Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We Hacked Apple for 3 Months

samcurry.net

Post reply on HN
Print view View original

291–300 of 318 posts

Re: We Hacked Apple for 3 Months

#291

Post by ric2b »

jcims wrote: post #288
ric2b wrote: post #287

Earlier quoted context omitted.

> Nothing but their ethics. That's not something a company the size of Apple can count on. > And why would someone who's willing to sell bugs to criminals bother with a site that's already been picked over by bug bounty researchers? Because it's Apple, it's one of the biggest companies on earth. iPhone jailbreak vulnerabilities alone fetch millions on the black market. If you know the bug bounty program doesn't pay m…

>Because it's Apple, it's one of the biggest companies on earth. Yes, and do you think you have a better understanding of the situation than the security and risk management folks that work there? There's absolutely nothing that has been said in this thread that they aren't keenly aware of. There are people in Cupertino that are going to wake up in a few hours, grab some coffee and pore over the threat intel reports…

> Yes, and do you think you have a better understanding of the situation than the security and risk management folks that work there?

You could have said the same to this team, "do you think you understand cyber-security better than Apple's experts?"

Re: We Hacked Apple for 3 Months

#292

Post by jcims »

ric2b wrote: post #291
jcims wrote: post #288

Earlier quoted context omitted.

>Because it's Apple, it's one of the biggest companies on earth. Yes, and do you think you have a better understanding of the situation than the security and risk management folks that work there? There's absolutely nothing that has been said in this thread that they aren't keenly aware of. There are people in Cupertino that are going to wake up in a few hours, grab some coffee and pore over the threat intel reports…

> Yes, and do you think you have a better understanding of the situation than the security and risk management folks that work there? You could have said the same to this team, "do you think you understand cyber-security better than Apple's experts?"

Hey, you should start a buck bounty program then. Provide companies with financial advice and get a percent of what they save!

Re: We Hacked Apple for 3 Months

#293

Post by mgoetzke »

ric2b wrote: post #287
jcims wrote: post #276

Earlier quoted context omitted.

Nothing but their ethics. But why would an expert spend any of their valuable time outside of work looking for bugs if they didn't like the terms of the program? That's irrational behavior. And why would someone who's willing to sell bugs to criminals bother with a site that's already been picked over by bug bounty researchers? The vast majority of companies in operation today have no such program and would likely be…

> Nothing but their ethics. That's not something a company the size of Apple can count on. > And why would someone who's willing to sell bugs to criminals bother with a site that's already been picked over by bug bounty researchers? Because it's Apple, it's one of the biggest companies on earth. iPhone jailbreak vulnerabilities alone fetch millions on the black market. If you know the bug bounty program doesn't pay m…

iPhone jailbreak would also be of interest to official parties

Re: We Hacked Apple for 3 Months

#294

Post by adrr »

tptacek wrote: post #102
amenod wrote: post #34

Earlier quoted context omitted.

The 4 exploits they got paid for don't seem like the biggest ones though. I would expect Apple to pay $500k - $1M for this session in the end, and it would be in the best interest of all parties if this happened. Apple would encourage responsible disclosure (and attract more white-hat bug hunters) this way. The amount of vulnerabilities found is a proof by itself that team work does pay off, if the team is strong. Al…

Where did you come up with that number? $500k is much more than a sitewide external app pentest of comparable scope would cost Apple, by an integer multiple. The bugs here are good, but they're not "bug bounty black swan" good; they're what you'd expect from a sitewide pentest. I agree Apple got a great deal here (that's the point of bounties, and anyone who thinks they're a bad deal for strong researchers is... righ…

Pen test that took 6 months with 10 people would cost at least $2mm using an extremely low $200/hr rate. People who are best in the industry will be significantly higher.

Re: We Hacked Apple for 3 Months

#295

Post by joninous »

brown9-2 wrote: post #252
brianpursley wrote: post #92

The most valuable vulnerability they found was some publicly exposed Spring Boot Actuator endpoints ( https://docs.spring.io/spring-boot/docs/current/reference/ht... ): $34,000 - Multiple eSign environments vulnerable to system memory leaks containing secrets and customer data due to public-facing actuator heapdump, env, and trace I guess it goes to remind you if you are a developer, don't overlook the simple things…

Does Spring Boot enable these by default?

You need to include a separate actuators module to enable them. IIRC in Spring Boot version 1.5 and older actuators were enabled and exposed as web endpoints by default. The heapdump endpoint mentioned in the article also required inclusion of Spring MVC module – which I guess most web apps do include.

In Spring Boot 2.0 and newer actuator module only exposes "info" and "health" web endpoints by default. Default configuration does expose more endpoints via JMX, though. Also, if your project includes Spring Security module actuator endpoints are secured by default.

Re: We Hacked Apple for 3 Months

#296

Post by blueblisters »

iruoy wrote: post #88
yread wrote: post #64

Earlier quoted context omitted.

Why do they need 17.0.0.0/8 (16,777,216 addresses) if they only have 25000 webservers? #eattheIPrich edit: fixed the number of addresses

This [0] is a really interesting page. Companies that have an entire /8 block are AT&T, Apple, Ford, Cogent, Prudential Financial, USP and Comcast. For some reason the US Department of Defense has 13 /8 blocks. All others belong to regional internet registries (AFRINIC, ARIN, APNIC, LACNIC, RIPE NNC). I really don't know why anyone other than the registries needs/deserves/got /8 blocks. [0]: https://en.wikipedia.org/…

> For some reason the US Department of Defense has 13 /8 blocks.

I did a bit of digging and looks like they're looking to sell:

https://datacentrereview.com/content-library/opinion/1522-th...

Re: We Hacked Apple for 3 Months

#298

Post by gowld »

ogre_codes wrote: post #260
JoblessWonder wrote: post #222

Earlier quoted context omitted.

Late reply: They just paid for 28 more issues, running total is now $288,500. https://twitter.com/samwcyo/status/1314310787243167744

$288k and Apple has only paid them for roughly half of the vulnerabilities. They expect the payout to exceed $500k. Well worth it for Apple and a decent payday for 3 months of spelunking.

Gross pay (not including employee benefits and before payroll tax deduction), split among a team of 5 people, unclear if they were working on this one project full time, and amortized over other months with less renumeration. It may not be better amortized pay than a regular software job.

Re: We Hacked Apple for 3 Months

#299

Post by gowld »

hbosch wrote: post #230
danaris wrote: post #206

Earlier quoted context omitted.

iCloud wasn't cracked. They used social engineering to gain access to the accounts.

You're right iCloud itself wasn't "cracked", per se, but the XSS exploit is (was) incredibly malicious and did not require any social engineering that I can see. https://samcurry.net/hacking-apple/#vuln3

Is this linked exploit the same as the Fappening exploit?
Post reply on HN