Slashdot Mirror
iPhone Bugs Are Too Valuable To Report To Apple (vice.com)
An anonymous reader writes: Last year, Apple launched a long-awaited bug bounty program to reward friendly hackers who report flaws in the iPhone to the company. Despite inviting some of the best hackers in the world to join, it's a bit of a flop so far. The iPhone's security is so tight that it's hard to find any flaws at all, which leads to sky-high prices for bugs on the grey market. Researchers I spoke to are reluctant to report bugs both because they are so valuable and because reporting some bugs may actually prevent them from doing more research. "People can get more cash if they sell their bugs to others," said Nikias Bassen, a security researcher for the company Zimperium, and who joined Apple's program last year. "If you're just doing it for the money, you're not going to give [bugs] to Apple directly." Patrick Wardle, a former NSA hacker who now specializes in MacOS research and was invited to the Apple bug bounty program, agreed. He said that iOS bugs are "too valuable to report to Apple."
Apple's pockets are a little deeper than most.
They could surely increase the bounty to a point where no one could possibly compete with them.
Then Apple is not paying well enough if the grey* market pays better.
* NSA, FAPSI, 3PLA, etc
Dude.
Nancy turned the lights down,
Nancy Pelosi! LOL!
where the bug-exploit reveal is "cleaner" if it comes from a volunteer donor rather from a humanities grad student or homeless person who gets money from Plasma-R-Us?
Why? That does not exist.
If you sell it to Apple, you are a white hat hacker and helping make the product better.
But it cost's you 7 figures per bug to be a good guy or gal.
If you sell at market rate, it isn't a grey market, it's a black market.
You are not only preventing something from getting fixed, you are helping folks do bad things.
But you get a bunch of cash.
It ought to be illegal except that is is funded by the FBI etc.
I don't see how it would hurt Apple to pay market rates, but folks should not get away with clean cash for black activities either.
Someone willing to sell bugs to criminals if they pay better is greyhat at best.
Good story. Would read again.
The iPhone's security is so tight that it's hard to find any flaws at all
Really? This sounds like corporate PR to me.
I'd guess that it's more that there aren't as many skilled hackers trying to break iOS, than some intrinsic superiority of the OS.
That's black market, not grey, I think.
Cut the pay of the iOS developers by the amount of the bug bounty.
If I'm good and work for bug bounties on other projects I can get a sort of steady pay. If I work on iOS bugs I might not find a valuable one with 6 months of effort. You could raise the payout to a million dollars a bug but I can't work on it full time because I will never no if and when I will get the pay.
Amway lit a fire once why not bring the hackers in with some sort of public rankings (updated monthly), secret conclaves in HI for the best 25 and all that bull
That's a +1 Painfully True...
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
There is no good or acceptable reason to do anything with a vulnerability other than to first report it to the developer, and then release it to the public if they fail to patch it within an acceptable timeframe.
Make no mistake, that market is as black as the devil's heart.
"When information is power, privacy is freedom" - Jah-Wren Ryel
You can find WAY more Android bugs, and there are more people using Android. No point in breaking iOS when only 15% of the market is using it.
Let us say Apple creates a division that has access to all the security by obscurity things and even the source code. They don't report to any of the traditional marketing, sales, development hierarchy. They only report to the security chief, and their pay, bonus and career prospects depend on the bugs they find and fix. Sort of like the Military Police, or inspectorates. Would that work?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I'd rather they be used for that first, then Apple can fix them later.
Obvious solution: buy from the grey market at whatever price it's valued. Pretty sure Apple has the cash to do this. In fact, I think they probably already do and the "bug bounty" is just to save money.
Son, you're grounded.
I like the way you think. - T.J.
Creimer we told you to stop shilling your books on slashdot. ;)
One would be a fool to think that Apple does not also purchase bugs on the black market through intermediaries. Having an inexpensive bug bounty gives incentive to all the white hats out there to do their part to increase Apple security.
For everyone else, Apple will buy exploits in the wild paying market value. If they increased their bug bounty program to this level, it would not increase their ability to get ahead of black hats since they would have to pay over market price to lure them over, but it would make all their other submitted bugs more expensive.
Apple can raise the price enough that thieves can't afford to outbid them. Granted, Apple can't outbid NSA and the other such global organizations. But they can outbid the small time thieves.
Actually Apple can out bid NSA if they want to. By a lot. The entire Intelligence budget for the USA is somewhere around $80 billion per year. This includes CIA, NSA, FBI, DIA, and the rest. Apple's profits last year were about $45 billion. So yeah, NSA isn't going to be able to outbid Apple unless Apple doesn't care.
Buy an Amazon Dot. In black, of course, to match my awesome Black MacBook.
It contraband it most certainly does exist. But then all markets are 'regulated' by the irresistible force, an offer that can't be refused.
“He’s not deformed, he’s just drunk!”
There is no good or acceptable reason to do anything with a vulnerability other than to first report it to the developer, and then release it to the public if they fail to patch it within an acceptable timeframe.
"Good" and "acceptable" are concepts very much in the eye of the beholder. For some the only "good" is how much money they can make and the rest of the world can burn as far as they care. The only thing "acceptable" to them is a large enough price. This is how much of Wall Street works so why should we expect the market for security flaws to be much different? The greater good is a concept as alien to such people as a Martian.
Make no mistake, that market is as black as the devil's heart.
Quite so.
There will always be someone angling for an advantage with out a moral code.
A.How is it not illegal to profit from the sale of vulnerabilities in software? (other than by reporting it to the vendor and collecting a bounty) and B.How come the software vendors (who presumably dont want vulnerabilities to be bought and sold on the open market) haven't been lobbying for laws to make these vulnerability marketplaces illegal?
Are the software companies worried that if its illegal it will just disappear into the deep web and become even harder to track and deal with? Do the software companies know that such laws will never happen because the government needs these vulnerability marketplaces as a way to get bugs to use in the spying efforts? Do the software companies know that such laws would be pointless since the action happens outside jurisdictions that might actually implement such laws?
Unlike Android, Microsoft etc.
For other companies, security is about protecting their customers. For Apple, security is about protecting Apple's walled garden.