Soon apple will be paying $1M to anyone who can work out how to change the battery.
Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone
51–60 of 308 posts
Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone
#52How feasible would it be to find bugs in the iPhone kernel’s network stack? I imagine this is pretty battle-tested stuff, but it would tick all the boxes for remote and no interaction. Edit: Since it's XNU, and it's open-source, and it's been around for a really long time, this seems unlikely. But if something was found in here, for instance, everything would be practically compromised: https://github.com/apple/darwi…
Here's one in the Multipath TCP component: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4241. I don't think this is remotely exploitable, though.
Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone
#53Earlier quoted context omitted.
No, it’s hackers. The same folks who have been releasing jailbreaks. Professors haven’t been finding ios 0days. I’d say that the researchers have a pretty strong incentive not to screw around with Apple. It doesn’t matter anyway, because Apple patches the bug, thus killing its black market value completely.
The point is apple is likely to only aim for researchers for this program as the hackers could just resell most 0days, letting apple know about a small fraction to maintain reputation. It would make sense for apple to not allow hackers access to the program for this reason.
In this context, "security researchers" is just the preferred job title that white-hat hackers put on their business cards. The ones who go for bug bounties are generally not paid by universities or large corporations to do that work.
Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone
#54What Apple is doing here is really smart. An under-appreciated wrinkle is that grey-market sales are valued on continuous access; you get paid over a period of time, and if the bug you sold dies, you stop getting paid. Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors.
> Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors.
Are independent discoveries of bugs common?
Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone
#55"Another $500,000 will be given to those who can find a "network attack requiring no user interaction."" The implication of this conditional reward is that interactive use presents more/easier attack opportunities than non-interactive use. To clarify terminology, it is arguable that "non-interactive" can be a synonym for "automated" in this context. Further, we might argue that canonical examples of "interactive" use…
> The implication of this conditional reward is that non-interactive use presents more/easier attack opportunities than interactive use. Doesn't this mean the opposite?
It means that, once you've found the vulnerability, it's more valuable because it's easier to use. Not that they're easier to find.
Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone
#56Earlier quoted context omitted.
The article also had > Another $500,000 will be given to those who can find a “network attack requiring no user interaction.” which I believe many of her vulnerabilities are definitely eligible for. I read that article from https://news.ycombinator.com/item?id=20639999 yesterday, and she had this paragraph as her second > Vulnerabilities are considered ‘remote’ when the attacker does not require any physical or netwo…
> Another Surely this is an additional $500,000 if she finds a kernel exploit (which would net her $1 million)?
I found a photo of a table here which hopefully makes things clearer: https://cdn.macrumors.com/article-new/2019/08/applebugbounty... .
'dang and/or 'scbt: This link and title is probably better: https://www.macrumors.com/2019/08/08/apple-bug-bounty-progra... | Apple Ups Bug Bounty Payouts, Expands Access to All Researchers and Launches macOS Program.
Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone
#57What Apple is doing here is really smart. An under-appreciated wrinkle is that grey-market sales are valued on continuous access; you get paid over a period of time, and if the bug you sold dies, you stop getting paid. Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors.
> Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors. Are independent discoveries of bugs common?
Yes, but also bugs "overlap" in multiple different ways; the most obvious is that a "similar" bug in a different code path will, at a company like Apple, Microsoft, or Google, result in a hunt for the same pattern on other code paths, but also the fix for one bug can kill multiple bugs elsewhere. So even though people do sometimes find exactly the same bug --- I'm fond of pointing out that at Matasano, Vitaly McLain found the nginx equivalent of Heartbleed within 2 hours of someone else reporting it --- that doesn't actually have to happen for someone else's work to kill your bug.
Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone
#58Earlier quoted context omitted.
By vetting applications, presumably. I would imagine it's mostly professors in well known universities and corporations closely affiliated with Apple getting access.
No, it’s hackers. The same folks who have been releasing jailbreaks. Professors haven’t been finding ios 0days. I’d say that the researchers have a pretty strong incentive not to screw around with Apple. It doesn’t matter anyway, because Apple patches the bug, thus killing its black market value completely.
Don't know about ios, but university researchers have found quite a bunch of Intel vulnerabilities.
If they get some special "developer" devices on their hands, they might find some funny things...
Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone
#59Just noting:
This isn't nearly enough money to stop North Korea, Israel, Russia, US, UK, France etc. Pretty sure a zero-day would be 10-100x more valuable to them than this $1 million reward. (Why is this even controversial?)
Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone
#60Earlier quoted context omitted.
Isn't the idea of a bug bounty at this scale that the monetary reward (especially combined with the lowered legal risk, but also when considered in isolation) is higher from reporting it to the vendor than from selling it on the black market? I.E. presumably Apple has done their research and one million dollars is more than they believe you'd getting selling a zero day to somebody else. I don't work in the security f…
From the article: >Previously, a company called Zerodium was vocal about how much it will pay researchers, before handing them to its unknown government customers. In January, the secretive company announced it was offering $2 million for a remote hack of an iPhone. So that's already more than what Apple offers. I tend to think they'll always be outbid.
A "remote hack" generally relies on a stack of exploits. From what I recall when the last jailbreaks came about, that stack was at least 5 or so exploits deep.
So $1M/exploit is priced significantly ahead of the $2M/hack.
Interesting this also means that an entire exploitable stack now becomes worth a lot more, while any given exploit is worth a lot less. And any stack of exploits becomes much more brittle, as a patch of a single one of N exploits can knock out the use of the stack.