Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

Post by pbhjpbhj » Fri, Aug 09, 2019, 10:37 AM UTC

paulriddle wrote: post #234

raxxorrax wrote: post #225

Earlier quoted context omitted.

> I'm surprised by how cheap the vulnerabilities market is I think this has a lot to do with government agencies buying any exploit they can get their hands and there is basically no market besides that. I don't know if that is illegal in the US, but it seems that government is the only buyer.

I'm wondering if hedge funds would buy something that would allow access to private data. I heard insider trading is not an unusual thing, so a polished series of exploites wrapped up as a tool with clear interface might be taken seriously.

Post by grugq » Fri, Aug 09, 2019, 11:12 AM UTC

corobo wrote: post #192

grugq wrote: post #148

Earlier quoted context omitted.

Who are these individuals that will pay millions of dollars for an exploit? Cyber criminals rely almost exclusively on dead bugs, frequently using exploits from the metasploit framework. That gives then sufficient access to a broad range of victims so they can generate revenue through volume. 0days are used against hardened targets. Think “Iranian nuclear facilities” rather than “grandma’s PC”

They are made up, in my head, figments of my imagination. Hence “for some reason”.

Post by shellcoder » Fri, Aug 09, 2019, 11:28 AM UTC

jakobegger wrote: post #238

shellcoder wrote: post #165

Earlier quoted context omitted.

Harder than you might think. Who gets to control the server being compromised? 1. The buyer or someone the buyer trusts, then the buyer can log all the network traffic and find the incoming attack traffic and work out the exploit from there. 2. The seller or someone the seller trusts, can backdoor the software to fake it. 3. Someone they both trust, that would require they have some mutual contacts which while possib…

> Who gets to control the server being compromised? I was thinking about phones, not servers. > then the buyer can log all the network traffic and find the incoming attack traffic and work out the exploit from there. Is it really that easy? I'm not a security researcher, but I imagine that most exploits aren't just a magic byte sequence you send to the victim -- so I assumed that just a single observation of a succes…

Post by bsaul » Fri, Aug 09, 2019, 11:47 AM UTC

devin wrote: post #181

jobigoud wrote: post #177

Earlier quoted context omitted.

Bounties on security vulns have difficult dynamics on incentives though. At these levels you start running the risk of an insider subtly introducing a vulnerability and share it with a secret aquaintance.

I’ll say it once more. This isn’t that big of a bounty when you consider what Apple’s iPhone security crew make on average/year.

Post by throw0101a » Fri, Aug 09, 2019, 12:20 PM UTC

ChrisCinelli wrote: post #92

tptacek wrote: post #38

What Apple is doing here is really smart. An under-appreciated wrinkle is that grey-market sales are valued on continuous access; you get paid over a period of time, and if the bug you sold dies, you stop getting paid. Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors.

Is not Apple's move mostly a PR stunt? Standard people will read "The iPhone is so secure that Apple is willing to pays $1M for somebody that find a security vulnerability." The reality is that they only pay that much for bugs in the kernel that do not require a user interaction. Other bugs that use a common action on an app that everybody uses, for example opening the stock mail application, may be enough in order t…