'We think the amount of the bounty is a testament to the security we provide.

The non-profit foundation also urges researchers and hackers to responsibly disclose vulnerabilities in Tor via its recently-launched bug bounty program. In response to the Zerodium bounty program, Tor Project says that breaching the security of its anonymity software may risk lives of many users, including human rights defenders, activists, lawyers, and researchers, who rely on it. We have launched this special bounty for Tor Browser zero-days to help our government customers fight crime and make the world a better and safer place for all,' Zerodium said. 'In many cases, used by ugly people to conduct activities such as drug trafficking or child abuse. In a FAQ, the company has admitted that it will sell the acquired Tor zero-days to law enforcement agencies, and possibly the commercial malware development companies who sell spyware to governments. Zerodium to Sell Tor Browser 0-Days to Law Enforcement AgenciesĪlthough the zero-day market has long been a lucrative business for private firms that regularly offer more payouts for undisclosed vulnerabilities than big technology companies, Zerodium says that it wants to resell the Tor browser exploits to law enforcement agencies to fight crime. Other attack vectors such as delivery via malicious document are not eligible for this bounty, but ZERODIUM may, at its sole discretion, make a distinct offer to acquire such exploits. Moreover, the zero-day Tor exploit must work without requiring any user interaction, except for victims to visit a web page.

The company has also clearly mentioned that the exploit must leverage remote code execution vulnerability, the initial attack vector should be a web page and it should work against the latest version of Tor Browser.

Tor browser for android non root