Hackers Claim $1 Million Bounty for Remote Jailbreaking iOS 9-Based iPhone

In September, notorious zero-day exploits acquisition firm Zerodium announced a bounty program for security enthusiasts and hackers who could find remote jailbreak vulnerabilities and exploits affecting iOS 9-powered iPhone or iPad. The firm has announced that somebody has claimed the $1 million bounty.

The firm says that the winning team, which submitted its entry just hours before the October 31 deadline, found a number of vulnerabilities in Chrome Web browser and iOS to circumvent "almost all mitigations" and managed to get access to a remote and full browser-based (untethered) jailbreak, he told Motherboard.

The claim should be concerning for users as well as the company itself, as Zerodium now possesses a tool that can jailbreak an iPhone remotely. It's more alarming when you realise that such a sophisticated vulnerability hadn't been publicly reported since iOS 7.

Zerodium had challenged enthusiasts to find a way to remotely jailbreak a new iPhone or iPad running the latest version of iOS mobile operating system. The bounty program also required users to find an exploit using Chrome or Safari or a text or multimedia message. This would make it possible for an attacker to install any app in a victim's device.

"Making the jailbreak remotely triggerable via Safari or Chrome requires at least two to three additional exploits compared to a local jailbreak," Chaouki Bekrar, founder of Zerodium told Motherboard.

Bekrar didn't reveal the identity of the winning team, not did he reveal the exact vulnerabilities the exploit targets. Moving forward, the company would likely sell the exploit.