Sources detail Azimuth Security, a boutique hacking shop finding 0-days for Tor, iOS, Android, more, which counts agencies from Five Eyes countries as clients
Motherboard : Tweets: @lorenzofb , @josephfcox , @josephfcox , @josephfcox , @lorenzofb , @josephfcox , @josephfcox , @motherboard , @lorenzofb , @lorenzofb , @cauchon , @lorenzofb , @mattbraga , @jason_koebler , and @josephfcox Tweets: Lorenzo Franceschi-Bicchierai / @lorenzofb : Here's an up-to-date price list for exploits, according to sources who work in the zero-day industry: -iOS remote jailbreak: $2 million -Chrome remote exploit with sandbox escape: $500,000-$1 million -Firefox remote: $200,000 -Tor $150,000-$250,000 http://motherboard.vice.com/ ... Joseph Cox / @josephfcox : Showing that there are legit zero-day vendors will be inconvenient for some peoples' narratives/illustrations of the industry. Important concerns remain, but you need to know the reality of the industry to have a nuanced, honest, and hopefully fruitful debate. No point otherwise Joseph Cox / @josephfcox : And the top-end of exploit development, hackers leave the NSA to join exploit companies; they leave the companies to join Apple; there's a circular door between firms, intel agencies, and Silicon Valley https://motherboard.vice.com/ ... pic.twitter.com/ySSlBMty47 Joseph Cox / @josephfcox : Highlighting the legit side of the zero-day industry is important for a load of questions: you can't talk about risks of zero-day proliferation, exploits also being sold to adversaries, whether 0days should be more readily patched if there is a gap in knowledge around legit firms Lorenzo Franceschi-Bicchierai / @lorenzofb : Oh, also, did you know @josephfcox is back on board? I can't say how happy I am to have another chance at working with him on stories such as this one. pic.twitter.com/70YA04iEEN Joseph Cox / @josephfcox : New: meet the startup selling exploits to the FBI, Australia's NSA, UK & Canada. Has some of the world's best iPhone hackers; hired NSA exploit writers. Over a dozen well-placed sources described the top-end of the zero-day industry you rarely hear about https://motherboard.vice.com/ ... pic.twitter.com/QLrRWTLA4e Joseph Cox / @josephfcox : To be blunt, the narrative around zero-day sales, that its mercenaries out of make money however they can, is wrong. There are legitimate actors, smaller shops, who provide to U.S. government, Five Eyes. https://motherboard.vice.com/ ... pic.twitter.com/LneCjVMcMw @motherboard : This story has been years in the making by @josephfcox and @lorenzoFB, and includes over a dozen sources detailing how Azimuth Security sells zero-days and exploits for iPhone and Android. Customers include the FBI, the UK, Canada, and Australia http://bit.ly/2BitYJI Lorenzo Franceschi-Bicchierai / @lorenzofb : This is the big the takeaway in our story. Too often this industry has been painted with a broad brush as sketchy. That is just not true. Also, you can be against govt using exploits or govt having backdoors to get around encryption. But you probably can't be against both. https://twitter.com/... Lorenzo Franceschi-Bicchierai / @lorenzofb : This tiny startup you probably never heard of helps government hackers in USA, UK, Australia and Canada get around encryption with expensive iOS, Android and Tor exploits. https://motherboard.vice.com/ ... pic.twitter.com/s3RkB1I6bw Justin Cauchon / @cauchon : According to the sources in the story, the company provided the FBI was an exploit to break through the Tor Browser. https://motherboard.vice.com/ ... pic.twitter.com/d8i7lSoeNX Lorenzo Franceschi-Bicchierai / @lorenzofb : The point here is that unless you're an anti-surveillance absolutist, it's either or. You can't have governments doing their jobs without either backdoors or exploits to get around encryption. Matthew Braga / @mattbraga : Linchpin Labs, Ottawa firm of ex-spies, distributes software exploits developed by another company, Azimuth security (CSE a reported customer). Great get by @josephfcox + @lorenzoFB, confirming whispers I've heard over the past few years. https://twitter.com/... Jason Koebler / @jason_koebler : Explosive story from @josephfcox and @lorenzoFB. The most important hacking companies are the ones most people have never heard of: https://motherboard.vice.com/ ... Joseph Cox / @josephfcox : While companies like Hacking Team and FinFisher are advertising at surveillance fairs, Azimuth doesn't need to: it has a partner company, a bridge to Five Eyes intelligence agencies. 3 sources say company run by ex-spies, 5 sources confirm relationship https://motherboard.vice.com/ ... pic.twitter.com/Zq9PP1yItn