Wednesday, March 19, 2025
HomeHacksZERODIUM Hosts Tor Browser Zero-Day Bounty Program

ZERODIUM Hosts Tor Browser Zero-Day Bounty Program

Published on

SIEM as a Service

Follow Us on Google News

ZERODIUM is known for paying premium bounties and rewards to security specialists to gain their unique and beforehand unreported zero-day investigation affecting major working operating systems, software, and devices.

Today ZERODIUM hosts Tor Browser Zero-Day Bounty and it is offering $1,000,000 for Zero-day exploits with Tor on Linux and Windows.And the bug bounty program is open up to November 30th, 2017 at 6:00 pm EDT and may be it closed in prior if the total payout reaches $1,000,000.

Exploiting browser vulnerabilities getting harder every day and this initiative will motivate security researchers to build new browser exploits. ZERODIUM sets the bar even higher with a new technical challenge: develop a fully functional zero-day exploit for Tor Browser with JavaScript BLOCKED!

Also read Deep Web Browser Tor Now With More Security and Compatibility

Submission Process

ZERODIUM estimates and verifies all submitted research inside one week or less. Payments are made in one or various installments by wire transfer or using crypto-currencies such as Bitcoin (in specific cases only).

ZERODIUM

The first installment is made within one week or less. For more detail, researchers should contact them with their PGP key.

ZERODIUM Payouts

ZERODIUM payouts for qualified zero-day abuses extend from $5,000 to $1,500,000 per submission. The sums paid by ZERODIUM to specialists to procure their unique zero-day abuses rely upon the fame and security quality of the influenced software/system, and also the nature of the submitted exploit (full or partial chain, supported versions/systems/architectures, reliability, bypassed exploit mitigations, default vs. non-default component, process continuation, etc).

  1. Tor Browser on Tails 3.x (64bit) and Windows 10 RS3/RS2 (64bit) : RCE and LPE to Root/SYSTEM without JavaScript $250,000 and RCE Only (No LPE) without JavaScript $185,000.
  2. Tor Browser on Tails 3.x (64bit) and Windows 10 RS3/RS2 (64bit) : RCE+LPE to Root/SYSTEM with JavaScript $125,000 and RCE Only (No LPE) with JavaScript $85,000.
  3. Tor Browser on Tails 3.x (64bit) OR on Windows 10 RS3/RS2 (64bit) : RCE+LPE to Root/SYSTEM without JavaScript $200,000 and RCE Only (No LPE) without JavaScript $175,000.
  4. Tor Browser on Tails 3.x (64bit) OR on Windows 10 RS3/RS2 (64bit) : RCE+LPE to Root/SYSTEM with JavaScript $100,000 and RCE Only (No LPE) without JavaScript $75,000.
Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Windows File Explorer Vulnerability Enables Network Spoofing Attacks: PoC Released

A critical vulnerability in Windows File Explorer has been discovered, allowing attackers to capture...

CISA Issues Security Warning on Fortinet FortiOS Authentication Bypass Exploit

The Cybersecurity and Infrastructure Security Agency (CISA) issued a critical security warning regarding a...

Fake Coinbase Migration Messages Target Users to Steal Wallet Credentials

A sophisticated phishing campaign is currently targeting cryptocurrency investors with fraudulent emails claiming to...

Electromagnetic Side-Channel Analysis of Cryptographically Secured Devices

Electromagnetic (EM) side-channel analysis has emerged as a significant threat to cryptographically secured devices,...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Chinese Hacked Exploit Juniper Networks Routers to Implant Backdoor

Cybersecurity researchers have uncovered a sophisticated cyber espionage campaign targeting critical network infrastructure, marking...

Salt Typhoon Hacked Nine U.S. Telecoms, Tactics and Techniques Revealed

Salt Typhoon, a state-sponsored Advanced Persistent Threat (APT) group linked to the People's Republic...

APT32 Hacker Group Attacking Cybersecurity Professionals Poisoning GitHub

The malicious Southeast Asian APT group known as OceanLotus (APT32) has been implicated in...