The company Zerodium is issuing an open challenge to hackers everywhere, announcing a new bug bounty program with a reward of $100,000 for anyone who manages to bypass the new Flash Player security feature related to the heap isolation mitigation protocol.
Heap isolation, also known as isolated heap, is a recently developed method for mitigating “user after free” vulnerabilities and one of Adobe's latest efforts to strengthen the defenses of the much-maligned Flash Player.
Despite constant calls for the permanent removal of Flash Player and the strong criticism it has received from time to time, Adobe developers , as well as independent researchers outside the organization, continue to invest in it, developing defenses against modern threats and attacks.
Zerodium, which markets unknown software flaws to businesses and intelligence agencies, announced last Thursday that any exploit that bypasses Flashplayer's heap isolation (with sandbox escape) will be subsidized with the amount of $100,000, while any exploit (without sandbox escape) will be subsidized with the amount of $65,000.
Adobe added isolated heap to Flash. This month we pay $100K (with sandbox) and $65K (without sandbox) per #exploit bypassing this mitigation
— Zerodium (@Zerodium) January 5, 2016
Last September, Zerodium announced that it was offering the astronomical sum of $1 million to the first three people who would manage to "break" the latest version of Apple's software, iOS 9, by successfully jailbreaking i-devices.
In November, a hacking group received the sum for disclosing a zero-day vulnerability that allowed remote hacking of any iOS device.
