Slashdot Mirror
iPhone Bugs Are Too Valuable To Report To Apple (vice.com)
An anonymous reader writes: Last year, Apple launched a long-awaited bug bounty program to reward friendly hackers who report flaws in the iPhone to the company. Despite inviting some of the best hackers in the world to join, it's a bit of a flop so far. The iPhone's security is so tight that it's hard to find any flaws at all, which leads to sky-high prices for bugs on the grey market. Researchers I spoke to are reluctant to report bugs both because they are so valuable and because reporting some bugs may actually prevent them from doing more research. "People can get more cash if they sell their bugs to others," said Nikias Bassen, a security researcher for the company Zimperium, and who joined Apple's program last year. "If you're just doing it for the money, you're not going to give [bugs] to Apple directly." Patrick Wardle, a former NSA hacker who now specializes in MacOS research and was invited to the Apple bug bounty program, agreed. He said that iOS bugs are "too valuable to report to Apple."
NT
Apple's pockets are a little deeper than most.
They could surely increase the bounty to a point where no one could possibly compete with them.
Then Apple is not paying well enough if the grey* market pays better.
* NSA, FAPSI, 3PLA, etc
Apple needs to learn how to compete in a genuinely open market.
Read this...you'll be glad you did!
Nancy turned the lights down, she hovered over me, her fetid breath enhanced by rubbing her stinky fingers on her teeth. I said, I am ready to taste your shit. Nancy smiled, I'm ready to stink you up. Nancy still had her panties on. They were sagging under the load of excrement inside. She placed her left hand inside and emerged with shit covered palm and digits. The ample load dripped from her. I reminded her that this was new to me. Only a taste. Vomit is not one of the smells that turns me on. Nancy wants to please. She licked most off and daubed her nipples. She extended her index finger to me and asked me if I liked the smell. Heavenly aroma, she rubbed her lips and put some on her outstretched tongue. She said she wanted to kiss me. Her tongue coaxed my lips apart. We French kissed. I felt her tongue, I felt the excrement, I felt excited too. It tasted slightly bitter and had a coarseness to it. I enjoyed the experience of having such a lovely stench in my mouth.
I asked Nancy if my breath stank. Just like mine she replied. Nancy was recruiting a virgin to shit eating. She was getting excited and was a little more tongue aggressive with a second helping that she kissed me with. She was also sweating profusely. She asked if she could fuck me. I have a two headed dildo, not too long and shit lubricated. My quick reply, absolutely, and another small helping of your shit. Nancy inserted herself and penetrated me. Using her right hand she replenished the fecal mass on her face. I asked her to put her brown covered finger in my nose to be refreshed with shit. So slowly did she fuck me. Closing my eyes I luxuriated in the penetration, the smell and now the taste of shit. I wanted this to last forever, but the ecstasy equaled coitus erruptus. Nancy held out a little longer. Her orgasm ended in us being a tangled, sleepy heap on that tight table.
I think a half hour passed and Evelyn entered the room. You look cozy and smell sexy, Evelyn remarked in a curious low pitched voice. Evelyn came over and smelled Nancy's excrement coated hair and said to her you're very ripe. I love it and so do you, she retorted. This was a funny and not so friendly exchange. Evelyn chimed in let's shower and get some steaks. No shower for me, Nancy said. I'm going to head home, masturbate and sleep. In short order she was gone. Evelyn embraced me and kissed me. Just us now. I have an exciting evening planned. Hot water to shower, no soap. A fragrant hint of feces on us. Not too much to arouse interest in a public environment, except maybe to attract another shit savoring dyke. Evelyn squeezed into a very tight fitting pair of silk panties. They would make a sexy parachute.
They also bore a resemblance to the panties in the shit smearing video we had watched. She completed her ensemble with fish net stockings and an ample jacket that cloaked her in respectability but left room for interest. Black dress for me, black sheer stockings. No false modesty. I looked good. A very pricey eatery, as I expected. Rare steaks and upscale wines, very intimate setting. We could converse in privacy. Recalling our initial encounter in the Mediterranean. Mykonos was our favorite port. We had our trysts amidst the blazing white windmills and the blazing blue sky. Above the sea, in narrow alleys we deeply inhaled each others shit on our fingertips.
A wonderful meal and memories . More smelly sex awaiting us Evelyn remarked. As we pulled into the garage Evelyn mentioned that she wanted to explore fetishes that compliment their love of shit smelling. Was I interested?? I said yes but was a little hesitant. Was the sudden departure of Nancy part of a prearranged scenario?? This address was listed at my hotel as the place I would be staying at.
Evelyn wanted to view the porno video we had looked at before. She wanted to do her version. Now the tight sweaty panties made sense. I sat in a comfortable chair as Evelyn got down on her knees and I watched her push out a perfect and substantial turd. An
where the bug-exploit reveal is "cleaner" if it comes from a volunteer donor rather from a humanities grad student or homeless person who gets money from Plasma-R-Us?
