Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

forbes.com

Post reply on HN
Print view View original

201–210 of 308 posts

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#201

Post by ChrisCinelli »

grugq wrote: post #144
ChrisCinelli wrote: post #133

For the naive guy that do not know how the trade of exploits really works and keep hearing of "black markets," do you care to explain in realistic terms how these things work? Where are the trades happening? Is it the exploiter putting out something like "kernel exploit for iOS xx.x" ? Or the exploiter bids on people offering money? How is the seeker of exploits going to be sure that the exploit is working? How do th…

It is not illegal to sell that type of software. It is not a black market, it is a grey market. There is no way you will ever hear authentic answers to your questions. The only time anyone tried to explain that the resulting article backfired on the interviewee. (Disclaimer, it was me) Governments do not buy from developers. The paperwork would be insane. They buy from businesses like Raytheon. How Raytheon gets them…

> What was, is, and will continue to be, the legitimate sale of vulnerabilities is now closed forever.

So in past, present and future, the legitimate sale of vulnerabilities is now closed forever. When was legitimate?

Are you saying that since it is not legit, exploits should never be sold? What are you advocating for ?

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#202

Post by tptacek »

Twisell wrote: post #169
grugq wrote: post #147

Earlier quoted context omitted.

Yes, because that is exactly the sort of behavior that a business would engage in. Screwing over their suppliers and demonstrating that they offer no value whatsoever. How would that make any sense? It is ludicrous.

Would be a nice pivot for patent troll companies. In a world where profit is king the question is not why, but when?

A nice pivot for patent companies would be somehow generating the connections and reputation to participate as brokers in this super-insular and highly technical marketplace, and then burn all that work down to fuck over an individual researcher for pocket change?

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#203

Post by ChrisCinelli »

grugq wrote: post #153
bArray wrote: post #143

Earlier quoted context omitted.

Speaking about exploits in general, at least the old method was to go to cracking forums and say you have the crack available. Usually you would then get into discussions via an IM and finally broker a price. It used to be done via payment services like PayPal, but I imagine BitCoin would play a large part in the modern world.

It does not.

Anonymous coins then? Or since they are companies, they are ok to revel their identity?

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#204

Post by Fnoord »

kccqzy wrote: post #117
ChrisCinelli wrote: post #92

Earlier quoted context omitted.

Is not Apple's move mostly a PR stunt? Standard people will read "The iPhone is so secure that Apple is willing to pays $1M for somebody that find a security vulnerability." The reality is that they only pay that much for bugs in the kernel that do not require a user interaction. Other bugs that use a common action on an app that everybody uses, for example opening the stock mail application, may be enough in order t…

I don't think it's a PR stunt. The typical layperson doesn't know what's a kernel, so the difference between a drive-by kernel exploit and an app exploit couldn't easily be summarized and made understood. Yes a layperson will understand the difference after you give them a five-minute primer of operating system theory, but in this age of social media who still has the attention span to sit through that, if their inte…

> I don't think it's a PR stunt.

I don't get this it is either A or B reasoning. Why can't it be also a PR stunt? Or also contain PR?

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#205

Post by pankajdoharey »

ChrisCinelli wrote: post #194
H8crilA wrote: post #161

Earlier quoted context omitted.

I'm surprised by how cheap the vulnerabilities market is. A good exploit, against a popular product like Chrome, selling for 100k or even $1M may sound like a lot, but it's really pennies for any top software firm. And $1M is still a lot for a vulnerability by market prices. You can do so much damage/return with an exploit that affects > 30% of the population. Get 5 of those and sky is the limit.

I think that not all companies are the same. Some companies put a lot of effort in security (Apple, Google, Facebook, etc). Usually they have engineering driven cultures. The other majority of companies see security just as a cost center that needs to be covered in order to reduce legal liabilities. The second kind of companies do not have a bug bounty programs because they know that they have too many holes and pref…

Well it is also a signalling to Apple Users that they is serious about security and privacy. This helps them sell more iThings.

