Slashdot Mirror
Apple's Lack of Bug Bounty Program May Explain Why Hackers Would Help FBI
On Wednesday, it was reported that FBI has contracted Cellebrite, an Israeli software provider specializing in mobile phone forensics, for $15,000 to break into the iPhone. It is believed that Cellebrite knows of a flaw in the iPhone which could allow circumvention of iOS' built-in security layers. Cellebrite could have worked with Apple on this flaw, but it chose to help FBI instead. It doesn't take rocket science to understand why Cellebrite chose to take the other route. The New York Times says that many security firms and hackers would love to work with Apple to further improve its products, but they don't because of a lack of incentive. There's little to no monetary incentive in helping the company with finding loopholes in its products. Apple -- unlike a number of Silicon Valley giants including Facebook, Microsoft, Google, Mozilla, and recently added to the list, Uber -- doesn't maintain a Bug Bounty program. Nicole Perlroth and Katie Benner report for the Times: When hackers do find flaws in Apple's code, they have little incentive to turn them over to the company for fixing. [...] Apple, which has had relatively strong security over the years, has been open about how security is a never-ending cat-and-mouse game and how it is unwilling to engage in a financial arms race to pay for code exploits. The company has yet to give hackers anything more than a gold star. When hackers do turn over serious flaws in its products, they may see their name listed on the company's website -- but that is it. That is a far cry from what hackers can expect if they sell an Apple flaw on the thriving underground market where a growing number of companies and government agencies are willing to pay hackers handsomely.
So if Apple pays the hackers $10,000 then the hackers won't go to the FBI when the FBI offers them $100,000?
What if Spectre pays the hackers one millyun dollars? Would you then write an article about how it's Apple's fault they wrote those bugs in the first place allowing crime and not paying enough a bounty so that good and noble heroic autobot white hat hackers could get paid for their awesome work?
Breaking into a 5c iphone:
https://www.aclu.org/blog/free...
So you're claiming that a company who specializes in helping government break into phones and do a forensic analysis on phones would rather take a meager bug bounty than potentially earn millions by aiding government spying and investigation? Yes that makes perfect sense. Do these NYT authors know that NASA is hiring rocket scientists?
Only LUDDITE companies making LUDDITE software have bugs. Apple's modern appy app apps are 100% appy and don't have any bugs!
Apps!
From what I can tell from Cellebrite themselves that they are not taking advantage of a security or software flaw but simply copying the data repeatedly at chip level after failing the 10 attempt limit.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Of course this article is over the top -- bugs will be worth more on the open market. However it is worth discussing. Apple does offer you something: acknowledgement on their website and a swift resolution of the problem. I have submitted a bug to Apple under this program that was acknowledged but have found that they leave much to be desired in this process. Replies from Apple on each email take about 30 days. No status reports are provided unless you ask. No details are provided whatsoever on the fix (from an academic perspective). For this first time I am following this process solely to see if it will work and so I may document for the public. However in the future I will be following my standard ethics / best practice with Apple just like every other company: "here's your vuln, I'm publishing in two weeks, please link to my blog when you announce this, call me if you need help or more time."
Well companies like Celebrite are being responsible, because they're reporting the exploit to the FBI, and getting paid for it. Pragmatic security researchers then implement a kludge to minimize their exposure.
This allows them to "make a living" while dedicating their income earning time towards making their community more secure. Its children who think the world works on "right and wrong", and that actions which "reward" behavior labelled as bad should never be conducted. Of course, because they're clueless, they don't realize the consequences of impractical decisions that doesn't correspond to reality. If Apple doesn't offer to pay them to disclose their security holes, and the FBI doesn't offer to pay to disclose security holes, then criminal organizations will pay for those security holes. "Nyah Nyah Nyah, I don't want to listen to the obvious, let me sit in my useless, uncomfortable social justice armor".
There is no America. There is no democracy. There is only IBM and AT&T and DuPont, Dow, General Electric, and Exxon
So if Apple pays the hackers $10,000 then the hackers won't go to the FBI when the FBI offers them $100,000?
Given that Apple has $200 Billion in the bank I'm pretty sure Apple can win that competition if they want to. The FBI's entire budget is something like $8 billion.
