Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

Post by nickpsecurity » Fri, Aug 09, 2019, 6:21 PM UTC

grugq wrote: post #267

nickpsecurity wrote: post #257

Earlier quoted context omitted.

I appreciate your honesty and taking responsibility. The time I spent in security research had me putting blame pretty far away from middle-people: (a) the users and buyers who almost exclusively go with insecure crap, even if secure ones are highly-usable and/or free; (b) the developers who do nothing to make their software secure. On (b), some vulnerabilities could've been prevented with push-button tools like AFL…

> I appreciate your honesty and taking responsibility. It is a fatal character flaw I have. When people want to know about something I try to help them. > You mention that everyone is doing it with no citations of academic sources. I'd be interested in reading any recent research you believe is high quality There was one by RAND which is good. https://www.rand.org/content/dam/rand/pubs/research_reports/... > represen…

Post by esmi » Fri, Aug 09, 2019, 7:13 PM UTC

auiya wrote: post #273

Rotdhizon wrote: post #100

Earlier quoted context omitted.

I'd imagine this is to combat marketplaces like zerodium and the deep web. Traditionally grey hat hackers don't always go through bug bounty programs because the pay is awful compared to what you can get through less ethical sources. By flexing that much cash at bug hunters, they are potentially now offering even more than what you could get on the mentioned markets. The only reason people go underground to sell expl…

> I'd imagine this is to combat marketplaces like Zerodium Zerodium already pays double what Apple does. Where's the incentive?

Post by esmi » Fri, Aug 09, 2019, 7:29 PM UTC

kaustyap wrote: post #255

redleader9345 wrote: post #254

Earlier quoted context omitted.

I don't know. But I do know that the way to prevent that is to handcuff all the developers with crushing process heaviness. Then they won't introduce anything malicious, because they won't introduce anything at all.

Yeah, what is not clear is if they would catch and fire developer/team who introduced $1M bug.

Post by e12e » Fri, Aug 09, 2019, 7:49 PM UTC

grugq wrote: post #178

komali2 wrote: post #159

Earlier quoted context omitted.

Damn this is an awesome break down of the industry, and it's hilarious to me that lo and behold someone suggests the Greenberg article and yeh does grugq himself turn up to settle the score. I can't think my way around your point about prohibition though - I think someone saying "selling exploits is bad" is also someone that would say "the government shouldn't be monitoring us, pedophile or not," and that's part of w…

Think of it like GMO. There are two sides with legitimate concerns. But only one side can speak publicly. As for backdoored Chrome, what is to prevent China using a modified version of Firefox that removes the backdoor? It would blind NSA to collection on the Chinese target. There is no way you can use backdoors against hard targets. Hard targets are why they need 0day. It is an arms race because it is a conflict bet…

Post by lawnchair_larry » Fri, Aug 09, 2019, 10:23 PM UTC

grugq wrote: post #150

lawnchair_larry wrote: post #6

Earlier quoted context omitted.

No, it’s hackers. The same folks who have been releasing jailbreaks. Professors haven’t been finding ios 0days. I’d say that the researchers have a pretty strong incentive not to screw around with Apple. It doesn’t matter anyway, because Apple patches the bug, thus killing its black market value completely.

The jailbreak community will not be getting these. They make more money continuing to sell to China than they will make selling to Apple.