211–220 of 308 posts
Earlier quoted context omitted.
Some stuff on the internet: https://zerodium.com/program.html Also I heard in person, so I cannot quote. Not sure how legal this is, but there are even vulnerabilities brokers, who set you up with buyers.
Interesting... they do not seem to be interested to processors exploits.
Earlier quoted context omitted.
I'd like to propose a new form of Betteridge's Law that states any time a monetary figure is given in reference to a large company the top comment will always be a form of "That's nothing. It should be at least 10x that number!"
I don’t know the law of which you speak, but the risk of not catching an ugly vulnerability after posturing themselves as a secure platform all over the media could easily cost them a lot more than 1M. That’s why their bounty is actually a lowball. It’s not that they’re a big company, it’s that they have a lot to lose. Does that make sense?
Y'all are a joke. Does that make sense?
Earlier quoted context omitted.
> the resulting article was a hatchet job Was that the forbes article linked above? > You can’t unfuck the goat. C’est la vie. That goat laid you golden eggs though. It takes me over 15 years to earn a $1m paycheck, and I wouldn't mind dealing with some people moaning at me for it. People always find something to complain about anyway, so I wouldn't be too concerned about it. > The conversation about vulnerability sa…
Yeah, that’s part of the hatchet job. I said I was projecting sales of $1M over the year. At 15% commission that would be $150k. You can make a lot more money than that, I’m sure. Also, don’t predict your sales funnel in February when you have no historical data to compare it with. I was off by about $900k. So yeah, that $15k golden egg. ¯\_(ツ)_/¯ At thetime I did not know about phrases like “off the record” or that…
That's a pretty big difference indeed, that's more like a normal SV salary than a 'live for ever in Thailand' amount of money.
Earlier quoted context omitted.
As has happened disappointingly in the past - there aren't any actual laws offering safe harbor for ethical hacking, companies just tend not to prosecute responsible disclosure... if your disclosure required you to break interstate commerce laws, run afoul of the CFAA[1] or even just violate a TOS - or even if they can convincingly argue that discovering your disclosure might have - then you can be prosecuted. Now, p…
This has nothing to do with hacking, so none of that applies. You're conflating attacking someone else's computer or network. You don't need safe harbor because analyzing your own property is not a crime. Neither is telling people what you found. Also, please stop using the term responsible disclosure!
Do you own the OS you’re breaking into?
Earlier quoted context omitted.
Are there any laws you bump into selling 0-days? Honest question, I know their are laws about the actual hacking part but is it illegal to sell the payload? Obviously this is ethically dirty money I just was curious if it's actually dirty money in a criminal sense.
What if you sell it to the repair industry? There are plenty of people who want to break open Apple's walled garden, and those are not necessarily what most would consider "malicious" or "unethical". Unfortunately the intersection of "security researcher" and "right-to-repair advocate" is probably tiny, but that would be something I'd love to see: someone finds a crack that enables a lot of third-party-repair scenari…
Based on personal experience, the intersection isn’t all that small.
Earlier quoted context omitted.
The NSA or any other agency would pay you 10x that if you go to them instead of report it.
I’m assuming you know from experience.
I'm absolutely sure that saudi arabia would pay much more than that for an exploit like that and I don't need to have experience doing it, it's common sense.
Earlier quoted context omitted.
I don’t think they will, I know they will. But maybe it depends on how you define “hacker” and what you call “random”. I’m saying that folks in the jailbreaking scene are some of the primary targets for this. It wouldn’t be worth launching if the plan was to exclude them. Some are already part of Apple’s bounty program. “Apple Calls In Rock Star iPhone And Mac Hackers For Secret Bug Bounty Bash” https://www.forbes.co…
Apple could use these devices to track the hackers...
Earlier quoted context omitted.
Think of it like GMO. There are two sides with legitimate concerns. But only one side can speak publicly. As for backdoored Chrome, what is to prevent China using a modified version of Firefox that removes the backdoor? It would blind NSA to collection on the Chinese target. There is no way you can use backdoors against hard targets. Hard targets are why they need 0day. It is an arms race because it is a conflict bet…
Your argument is limited to technical and political science concepts, and by limiting itself so, is correct. It is inapplicable to the real world. Governments have used zero days. Most famously to use a zero day unlock an iPhone against a terrorist (whose house was ransacked by the news media). Less famously was to botch a legal case against a pedophile (amazingly, it would be possible to find and arrest nearly all p…
I read your post, but still have no idea why it's inapplicable in the real world. Could you explain that again? I think it's a very interesting discussion, so I'd like to actually understand your point.
> Apple’s head of security engineering Ivan Krstić Oh great, the creator of that bitfrost junk. Time to short Apple.
Earlier quoted context omitted.
Damn this is an awesome break down of the industry, and it's hilarious to me that lo and behold someone suggests the Greenberg article and yeh does grugq himself turn up to settle the score. I can't think my way around your point about prohibition though - I think someone saying "selling exploits is bad" is also someone that would say "the government shouldn't be monitoring us, pedophile or not," and that's part of w…
Think of it like GMO. There are two sides with legitimate concerns. But only one side can speak publicly. As for backdoored Chrome, what is to prevent China using a modified version of Firefox that removes the backdoor? It would blind NSA to collection on the Chinese target. There is no way you can use backdoors against hard targets. Hard targets are why they need 0day. It is an arms race because it is a conflict bet…
It looks like you DID update it: https://gist.github.com/grugq/353b6fc9b094d5700c70
And from that gist:
> Use an iPod or an iPad without a SIM card
> Use an iPhone
How can you then says:
> A hardened Android device (disclaimer, I’m making one for retail sale) is safer than a stock iOS.
?
Is Android (and in general any open source system) safer than a iOS (a closed and highly customized system) ?
The idea I heard over and over is that a open source system is more secure because the code is scrutinized by anyone that wants to.
But with a monthly security update and how quickly a vulnerability can be exploited, it does not seems to be the case anymore.
The main reason is the time between a vulnerability is patched in the source code and the patch is deployed. When a commit that fixes a vulnerability is committed on the Android codebase, anybody that knows what is looking at would be able to notice it, and likely build/distribute an exploit before the patch is actually pushed to all users. On a closed source system, an exploiter can still reverse engineer the changes in an update but less people have the skills to do it and it is not straight forward to understand which changes in the code are a security patches.
Considering the timing and what I see on the Android security bulletin almost every month there are EoP and even RCE vulnerabilities being patched. A Google Phone, on average, will go 2 weeks every month vulnerable to a "known" vulnerability.
For all the others the situation is dramatically worse. Samsung is at best a month behind the security update schedule. A Samsung's user will have a phone that is always behind the last vulnerabilities patched and visible in the Android code base.
Some of these vulnerabilities can be quickly distributed since everybody has an LTE internet connection, read new on a browser.