Zerodium
More info
- Creator
- Chaouki Bekrar
- Released
- 2015
- Type
- Exploit broker
- Predecessor
- VUPEN
An American exploit broker that buys zero-days from researchers, resells them to governments, and publishes its purchase prices like a wholesaler.
Zerodium was founded in 2015 by Chaouki Bekrar, formerly of VUPEN. It made its name immediately by offering a million dollars for a remote jailbreak of iOS 9 — and then paying out. Its public price list became the industry's unofficial thermometer: when a zero-click full Android chain was valued at $2.5 million in 2019, above the equivalent for iOS, people read it as a verdict on Android's hardening.
Unlike a bug bounty, the vendor never hears a thing. Holes stay open for as long as they are worth money, which is the entire business model and also the entire criticism.