A security researcher eventually realizes that what they are holding is more than just a technical curiosity—it’s money—during their regular work. Much of it. If you discover a bug in Apple’s iOS, you shouldn’t just report it and move on. For some, it entails going into a shadow economy where payouts can reach the millions, buyers are strong, and regulations are ambiguous.
The zero-day economy is this. Additionally, Apple’s price chart places it close to the top. For those who don’t know, a zero-day vulnerability is a software flaw that the vendor is unaware of, allowing attackers to take advantage of it before a fix is available. The idea that developers have had zero days to solve the issue is where the term originates. These defects are extremely valuable to the person who possesses them, uncommon, and difficult to locate technically. Once limited to shadowy areas of the internet, the market for them has expanded into something more akin to an active, if unseen, industry.
Many people believe that Apple’s security architecture is one of the hardest to breach. Ironically, the price is raised precisely because of that reputation. The buyer, a U.S. government contractor, paid a quarter of a million dollars for an iOS exploit that the Grugq, a Bangkok-based exploit broker who became somewhat of a legend in these circles, arranged in 2012. Thinking he had underpriced it, he left. He observed that the customer was overly pleased with the transaction.
The going rate had increased dramatically by 2016. According to reports, the FBI paid a third party more than $1.3 million to unlock an iPhone related to the San Bernardino shooting investigation. It was a noteworthy figure for more reasons than just the quantity; it loudly and publicly demonstrated that there was a market for Apple exploits and that governments were prepared to pay higher prices to access it.
Apple’s head of security engineering, Ivan Krstić, has expressed a degree of satisfaction when discussing this market. Apple believes that high prices indicate that their weaknesses are actually difficult to identify. The majority of Android and Windows exploits are sold for tens of thousands of dollars. Seven figures are frequently cleared by iOS exploits. That gap is a result of years of layered security design, including sandboxed application architecture and custom chips. It is frequently necessary to chain together five to ten distinct bugs, each of which is a discovery in and of itself, in order to exploit an iPhone.
The market continues to find buyers and sellers despite this. The most advanced zero-day exploits can now fetch prices of up to $10 million, according to research from Digital Shadows. This figure strains credulity until you take into account who is making the purchase. Government contractors, surveillance companies, and nation-state intelligence agencies are not small businesses operating on a tight budget. Apple patched seven actively exploited zero-days in 2022 alone. A listing purportedly offering a weaponized Apple vulnerability for more than €2 million surfaced on the dark web that same year. Not impossible, but unconfirmed.
The Apple zero-day market is unique, but it’s also unsettling to consider. Not all of the buyers are criminals in the conventional sense. The Grugq himself pointed out that Western governments pay the best prices and are among the most reliable clients. Although there is a real ethical distinction between a state agency purchasing a surveillance tool and a criminal enterprise doing the same thing, it is not as clear-cut as policy discussions might suggest.
It’s difficult to ignore the fact that discussions about zero-days seldom come to clear conclusions. It is truly impressive how costly it is to attack Apple’s platform. However, the economy that has developed around these vulnerabilities does not appear to be contracting, and expensive is not insurmountable. Someone, somewhere, will be willing to put in the time to find the crack in the wall as long as an iPhone can reveal secrets worth over a million dollars to the right buyer.
The bugs will continue to sell. Prices will probably continue to rise. And a researcher is most likely currently determining the true value of their discovery somewhere in an unremarkable office.
