Slashdot Mirror
Zero-Day Hunters Will Pay Over Twice as Much as Apple's New Bug Bounty Programme (vice.com)
Joseph Cox, writing for Motherboard: Last week, Apple finally joined other technology giants and announced a bug bounty programme, where hackers can submit details of previously unknown vulnerabilities in Apple systems and devices, and get paid for sharing them with the company. But Apple is not going to be without competition. On Wednesday, established bug-hunting company Exodus Intelligence launched its own new acquisition programme for both vulnerabilities and exploits. And when it comes to iOS bugs, the company is offering up to more than double Apple's maximum payout. While Apple's highest bounty is $200,000, Exodus is advertising a maximum of $500,000 for vulnerabilities affecting iOS 9.3 or above. Exodus provides details of vulnerabilities and working exploits to customers who pay a subscription fee of around $200,000 per year, according to Time. Those customers could be on the defensive side -- such as antivirus vendors who want to plug newly discovered holes -- or part of an offensive team using the exploit to target systems themselves. On its site, Exodus emphasises the former, writing that it "works with the research community to find these attacks first and make them available to security vendors and enterprises, allowing them to deploy defenses before their adversaries can attack."
This is why Apple's bug bounty program is a complete and utter sham.
Chas - The one, the only.
THANK GOD!!!
Think about the damage to goodwill alone if your product had a vulnerability that was known to bad actors but not to the company because it was too cheap to pay for it.
The solution is obvious: Apple should get a subscription from Exodus. It could be much cheaper than buying each individual security vulnerability from researchers.
For an exploit that lets me take over the world.
Submit to the hackers first, then Apple second!
Doesn't all this bug bounty shit just encourage people to team up and sell a perfect exploit to the bad guys and an imperfect report to several of the good guys?
To profit from a war, become an arms dealer and sell to everyone - that's always been my principle in my field. Sell not to help one side win, but to make sure the war lasts as long as possible Why would it be any different here?
Is that they then sell the vulnerability to highest government bidder.
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
cia / nsa front to me.
Face it, Apple can never outbid on bugx.
I mean, last year, they offered 3 prizes of $1M each for a jailbreak (one of which was claimed).
At a time when Windows and Android exploits go for maybe $10,000 each regularly and $100k tops, iOS vulnerabilities exceed that.
"Thinly-Veiled Extortion Racket Offers Large Amounts Of Totally Legitimate Money"
Obliteracy: Words with explosions
Looking at their web-site they sound more like weapon dealers to me: "The team employs exclusive in-house techniques to create a working exploit tool for the vulnerability" and "We design our offerings such that our clients can digest the information regardless of their intended implementation."
This is an FBI Microsoft site.
Pretty pathetic editing when you misspell the word "program" in the title. Go read a book and learn something you sack of illiterate dicks.
I think the point is that a bug-finder can at least get paid for doing the 'right thing' instead of not.
The black market is likely to be more lucrative in nearly any endeavor.
If Apple is already paying for bug hunting, then we don't need a parasite out there misdirecting and creating security problems for the criminal element to use (yes, that includes warrantless spying).