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#206

Post by roboys »

devin wrote: post #158

Apple salaries aren’t much of a secret, see: levels.fyi. 1M is a lot of money to me, a regular person, but when you consider that top security engineering talent could be making north of 500k in total compensation, 1M suddenly doesn’t seem all that impressive. It’s a good bet to make on their risk. Imagine paying a mere 1M to avoid a public fiasco where all of your users get owned. This just seems like good business.…

Imo it's worth more than a million dollars for an organization to not disclose a flaw to Apple and make the attack vector available to clients.

Governments are more than willing to pay $100,000-$1,000,000 per unlock.

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#207

Post by roboys »

coldtea wrote: post #110
segmondy wrote: post #104

Earlier quoted context omitted.

Money is not a problem to Nation state actors. Not even $10M will stop any country. Even an African dictator motivated will easily pay $50M if that means getting what it takes to stay in power.

African dictators care for mobile OS hacks for staying in power?

Gathering intelligence is a key part of staying in power.

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#208

Post by ChrisCinelli »

H8crilA wrote: post #175
collyw wrote: post #168

Earlier quoted context omitted.

Out of interest how do you get to know the market price or the market in general for this sort of thing? If I were to discover a vulnerability is there a legal way I could cash in on it (aside from this case with Apple)?

Some stuff on the internet: https://zerodium.com/program.html Also I heard in person, so I cannot quote. Not sure how legal this is, but there are even vulnerabilities brokers, who set you up with buyers.

Interesting... they do not seem to be interested to processors exploits.

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#209

Post by kdbg »

throwaway42947g wrote: post #189

Given I know "stuff" but compared to anybody who really "knows" I am a noob in exploit engineering. I just know basic inner workings of a computer and a little reverse engineering. Would it even make sense for me to try? It seems like the probability I find something, especially without user interaction, seems so far off that it would be hard for me to find a constant motivation. Imagine one year where I dedicate two…

> Imagine one year where I dedicate two days a week learning, understanding and trying. Do I would have any chance at all to find something worth the $1M?

Yes...but probably not the way you're thinking.

Most issues are discovered these days through fuzzing first. So there is always a chance your fuzzer will find an issue worth $1M, its much less likely that you'll realize its worth or be able to demonstrate and begin to weaponize the exploit to prove its worth.

Lets rephrase the question a little bit though:

Instead of "Do I would have any chance at all to find something worth the $1M?" lets ask "Would I have any chance of learning this level of exploit development"

Two days a week, lets just round to 50 weeks a year, give you a bit of a break during the year and say 100 days of effort.

So, in a 100 days would you have any chance of reaching the level of being able to atleast write an iOS exploit, ignoring the discovery aspect? Unfortunately, the answer is still no.

But, you would make some serious progress!

A modern iOS zero-click exploit isn't just one issue, in a worst-case (okay there are worse than this, but this is a poor case) scenario you might need the following issues

- Memory Leak + Entry Point service exploit - Sandbox Escape to low priv user - Privilege escalation to higher priv user - Kernel memory leak + Kernel exploit to finally get root privs

This even for someone with experience, going from fuzz result to exploit can take months. So in a 100 days of spread out effort, you won't be doing that, but you might be able to begin approach that first stage, a memory leak and an exploit in a user-land service.

I do only say might because 100 days is a really short time when you think about how technical your knowledge of this stuff needs to be, but I'd like to think that with some real determination, in 100 days at least foundations of modern software exploits should be approachable.

As for would it make sense for you to even try, the best time to start was 20 years ago, its been getting increasingly more difficult. The longer you wait the higher the barrier to entry gets.

Re: Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

#210

Post by jobigoud »

akersten wrote: post #186
jobigoud wrote: post #177

Earlier quoted context omitted.

Bounties on security vulns have difficult dynamics on incentives though. At these levels you start running the risk of an insider subtly introducing a vulnerability and share it with a secret aquaintance.

I would hope there is sufficient discouragement for that sort of behavior - that's definitely breaking at least two federal laws. Maybe I'm naive, but I would think that any programmer skilled and privileged enough to be able to insert a vulnerability into a mainline product, get it past code review, and make it look like an innocent mistake during the inevitable root-cause analysis would not only know better, but wo…

Another scenario is, having access to the code, being in a much better position to test and find vulnerabilities in the first place. Instead of disclosing them internally which may just be expected and get you little extra, leak them to a trusted external partner for a share of the bounty.
Post reply on HN