Live data from Hacker News

We Hacked Apple for 3 Months

samcurry.net

211–220 of 318 posts

Re: We Hacked Apple for 3 Months

#211
post #3

July 6 - August 6 - September 6 -- that's 2 months elapsed, not three. Five people working for 2 months is 10 person-months. Apple paid them just under $52,000, none of which was guaranteed. They had to pay whatever taxes are appropriate for their jurisdictions. I'd say Apple got an amazing bargain.

Everybody wins here. It's a bargain for Apple, because their ledgers deal with numbers that require the -illions suffixes, but it's ALSO $10k per person, which even after taxes is still a lot of money on top of their regular salary for anyone with bills to pay.

Good pentester costs typically $2000 per day. Given the amount of work they did, the return feels like a slap in the face. Certainly it won't encourage highly skilled people to hunt for security holes.

Re: We Hacked Apple for 3 Months

#212
post #190

Earlier quoted context omitted.

7,000 unique domains seems insane, what could they possibly need all of those for? Unless that includes subdomains, I guess.

That's probably right. A quick internet search shows up domains like applecoronavirus.com and similar, as well as this court case [1] where they acquired a bunch of ipod related names. I suspect they are only parking those names after recovering them or buying them preemptively. Domain names are cheap, so why not. I don't think that's any argument for the possession of the /8 though. I remember Google had ownership o…

All parked domains could lead to the same IP. A single web server could distinguish which domain it’s contacted for, using the HTTP headers for example, and serve different content (probably all 301-redirects, but to relevant other websites of Apple).

Re: We Hacked Apple for 3 Months

#213
post #69

Am I being hyperbolic or is this an absolutely enormous compromise of trust in Apple? XSS in iCloud Email allowing for data exfiltration of emails, pictures, videos??? That's absolutely insane. It just comes to show how vulnerable we all are to exploits like this, especially if you're a notable person of interest.

Software is made by people and people are not perfect. The bigger the project the more moving pieces there are and the more likelihood of flaws. My experience in bug bounty programs has taught me that if you do start a bug bounty program you need to be serious about it and when a report comes in that is actually serious that you need to act on it quickly. And it seems Apple is doing that. What would be more concernin…

This happens when a company choses to amass wealth instead of investing in security. Their ads about privacy now sound laughable

Re: We Hacked Apple for 3 Months

#214

Earlier quoted context omitted.

If you don't have a way to share documentation for your API with anyone for a cost of about $0.00, then you're signaling that your development process is a bit broken.

its probably just a case of they emailed support@ without a support contract, and didn't get very far. I don't think that's very indicitive of much, especially for "enterprise software".

Sure, but there's no reason for something like API documentation to require emailing support@.

Let me cite a specific recent example: I was tasked with building an application that integrated document e-signatures. The spec called for Docusign specifically, so I looked at their documentation. What I could find of it was written unclearly and much of it was hidden behind a developer account login. Getting a developer account was "free", as long as my time was worth $0. (You had to fill out a form of some kind, I don't remember the specifics anymore.)

So then I looked at HelloSign, a competitor. Their documentation was public, freely available, and beautiful (https://app.hellosign.com/api/documentation). It included specific examples and walkthrus. This says things to me like, "we care about the developer experience".

I practically begged the customer to use HelloSign instead. I expected, from experience, that Docusign integration was going to suck, and HelloSign integration would suck a lot less. The customer said, "the spec already says Docusign, so we can't switch".

And the Docusign integration did suck. It was terrible. Lots of it was incomplete. Their vendor library was a godawful mess, built from some automated tool that converts an API into a bad class library. Their support was basically useless even after a contract had been negotiated and signed. The client ended up spending an extra ten grand or so and at least a couple weeks worth of delays just on Docusign-related issues.

This is a pattern that reoccurs often enough that experienced developers use documentation as a proxy for the quality of the service.

Re: We Hacked Apple for 3 Months

#215

"To be brief: Apple's infrastructure is massive. They own the entire 17.0.0.0/8 IP range, which includes 25,000 web servers with 10,000 of them under apple.com, another 7,000 unique domains, and to top it all off, their own TLD (dot apple)." Wow. I would think it's just impossible to secure all that, and that's not even everything.

7,000 unique domains seems insane, what could they possibly need all of those for? Unless that includes subdomains, I guess.

[deleted]

Re: We Hacked Apple for 3 Months

#216
post #36

I’ve always been interested in this round of thing, but have no idea how or where to get started

Many years ago, you'd likely have been told to start by reading the Web Application Hackers Handbook (WAHH). But that has since been replaced by the online interactive labs, available free of charge by the fine folks of PortSwigger.

https://portswigger.net/web-security

IMHO there is no better place to start.

Re: We Hacked Apple for 3 Months

#217
post #69

Earlier quoted context omitted.

Software is made by people and people are not perfect. The bigger the project the more moving pieces there are and the more likelihood of flaws. My experience in bug bounty programs has taught me that if you do start a bug bounty program you need to be serious about it and when a report comes in that is actually serious that you need to act on it quickly. And it seems Apple is doing that. What would be more concernin…

This happens when a company choses to amass wealth instead of investing in security. Their ads about privacy now sound laughable

Oh please... EVERY SINGLE piece of software has some security issue. Apple is no exception. Assuming they should be perfect is just petty BS and short sighted.

Also, keep in mind that security and privacy, while related, are not the same things.

You can have privacy (i.e. minimal data gathering) and poor security. You can also have poor privacy but amazing security.

Not sure why I'm feeding the troll here but whatever.

Re: We Hacked Apple for 3 Months

#218

Earlier quoted context omitted.

its probably just a case of they emailed support@ without a support contract, and didn't get very far. I don't think that's very indicitive of much, especially for "enterprise software".

Sure, but there's no reason for something like API documentation to require emailing support@. Let me cite a specific recent example: I was tasked with building an application that integrated document e-signatures. The spec called for Docusign specifically, so I looked at their documentation. What I could find of it was written unclearly and much of it was hidden behind a developer account login. Getting a developer…

Your example is comparing apples to oranges. We're talking about software that doesn't even have "contact us for pricing" on the website because nobody that needs it even asks what it costs.

Re: We Hacked Apple for 3 Months

#220

Earlier quoted context omitted.

Sure, but there's no reason for something like API documentation to require emailing support@. Let me cite a specific recent example: I was tasked with building an application that integrated document e-signatures. The spec called for Docusign specifically, so I looked at their documentation. What I could find of it was written unclearly and much of it was hidden behind a developer account login. Getting a developer…

Your example is comparing apples to oranges. We're talking about software that doesn't even have "contact us for pricing" on the website because nobody that needs it even asks what it costs.

Sorry, I don't talk to enterprise ISVs unless somebody's paying my billable rate.
Post reply on HN