A new United Arab Emirates-based startup is offering up to $20 million for hacking tools that could help governments break into any smartphone with a text message.
Advanced Security Solutions launched this month and is now offering some of the highest prices, at least public ones, in the whole zero-day market. Zero-days are flaws in software that are unknown to the affected developer at the time of their discovery. These tools can be highly valuable for hackers, especially those working for law enforcement and intelligence agencies.
Apart from the highest bounty of $20 million, which applies to any mobile operating system, the company also offers bounties for exploits in various software: $15 million for the same type of zero-days for Android devices and for iPhones; $10 million for Windows; $5 million for Chrome; $1 million for Apple's Safari and Microsoft Edge browsers, among others.
It's unclear who is behind the company and its customers.
"We empower government agencies, intelligence services, and law enforcement to operate with precision in the digital battlefield," reads the company's website. "We maintain continuous cooperation with over 25 governments and intelligence agencies worldwide. Our clients consistently return for new services, reflecting the trust and strategic value we provide in high-stakes operational contexts, including counterterrorism and narcotics control."
The website also says that while the company is new, "it is staffed exclusively by professionals with over 20 years of operational experience in elite intelligence units and private military contractors."
Advanced Security Solutions did not respond to a series of questions, including who funds, owns, and runs the company, who the customers are, as well as whether the company has any self-imposed ethical or legal restrictions on what governments to sell to.
A security researcher with experience in the world of zero-days told TechCrunch that the prices offered by Advanced Security Solutions are approximately in line with the current market.
"Normally these advertised prices are in the ball park," the person told TechCrunch on the condition of anonymity to speak candidly about the zero-day industry. The person added that the $20 million bounty "is low depending on how unscrupulous you are."