Let me offer you an alternative interpretation:
The FBI has known what was on that phone for a LONG LONG time, because they've always had the ability to break into the phone. They realized that they're not going to get the court precedent they wanted, so now it's time to humiliate apple by paying Celebrite to play along like they are the ones that hacked the phone. This gives the FBI three things:
1) The ability to claim that their tech isn't that great, thus keeping their enemies in the dark.
2) Being able to save face and NOT set the precedent in the opposing direction (because they can drop the case which results in no precedent being set)
3) They can throw some egg on Apple's face saying that "an Israeli company" had the ability to break into the phone. (Notice that it's not a foreign government that has this capability), playing on the xenophobia of stupid Americans.
This has always been and always will be a political fight, not a technical one.
Which has more power: the hammer, or the anvil?
Except that they don't: https://linux.slashdot.org/sto...
"How dare you! This is the entitlement generation. Apple owes us money."
Actually, when you look at the offshore tax avoidance, they most certainly do, as far as tax money goes.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Yes indeed. The FBI are scum that lurk in the sewers of the underground market. But we knew that already.
http://www.acetonestudio.com
the FBI's attempts to find his accomplices (if any) is as crispy clean from both legal and ethical point of view as virgin snow.
“He’s not deformed, he’s just drunk!”
Well, the District attorney will pay 15000 for each and every of the hundreds of iPhones they want cracked, Apple would only pay once.
Neither interpretation contradicts one another; they can both be valid. I wasn't addressing the motivation for the FBI to reveal their association with a security consulting firm. On the other hand, I was directly addressing the "snitches get stitches" trope that the OP seems to be suggesting.
There is no America. There is no democracy. There is only IBM and AT&T and DuPont, Dow, General Electric, and Exxon
Yeah, yeah, you just hate white...
In Soviet Washington the swamp drains you.
Bug bounties are for cows, moo?
Not really. crispy clean just made me kinda hungry for a doughnut.
“He’s not deformed, he’s just drunk!”
You forgot this one: Only PROPRIETARY SOFTWARE companies making CLOSED software have bugs. The gnuPhone's modern appy app apps are 100% free, and since enough eyeballs make all bugs shallow, they don't have any bugs - not even Heartbleed!
(Disclaimer: like its parent, the preceding comment was just a joke. Since no response is necessary for a joke, this comment is ipso facto not a "Troll.")
The FBI has known what was on that phone for a LONG LONG time, because they've always had the ability to break into the phone. They realized that they're not going to get the court precedent they wanted, so now it's time to humiliate apple by paying Celebrite to play along like they are the ones that hacked the phone.
Except that Apple already said in their response that the FBI hasn't tried any alternate means before rushing to the court to order Apple to work for them. Congress also grilled the FBI if they tried other means and the answer was they exhausted all alternatives. It appears that they didn't. If I were Apple, I'd throw that in their face.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Basically, bug bounties mean you're paying freelancers to set up a working group to find exploits. And then hope that, once they have their group working well, that the group you paid to set up will sell their results to you, and only you.
Here's what Machiavelli said about mercenaries:
But isn't iPhone's encryption enough to protect a particular user's data (as long as there is no one with enough resources trying to extract data from said phone)?
Linux is for people who don't mind RTFM.
And if they do manage to track you down, you submit working exploit code as evidence. They either drop the case before the exploit is entered into evidence (where it becomes a matter of public record a-la DeCSS) or, well, you were going away for it anyway, right?
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Just spout a vulnerability off in front of their sales people and see how they react.
Um...
I don't know what kind of interactions you've had with salespeople in general, but that reaction has nothing to do with Apple.
It's kind of like asking the your DB admin to do your dental work -- it's just not their field.
-- Sometimes you have to turn the lights off in order to see.
To each their own, but when I think of positive attributes for a doughnut, crispy is not on the list.
In fact, crispy is near the top of the field labeled "negative attributes for doughnuts".
-- Sometimes you have to turn the lights off in order to see.
Wait, people want incentives to work? Oh, the horror! You mean that won't just do stuff for Kumbay, Utopia and altruism? My social justice model is broken.
Just another day in Paradise
Which means do you find so objectionable as to require justification?
Thank you for paying some attention. Had you actually been smarter, you would've noticed, that my objections are always to government doing, what it should not be doing at all.
Prosecuting actual murderers is not on the list...
A typical Illiberal coward — posts anonymously so his precious down-mod survives...
In Soviet Washington the swamp drains you.