Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

forbes.com

Post reply on HN
Print view View original

101–110 of 308 posts

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#101

Post by userbinator »

gmanley wrote: post #40
b_tterc_p wrote: post #17

Earlier quoted context omitted.

Worth adding that clean money is worth more than dirty money

Are there any laws you bump into selling 0-days? Honest question, I know their are laws about the actual hacking part but is it illegal to sell the payload? Obviously this is ethically dirty money I just was curious if it's actually dirty money in a criminal sense.

What if you sell it to the repair industry? There are plenty of people who want to break open Apple's walled garden, and those are not necessarily what most would consider "malicious" or "unethical".

Unfortunately the intersection of "security researcher" and "right-to-repair advocate" is probably tiny, but that would be something I'd love to see: someone finds a crack that enables a lot of third-party-repair scenarios and sells it to that industry instead of to the black-hat criminals or even back to Apple itself.

The third-party repair/aftermarket industry is huge and would love to break through the proprietariness of the ecosystem. In that light, $1M seems rather small...

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#102

Post by dantiberian »

tptacek wrote: post #38

What Apple is doing here is really smart. An under-appreciated wrinkle is that grey-market sales are valued on continuous access; you get paid over a period of time, and if the bug you sold dies, you stop getting paid. Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors.

Another benefit of this is that researchers are no longer incentivised to hold onto bugs. Currently, you need to find a vulnerability just to get onto the device to do further research. If the researcher reported that bug then they would lose that access. Now they are free to report any bugs they find without jeopardising future research activity.

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#103

Post by jazzyjackson »

ChrisCinelli wrote: post #92
tptacek wrote: post #38

What Apple is doing here is really smart. An under-appreciated wrinkle is that grey-market sales are valued on continuous access; you get paid over a period of time, and if the bug you sold dies, you stop getting paid. Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors.

Is not Apple's move mostly a PR stunt? Standard people will read "The iPhone is so secure that Apple is willing to pays $1M for somebody that find a security vulnerability." The reality is that they only pay that much for bugs in the kernel that do not require a user interaction. Other bugs that use a common action on an app that everybody uses, for example opening the stock mail application, may be enough in order t…

I think it transcends PR stunt if it actually changes the market for vulnerabilities. $1mil for kernel hacks and 100k for app interactions is just being price competitive with the market.

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#104

Post by segmondy »

notatoad wrote: post #86
segmondy wrote: post #77

Earlier quoted context omitted.

But they also pushed up the price in black market, and if someone in the black market is willing to pay $2mil, $500k ahead, and then the rest over a period of time. Someone might take that payments in bitcoin over Apples $1m which you will have to pay tax on. We should also remember that there are tons of people outside the US who are into this. Africa, Asian, Eastern Europe. They don't have to worry about the legali…

>But they also pushed up the price in black market isn't that the point? sure, it makes selling on the black market more valuable for the hackers willing to do that, but it also makes purchasing an iPhone exploit less accessible for anybody else. that's a good thing.

Money is not a problem to Nation state actors. Not even $10M will stop any country. Even an African dictator motivated will easily pay $50M if that means getting what it takes to stay in power.

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#105

Post by Geee »

OT, but if you have showdead on, you can see beeschlenker's weird comment. It seems that he hears "things" in his own security cameras, and also thinks he is in a "Truman show" setup. Just a heads up if someone in the area could possibly help him.

https://www.gofundme.com/f/to-keep-brian-schlenker-alive

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#106

Post by draw_down »

ChrisCinelli wrote: post #92
tptacek wrote: post #38

What Apple is doing here is really smart. An under-appreciated wrinkle is that grey-market sales are valued on continuous access; you get paid over a period of time, and if the bug you sold dies, you stop getting paid. Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors.

Is not Apple's move mostly a PR stunt? Standard people will read "The iPhone is so secure that Apple is willing to pays $1M for somebody that find a security vulnerability." The reality is that they only pay that much for bugs in the kernel that do not require a user interaction. Other bugs that use a common action on an app that everybody uses, for example opening the stock mail application, may be enough in order t…

Come on

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#107

Post by sieabahlpark »

Geee wrote: post #105

OT, but if you have showdead on, you can see beeschlenker's weird comment. It seems that he hears "things" in his own security cameras, and also thinks he is in a "Truman show" setup. Just a heads up if someone in the area could possibly help him. https://www.gofundme.com/f/to-keep-brian-schlenker-alive

If this man is so targeted why would a GoFundMe not be bribed to be taken down?

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#108

Post by awake »

Geee wrote: post #105

OT, but if you have showdead on, you can see beeschlenker's weird comment. It seems that he hears "things" in his own security cameras, and also thinks he is in a "Truman show" setup. Just a heads up if someone in the area could possibly help him. https://www.gofundme.com/f/to-keep-brian-schlenker-alive

Can you contact gofundme. He probably needs help and some of these larger companies have ways of informing local authorities if someone is at risk of harming themselves or others.

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#110

Post by coldtea »

segmondy wrote: post #104
notatoad wrote: post #86

Earlier quoted context omitted.

>But they also pushed up the price in black market isn't that the point? sure, it makes selling on the black market more valuable for the hackers willing to do that, but it also makes purchasing an iPhone exploit less accessible for anybody else. that's a good thing.

Money is not a problem to Nation state actors. Not even $10M will stop any country. Even an African dictator motivated will easily pay $50M if that means getting what it takes to stay in power.

African dictators care for mobile OS hacks for staying in power?
Post reply on HN