Washington, D.C.-based company called Zerodium, which is in the controversial business of buying and selling information about software vulnerabilities.

It congratulated the winning team on Twitter Monday, though it didn’t identify the researchers, which made its claim about finding a new security hole in iOS 9 impossible to verify.

Apple officials didn’t immediately have a comment.

Chaouki Bekrar, Zerodium’s founder, said via email that the winning team’s exploit “is still being extensively tested by Zerodium to verify and document each of the underlying vulnerabilities.”

Apple’s iOS is one of the most challenging for hackers to exploit and the company has engineered strong defenses around iOS that make it hard to infect with malware. 

Zerodium launched its contest in September, saying it would reward the first group to come up with a remote, browser-based exploit. That means the unauthorized code had to be delivered to an iOS device by getting the user to visit a web page using Chrome or Safari, or via a text or multimedia message sent to the device, according to Zerodium’s conditions.

“It’s definitely very technically challenging,” said Patrick Wardle, director of research with Synack, a service that matches security researchers with bug-hunting work.

Despite the difficulty, enthusiasts have found ways around Apple’s defenses in the past to install unapproved apps, a process known as jailbreaking.

Jailbreakers usually want to run apps from Cydia, a store for unauthorized apps. The jailbreak exploit code is publicly available and those who developed it weren’t paid.

Zerodium, however, keeps the vulnerabilities it buys close and only makes them available to clients who subscribe to its Security Research Feed. 

Bekrar said the vulnerabilities found by the winning team may be reported to Apple later by Zerodium.

The reward that the company is allegedly paying shows how valuable the information could be to other companies, organizations and even nation states.

“If they’re paying a million dollars, I’m sure that means someone is willing to buy it for that or more,” Wardle said in a phone interview Monday.

The flaws are known as “zero-day” vulnerabilities since Apple hasn’t had time yet to develop a patch. It may be hard for Apple to figure out how to fix the flaws if more information doesn’t leak out.

Wardle said the team likely found several software flaws that are used in a chain to ensure any planted code stays on an iOS 9 device even after it is rebooted.

That probably means the group has found a browser vulnerability and then another one around the core of the operating system, known as the kernel, Wardle said. A third flaw would also be needed to ensure the unauthorized code stays on the device on reboot since Apple checks for strange apps, he said.

Bekrar wouldn’t reveal much detail other than that “the exploit chain includes a number of vulnerabilities affecting both Google Chrome browser and iOS, and bypassing almost all mitigations in place.”

A second team also participated in the contest as well, Bekrar wrote. That team developed a partial jailbreak and may be eligible for partial reward, he said.

Bekrar also founded Vupen, a now-shuttered vulnerability broker that sold information to government agencies and other organizations.

Vupen’s business model was criticized by some in the security community, who contended that sharing vulnerability information without notifying software vendors could put people at unnecessary risk if the information is abused.