In December 2019, the virtual private network (VPN) service provider NordVPN launched a public bug bounty program operated via the HackerOne platform. The company payouts were up to $100,000 for zero-days in Pidgin, which is a free and open-source multi-platform instant messaging client.Īdditional info about the Zerodium Exploit Acquisition Program is available here. In June, the zero-day exploit broker announced it was looking for 0day exploits affecting the IM client tool Pidgin on Windows and Linux. The company announced payouts up to $100,000 for zero-days in vCenter Server. vCenter Server is the centralized management utility for VMware, and is used to manage virtual machines, multiple ESXi hosts, and all dependent components from a single centralized location. In July, Zerodium announced it was looking for zero-day exploits for VMware vCenter Server. NordVPN and Surfshark have been used by threat actors in the past. Zerodium will likely resell the zero-day exploits to law enforcement and intelligence agencies that will use them for their investigation into cybercriminal activities and operations carried out by nation-state actors. The request is not surprising, the three providers are used by tens of millions of users worldwide, including cybercriminals. The company is not interested in local privilege escalation. Zerodium is searching for information disclosure, IP address leak, or remote code execution in the Windows VPN software of the three service providers. VPN services allow users to protect their anonymity when accessing resources online, they allow hiding the user’s IP address by routing the connection through a network of servers used by the provider. Local privilege escalation is out of scope. We're looking for #0day exploits affecting VPN software for Windows:Įxploit types: information disclosure, IP address leak, or remote code execution.
0 Comments
Leave a Reply. |