Slashdot Mirror
Apple's Lack of Bug Bounty Program May Explain Why Hackers Would Help FBI
On Wednesday, it was reported that FBI has contracted Cellebrite, an Israeli software provider specializing in mobile phone forensics, for $15,000 to break into the iPhone. It is believed that Cellebrite knows of a flaw in the iPhone which could allow circumvention of iOS' built-in security layers. Cellebrite could have worked with Apple on this flaw, but it chose to help FBI instead. It doesn't take rocket science to understand why Cellebrite chose to take the other route. The New York Times says that many security firms and hackers would love to work with Apple to further improve its products, but they don't because of a lack of incentive. There's little to no monetary incentive in helping the company with finding loopholes in its products. Apple -- unlike a number of Silicon Valley giants including Facebook, Microsoft, Google, Mozilla, and recently added to the list, Uber -- doesn't maintain a Bug Bounty program. Nicole Perlroth and Katie Benner report for the Times: When hackers do find flaws in Apple's code, they have little incentive to turn them over to the company for fixing. [...] Apple, which has had relatively strong security over the years, has been open about how security is a never-ending cat-and-mouse game and how it is unwilling to engage in a financial arms race to pay for code exploits. The company has yet to give hackers anything more than a gold star. When hackers do turn over serious flaws in its products, they may see their name listed on the company's website -- but that is it. That is a far cry from what hackers can expect if they sell an Apple flaw on the thriving underground market where a growing number of companies and government agencies are willing to pay hackers handsomely.
So if Apple pays the hackers $10,000 then the hackers won't go to the FBI when the FBI offers them $100,000?
What if Spectre pays the hackers one millyun dollars? Would you then write an article about how it's Apple's fault they wrote those bugs in the first place allowing crime and not paying enough a bounty so that good and noble heroic autobot white hat hackers could get paid for their awesome work?
You're onto part of the real point here...but only part of it. Cellebrite already makes their living doing this kind of thing; they're the primary producer of forensic tools for mobile devices. They used to do iPhones, back before it got so hard to hack them that it wasn't worth their time any longer. When troops in the field capture cellular devices and they want to know what is in them? They plug them into a Cellebrite device.
So, 1, Cellebrite isn't 'hackers,' it's a company with a business model that focuses on pulling data out of devices when you don't have the PIN to unlock them. And 2, a bug bounty program isn't meant to deter companies from producing forensic tools.
Exactly. Forensic companies are unlikely to let vendors know what exploits they find because that eliminates one of their entry points once the bug is fixed; the NYT article points that out as well. A bounty program could make it financially unviable to keep trying to find holes in iOS but as it becomes more difficult to find exploits it also becomes more lucrative to sell them to others, white or black hat. Why collect 100K from Apple when you can sell the same exploit multiple times and make a lot more than that? The best outcome Apple could achieve is to make it so difficult and time consuming to find exploits that those with the technical skills to do so turn to easier targets. Sure, a dedicates lone hacker or two may find an exploit and so so simply of rtes challenge; but you only need one of them to turn it it to kill the bug. Recognition and some cash may be enough to convince one person to reveal the bug to Apple; and you only need one person for bounties to be effective. In the end, those who use exploits for financial gain will continue to search and keep their findings to themselves; those that do it for other reasons such as research or for recognition of their skills may be more willing to share what they find.
I'm a consultant - I convert gibberish into cash-flow.
"So if Apple pays the hackers $10,000 then the hackers won't go to the FBI when the FBI offers them $100,000?"
Correct. If the hackers know about it, and already got paid by Apple, as soon as the FBI finds out it's not a legit 'never-before seen' hack (because it has been reported and a prize claimed) then they'll be on that hacker's ass.
Hackers have logic. Try using some of it some time.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
"How dare you! This is the entitlement generation. Apple owes us money."
Actually, when you look at the offshore tax avoidance, they most certainly do, as far as tax money goes.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
You're off by an order of magnitude.
The bug bounty for a zero-day iOS9 bug is $1,000,000 with up to $3,000,000 paid out in total.
So yes, even if Apple offered $100K, when people are willing to spend millions on a bug, it's just an arms race.