$500k Offered for iOS 0-Day Vulnerability

Bug bounty programs are becoming very popular in the technology industry right now. Apple, Google, Microsoft, and Facebook, all leverage the talent of independent security researchers to augment their own quality assurance staff at finding weaknesses in their products. In addition, independent security research firms as well as vulnerability resellers will also pay handsomely for specific zero-day vulnerabilities and exploits.    

Most recently, Exodus Intelligence’s Research Sponsorship Program (RSP) has offered a half-million dollar bounty for an iOS zero-day vulnerability and working exploit. This competes with Apple’s announcement of $200k vulnerability program.    

Normally, bounties are paid out once the researcher submits his work and it is verified. Exodus is upping the potential pay for their suppliers. They might also send researchers a bonus every quarter the zero-day exploit is still alive.    

I like the creativity and competitiveness! I have always been a big fan of bug-bounty programs as an alternative financial incentive path for hackers/researchers.  Hopefully it brings in more security researchers to look-for and turn-in vulnerabilities instead of selling them on the black market.