Slashdot Mirror
iPhone Bugs Are Too Valuable To Report To Apple (vice.com)
An anonymous reader writes: Last year, Apple launched a long-awaited bug bounty program to reward friendly hackers who report flaws in the iPhone to the company. Despite inviting some of the best hackers in the world to join, it's a bit of a flop so far. The iPhone's security is so tight that it's hard to find any flaws at all, which leads to sky-high prices for bugs on the grey market. Researchers I spoke to are reluctant to report bugs both because they are so valuable and because reporting some bugs may actually prevent them from doing more research. "People can get more cash if they sell their bugs to others," said Nikias Bassen, a security researcher for the company Zimperium, and who joined Apple's program last year. "If you're just doing it for the money, you're not going to give [bugs] to Apple directly." Patrick Wardle, a former NSA hacker who now specializes in MacOS research and was invited to the Apple bug bounty program, agreed. He said that iOS bugs are "too valuable to report to Apple."
Apple's pockets are a little deeper than most.
They could surely increase the bounty to a point where no one could possibly compete with them.
Then Apple is not paying well enough if the grey* market pays better.
* NSA, FAPSI, 3PLA, etc
where the bug-exploit reveal is "cleaner" if it comes from a volunteer donor rather from a humanities grad student or homeless person who gets money from Plasma-R-Us?
Why? That does not exist.
If you sell it to Apple, you are a white hat hacker and helping make the product better.
But it cost's you 7 figures per bug to be a good guy or gal.
If you sell at market rate, it isn't a grey market, it's a black market.
You are not only preventing something from getting fixed, you are helping folks do bad things.
But you get a bunch of cash.
It ought to be illegal except that is is funded by the FBI etc.
I don't see how it would hurt Apple to pay market rates, but folks should not get away with clean cash for black activities either.
Someone willing to sell bugs to criminals if they pay better is greyhat at best.
That's black market, not grey, I think.
Cut the pay of the iOS developers by the amount of the bug bounty.
There are plenty of iOS users who have money, there's plenty of motivation. There aren't as many hackers because it's not very rewarding. The OS and app infrastructure is more secure, and it limits application developers in cases.
You seem not to lnow much how an OS works, how its security works and particularily why iOs is that secure.
Your post is pointless.
It starts with 'skiled hackers trying to break', you watch to many bad movies about 'hacking'.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
If I'm good and work for bug bounties on other projects I can get a sort of steady pay. If I work on iOS bugs I might not find a valuable one with 6 months of effort. You could raise the payout to a million dollars a bug but I can't work on it full time because I will never no if and when I will get the pay.
Amway lit a fire once why not bring the hackers in with some sort of public rankings (updated monthly), secret conclaves in HI for the best 25 and all that bull
That's a +1 Painfully True...
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
There is no good or acceptable reason to do anything with a vulnerability other than to first report it to the developer, and then release it to the public if they fail to patch it within an acceptable timeframe.
Make no mistake, that market is as black as the devil's heart.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Let us say Apple creates a division that has access to all the security by obscurity things and even the source code. They don't report to any of the traditional marketing, sales, development hierarchy. They only report to the security chief, and their pay, bonus and career prospects depend on the bugs they find and fix. Sort of like the Military Police, or inspectorates. Would that work?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I'd rather they be used for that first, then Apple can fix them later.
One would be a fool to think that Apple does not also purchase bugs on the black market through intermediaries. Having an inexpensive bug bounty gives incentive to all the white hats out there to do their part to increase Apple security.
For everyone else, Apple will buy exploits in the wild paying market value. If they increased their bug bounty program to this level, it would not increase their ability to get ahead of black hats since they would have to pay over market price to lure them over, but it would make all their other submitted bugs more expensive.
Apple can raise the price enough that thieves can't afford to outbid them. Granted, Apple can't outbid NSA and the other such global organizations. But they can outbid the small time thieves.
Actually Apple can out bid NSA if they want to. By a lot. The entire Intelligence budget for the USA is somewhere around $80 billion per year. This includes CIA, NSA, FBI, DIA, and the rest. Apple's profits last year were about $45 billion. So yeah, NSA isn't going to be able to outbid Apple unless Apple doesn't care.
What's worth more to thieves, 1 bentley, or 20 rust-buckets from the local scrapyard?
1) it's more than 15%.
2) iOS is used by higher value targets. A lot of this came to light when a company strung 3 vulnerabilities together to make a rootkit dropper. The cost was about half a million to attack one dissident.
It contraband it most certainly does exist. But then all markets are 'regulated' by the irresistible force, an offer that can't be refused.
“He’s not deformed, he’s just drunk!”
There is no good or acceptable reason to do anything with a vulnerability other than to first report it to the developer, and then release it to the public if they fail to patch it within an acceptable timeframe.
"Good" and "acceptable" are concepts very much in the eye of the beholder. For some the only "good" is how much money they can make and the rest of the world can burn as far as they care. The only thing "acceptable" to them is a large enough price. This is how much of Wall Street works so why should we expect the market for security flaws to be much different? The greater good is a concept as alien to such people as a Martian.
Make no mistake, that market is as black as the devil's heart.
Quite so.
A.How is it not illegal to profit from the sale of vulnerabilities in software? (other than by reporting it to the vendor and collecting a bounty) and B.How come the software vendors (who presumably dont want vulnerabilities to be bought and sold on the open market) haven't been lobbying for laws to make these vulnerability marketplaces illegal?
Are the software companies worried that if its illegal it will just disappear into the deep web and become even harder to track and deal with? Do the software companies know that such laws will never happen because the government needs these vulnerability marketplaces as a way to get bugs to use in the spying efforts? Do the software companies know that such laws would be pointless since the action happens outside jurisdictions that might actually implement such laws?
Unlike Android, Microsoft etc.
For other companies, security is about protecting their customers. For Apple, security is about protecting Apple's walled garden.
So can you enlighten me?
I've been writing Windows software since you had to write your own message handler loop, I've written video driver interceptors to pull text being sent to the screen. I've written windows message hooks and printer drivers. Before that, I wrote DOS TSRs in assembly. I've rooted my Android phone, I've installed BSD before Linux was a thing. I think I know a thing or two about hacking.
Your rebuttal didn't actually say anything, except that you think I'm wrong. Why exactly, in a structural sense, do you feel iOS is more secure? I maintain that there is nothing structurally different, or more difficult, about hacking iOS. I think the only difference is market share. The money (hacking effort costs money) is going to follow the market king, every time.
iOS sandboxes each app.
Consider it a glorified change root environment which is hardened against break outs.
Basically every app is running with its own group and user id. They can not access each others data.
https://www.apple.com/business...
Yes, we need a new search engine, since google is 'tweaking' search results lots of stuff is hard to find.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.