Winner claimed in $1 million iOS 9 hacking contest

The money was offered in a contest run by a Washington, D.C.-based company called Zerodium, which is in the controversial business of buying and selling information about software vulnerabilities.

It congratulated the winning team on Twitter Monday, though it didn't identify the researchers or provide any details of the hack, which made its claim about finding a new security hole in iOS 9 impossible to verify. Apple officials didn't immediately have a comment.

Apple's iOS is one of the most challenging for hackers to exploit and the company has engineered strong defenses around iOS that make it hard to infect with malware. 

Zerodium launched its contest in September, saying it would reward the first group to come up with a remote, browser-based exploit. That means the unauthorized code had to be delivered to an iOS device by getting the user to visit a web page using Chrome or Safari, or via a text or multimedia message sent to the device, according to Zerodium's conditions.

"It's definitely very technically challenging," said Patrick Wardle, director of research with Synack, a service that matches security researchers with bug-hunting work.

Despite the difficulty, enthusiasts have found ways around Apple's defenses in the past to install unapproved apps, a process known as jailbreaking.

Jailbreakers usually want to run apps from Cydia, a store for unauthorized apps. The jailbreak exploit code is publicly available and those who developed it weren't paid.

Zerodium, however, keeps the vulnerabilities it buys close and only makes them available to clients who subscribe to its Security Research Feed.

The reward it's allegedly paying shows how valuable the information could be to other companies, organizations and even nation states.

"If they’re paying a million dollars, I'm sure that means someone is willing to buy it for that or more," Wardle said in a phone interview Monday.

The flaws are known as "zero-day" vulnerabilities since Apple hasn't had time yet to develop a patch. It may be hard for Apple to figure out how to fix the flaws if more information doesn't leak out.

Wardle said the team likely found several software flaws that are used in a chain to ensure any planted code stays on an iOS 9 device even after it is rebooted.

That probably means the group has found a browser vulnerability and then another one around the core of the operating system, known as the kernel, Wardle said. A third flaw would also be needed to ensure the unauthorized code stays on the device on reboot since Apple checks for strange apps, he said.

Zerodium was founded by Chaouki Bekrar, who also founded Vupen, a now-shuttered vulnerability broker that sold information to government agencies and other organizations.

Vupen's business model was criticized by some in the security community, who contended that sharing vulnerability information without notifying software vendors could put people at unnecessary risk if the information is abused.