Slashdot Mirror
Apple Has Started Paying Hackers for iPhone Exploits (vice.com)
Lorenzo Franceschi-Bicchierai, reporting for Motherboard: In 2016, Apple's head of security surprised the attendees of one of the biggest security conference in the world by announcing a bug bounty program for Apple's mobile operating system iOS. At the beginning, Apple struggled to woo researchers and convince them to report high-value bugs. For the researchers, the main issue was that the bugs they discovered were too valuable to report to Apple, despite rewards as high as $200,000. Companies like GrayShift and Azimuth made an entire business out of exploiting vulnerabilities in Apple products, while other researchers didn't want to report bugs so they could keep doing research on iOS. But two years later, some researchers are finally reporting vulnerabilities to Apple, and the company has begun to award some researchers with bounties, Motherboard has learned.
[...] Adam Donefeld, a researcher at mobile security firm Zimperium said that he has submitted several bugs to Apple and received payments for the company. Donefeld was not part of the first batch of security researchers who were personally invited by Apple to visit its Cupertino campus and asked to join the program. But after submitting a few bugs, Donefeld told me, an Apple employee asked him if he wanted to be part of the bounty program in a phone call. "I know Apple pays people," Donefeld said in an online chat. "I'm certainly not the only payout." Another researcher, who asked to remain anonymous because they are worried about souring their relationship with Apple, said that they have submitted a few bugs and been awarded bounties, but has yet to be paid. [...] Two other researchers told Motherboard they also have concerns with or have had trouble with the program. One said they weren't paid for a bug they submitted (Motherboard could not independently confirm that the researcher did not get a payment), and another said they didn't want to participate in it at all, even after being invited. Further reading: Google Bug Hunter Urges Apple To Change Its iOS Security Culture; Asks Tim Cook To Donate $2.45 Million To Amnesty For His Unpaid iPhone Bug Bounties.
[...] Adam Donefeld, a researcher at mobile security firm Zimperium said that he has submitted several bugs to Apple and received payments for the company. Donefeld was not part of the first batch of security researchers who were personally invited by Apple to visit its Cupertino campus and asked to join the program. But after submitting a few bugs, Donefeld told me, an Apple employee asked him if he wanted to be part of the bounty program in a phone call. "I know Apple pays people," Donefeld said in an online chat. "I'm certainly not the only payout." Another researcher, who asked to remain anonymous because they are worried about souring their relationship with Apple, said that they have submitted a few bugs and been awarded bounties, but has yet to be paid. [...] Two other researchers told Motherboard they also have concerns with or have had trouble with the program. One said they weren't paid for a bug they submitted (Motherboard could not independently confirm that the researcher did not get a payment), and another said they didn't want to participate in it at all, even after being invited. Further reading: Google Bug Hunter Urges Apple To Change Its iOS Security Culture; Asks Tim Cook To Donate $2.45 Million To Amnesty For His Unpaid iPhone Bug Bounties.
>> Apple Has (FINALLY) Started Paying Hackers for iPhone Exploits (,FOLLOWING THE FOOTSTEPS OF HUNDREDS OF OTHER TECH COMPANIES)
Thinking back 10-20 years ago. Where if people reported security flaws, the big tech companies other then thanking them for reporting the issues, would try to sue them, to put them in jail for hacking their systems. Not really understanding the hacking community and the fact that most of them are not out to do damage to other people or systems, but just the thrill of finding new ways to get in. Being able to get paid for your efforts helps instinctive the hackers to report their findings, it help the company fix there problems before it become out of hand, and makes sure people are not afraid to use technology beyond its intended purposes and innovate vs using just what is was meant for in fear of getting into trouble by Big Tech.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Why do these "security researchers" think they're entitled to get paid by Apple? Sounds like a bunch of lazy millennial with a massive sense of entitlement.
It's here! APK Hosts File Engine 1.0++ 64-bit for MacOS h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r M a c O S . z i p
Yields more security/speed/reliability/anonymity vs. any 1 solution (99% of threats use hostnames vs. IP address most firewalls use) more efficiently/FASTER + NATIVELY 4 less!
Vs. "Bolt on 'MoAr' illogic-logic" slowing you hosts speed u up 2 ways: Adblocks + Hardcode fav. sites u spend most time @ vs. competition loaded w/ security bugs (DNS/AntiVir) + overheads slowing u (messagepass 'souled-out' to advertisers easily detected & blocked addons + firewall filtering drivers) & their complexity leads to exploitation!
* ONLY 1 of its kind in GUI 4 MacOS!
(Better vs. Windows model in speed/efficiency/merge)
APK
P.S.=> Protects against Spectre & Meltdown + redirect poisoned or downed DNS/botnets/malware downloads/malcript/email malicious payloads... apk
See subject: Your MASSIVE FAIL in this life is you're nothing more than a chattering little do-nothing "ne'er-do-well" online & you know it...
