New zero-day startup offers $20 million for tools that can hack any smartphone

A newly launched startup based in the United Arab Emirates is shaking up the zero-day market by offering bounties of up to $20 million for hacking tools that enable government agencies to infiltrate any smartphone via text messages. This company, named Advanced Security Solutions, has emerged as a significant player by presenting some of the highest known rewards in this niche sector. Zero-day vulnerabilities are flaws in software that developers are unaware of at the time of discovery, making them incredibly valuable to hackers, particularly those associated with law enforcement and intelligence operations. In addition to the flagship $20 million bounty applicable to any mobile operating system, the startup provides substantial rewards for specific platforms: $15 million for zero-days on Android and iOS, $10 million for Windows, $5 million for Chrome, and $1 million for both Apple’s Safari and Microsoft Edge. The company's website claims a close collaboration with over 25 governments and intelligence agencies globally, stating, "We empower government agencies, intelligence services, and law enforcement to operate with precision in the digital battlefield." Despite launching recently, Advanced Security Solutions boasts a team with over 20 years of experience in elite intelligence and private military operations. However, the startup has not addressed key questions regarding its ownership, funding, or specific clients. A security researcher familiar with the zero-day landscape remarked that the bounties offered align with current market trends, suggesting that the $20 million reward is relatively modest depending on the ethical standards of the seller. The researcher expressed concerns about dealing with a company that lacks transparency about its leadership, emphasizing the risks of selling vulnerabilities to unidentified entities. The zero-day market has seen substantial growth over the past decade, both in terms of participant companies and the prices they are willing to pay. In 2015, Zerodium was among the first to publish its pricing, offering up to $1 million for iPhone hacking tools, while prices have dramatically escalated since then due to increased demand and the heightened difficulty of breaching modern software defenses. For example, last year, Crowdfense raised its bounty to $7 million for iPhone exploits and $5 million for Android vulnerabilities. Advanced Security Solutions also joins in by offering $2 million for vulnerabilities in popular messaging applications like Telegram, Signal, and WhatsApp. Notably, the Russian firm Operation Zero has set a high bar with offers reaching $20 million, although it operates under different legal constraints that limit engagement with Western researchers. As this market evolves and the stakes rise, the implications for cybersecurity and governmental operations are profound, raising ethical questions about the commercialization of hacking tools.