The appy iPhone doesn't have bugs; it only has appy app apps! Anyone who claims they found an iPhone bug is a LUDDITE who actually found a bug in a LUDDITE phone like the LUDDITE Nokia 3310!
Apps!
If you sell it to Apple, you are a white hat hacker and helping make the product better.
But it cost's you 7 figures per bug to be a good guy or gal.
If you sell at market rate, it isn't a grey market, it's a black market.
You are not only preventing something from getting fixed, you are helping folks do bad things.
But you get a bunch of cash.
It ought to be illegal except that is is funded by the FBI etc.
I don't see how it would hurt Apple to pay market rates, but folks should not get away with clean cash for black activities either.
Someone willing to sell bugs to criminals if they pay better is greyhat at best.
The iPhone's security is so tight that it's hard to find any flaws at all
Really? This sounds like corporate PR to me.
I'd guess that it's more that there aren't as many skilled hackers trying to break iOS, than some intrinsic superiority of the OS.
That's black market, not grey, I think.
Cut the pay of the iOS developers by the amount of the bug bounty.
If I'm good and work for bug bounties on other projects I can get a sort of steady pay. If I work on iOS bugs I might not find a valuable one with 6 months of effort. You could raise the payout to a million dollars a bug but I can't work on it full time because I will never no if and when I will get the pay.
Amway lit a fire once why not bring the hackers in with some sort of public rankings (updated monthly), secret conclaves in HI for the best 25 and all that bull
There is no good or acceptable reason to do anything with a vulnerability other than to first report it to the developer, and then release it to the public if they fail to patch it within an acceptable timeframe.
Make no mistake, that market is as black as the devil's heart.
"When information is power, privacy is freedom" - Jah-Wren Ryel
You can find WAY more Android bugs, and there are more people using Android. No point in breaking iOS when only 15% of the market is using it.
Let us say Apple creates a division that has access to all the security by obscurity things and even the source code. They don't report to any of the traditional marketing, sales, development hierarchy. They only report to the security chief, and their pay, bonus and career prospects depend on the bugs they find and fix. Sort of like the Military Police, or inspectorates. Would that work?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I'd rather they be used for that first, then Apple can fix them later.
Obvious solution: buy from the grey market at whatever price it's valued. Pretty sure Apple has the cash to do this. In fact, I think they probably already do and the "bug bounty" is just to save money.
I like the way you think. - T.J.
One would be a fool to think that Apple does not also purchase bugs on the black market through intermediaries. Having an inexpensive bug bounty gives incentive to all the white hats out there to do their part to increase Apple security.
For everyone else, Apple will buy exploits in the wild paying market value. If they increased their bug bounty program to this level, it would not increase their ability to get ahead of black hats since they would have to pay over market price to lure them over, but it would make all their other submitted bugs more expensive.
Apple can raise the price enough that thieves can't afford to outbid them. Granted, Apple can't outbid NSA and the other such global organizations. But they can outbid the small time thieves.
Actually Apple can out bid NSA if they want to. By a lot. The entire Intelligence budget for the USA is somewhere around $80 billion per year. This includes CIA, NSA, FBI, DIA, and the rest. Apple's profits last year were about $45 billion. So yeah, NSA isn't going to be able to outbid Apple unless Apple doesn't care.
There is no good or acceptable reason to do anything with a vulnerability other than to first report it to the developer, and then release it to the public if they fail to patch it within an acceptable timeframe.
"Good" and "acceptable" are concepts very much in the eye of the beholder. For some the only "good" is how much money they can make and the rest of the world can burn as far as they care. The only thing "acceptable" to them is a large enough price. This is how much of Wall Street works so why should we expect the market for security flaws to be much different? The greater good is a concept as alien to such people as a Martian.
Make no mistake, that market is as black as the devil's heart.
Quite so.
There will always be someone angling for an advantage with out a moral code.
A.How is it not illegal to profit from the sale of vulnerabilities in software? (other than by reporting it to the vendor and collecting a bounty) and B.How come the software vendors (who presumably dont want vulnerabilities to be bought and sold on the open market) haven't been lobbying for laws to make these vulnerability marketplaces illegal?
Are the software companies worried that if its illegal it will just disappear into the deep web and become even harder to track and deal with? Do the software companies know that such laws will never happen because the government needs these vulnerability marketplaces as a way to get bugs to use in the spying efforts? Do the software companies know that such laws would be pointless since the action happens outside jurisdictions that might actually implement such laws?
Unlike Android, Microsoft etc.
For other companies, security is about protecting their customers. For Apple, security is about protecting Apple's walled garden.