* Is that the best your "phantasyland FAKE NAME" (for your fake lie of a so-called 'life') can manage?
When a FAKE NAME do nothing like YOU does better than I have? Then talk (you're all talk & no action)...
You can't help you're an immature little BUTTHURT no-mind, lol! I blew you away in TONS OF PLACES and easily dust your no-mind bullshit blatherings.
APK
P.S.=> The TRUE PRICE of your UNIDENTIFIABLE FAKE NAME do-nothing selves like you that I can ALWAYS CASH IN ON (lol) is that I can use FACT/TRUTH on them to SHATTER their all TOO fragile delusional egos that they actually know A DAMN THING in computing, lol... apk
Your software is just fine - well written, functional... I'm going to continue using the Host File Engine by mmell February 17, 2017
Your premise that hostfiles are a good way to deal with advertising and malvertising is quite valid - by JazzLad April 20, 2016
his hosts program is actually pretty good by xenotransplant August 10 2015
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg September 25 2015
I like your host file system by Karmashock September 09 2015
that APK guy, I use his host file by rogoshen1 Tuesday March 03, 2015
I personally use a HOSTS file blocker produced from a genius called APK by 110010001000 October 27 2017
* Provides full protection against Spectre & Meltdown flaws
APK
P.S.=> Comprehensive security without wasting money on bug bounties for Juden security researchers. Linux version is also available!... apk
Rather than capping the reward at an arbitrary value, which limits the chances of it being brought to them, Apple should have a policy that negotiates/bids the bounty amount based on the exploit's significance. The process can work by having the hacker demonstrate the exploit to Apple, without revealing how the exploit works, after which they can negotiate the bounty.
See subject: Don't worry - the "Golden Calf" of your shekels dries up! I give folks what they want vs. your machinations, lol & THUS I always will win... & you KNOW it.
* Heck - you're PROVING IT via your EASILY NULLIFIED "Bitch Tactics 'efforts'" which I easily prove are you in seconds by posting your PUNY threats... lmao!
(You really ARE too STUPID to live... time to FIRE UP THE OVENS again & Zyklon B showers).
Ever see Dr, Strange? Keep it up, that's EXACTLY what I want "JudenMammu" - you're MY prisoner.
LASTLY Don't speak for "Everyone" JUDE - you're the HATED minority ALL THRU HISTORY only fooling YOURSELVES, lol - self deluded morons & thieves.
APK
P.S.=> Dance little Jude, dance - to MY TUNE as I see you lose all that STOLEN GOLD/SHEKELS, lol - slowly (oh, SO slowly, painfully, as your kind fell into your OWN trap of debt, lol)... apk
>> having the hacker demonstrate the exploit to Apple, without revealing how the exploit works
I'm not sure if you're trolling, but in case you're not, I can tell you that just seeing someone exploit your code gives you a LOT of clues as to what the exploit actually is. As a software developer...I've been with >1 companies that get reporting researchers to show us the exploit (against heavily instrumented website/services/etc.) and then we've fixed it without paying/recognizing the researcher AT ALL. In these cases, having a standing reward system actually benefits the reporter, as in "I think I found some XSS vulnerabilities and I'd like to apply for the $1K XSS reward - can we agree to engage under this framework?"
Sell to the highest bidder.
only pennies... and remember, in the past when people have reported serious security flaws, Apple have lingered and taken as much as 10 months to patch them, even when the fixes were trivial, because they want to give government access until they say they no longer need it.
If you think your Apple device is secure and that there's no way in, you're kidding yourself.
The hacker wouldn't even need to show the exploit. He can simply state how much the system is compromised by the exploit, and give a general idea on how easy the exploit is to perform. That would be enough for Apple to assign a value to it and draw up the contract. Actual payment would occur once the exploit is demonstrated and proven to match the hacker's claims during the negotiation.
Now you've tumbled on a reason why a standing reward program has value to the company: they want the exploit info ASAP, and ASAP and "negotiate a contract" are on opposites sides of a time-to-fix spectrum.
with ants
with ants
exploits with ants
Right, because it's impossible for Apple to have a boilerplate contract already on hand and plug in the specifics for a specific exploit in less than a few hours, with the total monetary negotiation taking not much longer. You're reaching.
At this point, it would make more sense to have the boilerplate already filled in with the various degrees of exploit.
Which, if I am not mistaken, is where we started (prices listed apriori).
>> few hours, with the total monetary negotiation taking not much longer
:)
You haven't ever negotiated a business contract, have you?
Right.
All the time. In this case there's nothing to negotiate - Apple will set all the terms, the parties will settle on an amount, and the hacker can either take it or leave it. The terms outside consideration wouldn't be negotiable.