Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

bleepingcomputer.com

Post reply on HN
Print view View original

241–250 of 254 posts

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#241

Post by tptacek »

saagarjha wrote: post #240
tptacek wrote: post #237

Earlier quoted context omitted.

You've lost me. What does this have to do with the point I made about which bugs we want security developers at Apple spending their time on? You seem to be making my point for me.

The whole point of the bug bounty program is that anything that qualifies for it is something that Apple considers to be important enough to pay out money for, because they (ostensibly) want people to report these to them. I understand if they are overloaded with "this function leaks the country of the device" bug reports but the ones that they actually include in the bug bounty program are those that have the potent…

I think there might be someone else on this thread you mean to direct this to, because it's not responsive to anything I'm saying.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#242

Post by tptacek »

WesolyKubeczek wrote: post #235
tptacek wrote: post #234

Earlier quoted context omitted.

It's not just that it's contact data; I agree, exposing contact databases is a big deal, and that this (as depicted) is a significant bug. It's that to accomplish that with this bug, you have to install a malicious app from the app store. That is a very high hurdle towards operationalizing the bug, especially since, as I said elsewhere, Apple does API-level surveillance of apps in the app store.

But isn't it the reason malicious actors buy legit apps made by small shops to insert what at best is adware/spyware into something that is useful and made a name for itself already? Or make useless copycats, as Kosta Eleftheriou proved already is a way of choice in the iOS App Store.

I'm not saying you can't do anything with this bug, just that it's much harder to do something with it than with a drive by vulnerability. It is a little surprising to me that Apple's bounty sort of implies they'll pay so much for a bug like this.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#243

Post by justshowpost »

akomtu wrote: post #50
basisword wrote: post #33

Earlier quoted context omitted.

I could accomplish the same thing by robbing a bank - doesn’t make it the right thing to do.

Unless it's a mafia's bank.

You're also either a victim or an oppressor. No wrong can be done by anyone in the former group, and no good by the latter. Such ideas of victimization do nothing but justify the use of power and engender intergroup conflict.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#244

Post by nradov »

qazpot wrote: post #213
marvin wrote: post #207

Earlier quoted context omitted.

For those who figure this is a great way to monetize their security skills and actually have the chops to do it: It should probably be pointed out that once you do this, you’re in the weapons industry. Your work will likely be used, directly or indirectly, to put a bomb through someone’s roof or put them in prison for a very long time. Make sure you’re okay with the ethics of it.

> It should probably be pointed out that once you do this, you’re in the weapons industry. Your work will likely be used, directly or indirectly, to put a bomb through someone’s roof or put them in prison for a very long time. Make sure you’re okay with the ethics of it. By this logic, americans should stop using cars at all, cause all that oil is coming from middle east, saudi arabia.

American cars mostly run on gasoline from domestic and Canadian sources. Very little comes from Saudi Arabia.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#245

Post by dpkonofa »

saagarjha wrote: post #232
dpkonofa wrote: post #220

Earlier quoted context omitted.

You are correct. I did misunderstand that portion of it but that doesn't change the fact that Apple is willing to pay $100k for a bounty like that but no one else does and Apple's actions don't suggest at all that they won't pay out the bounty. If you've ever been part of a program like this, on the developer side, it's possible that they discovered a larger bug that this was a part of or that someone else had alread…

I have no idea if Zerodium would pay out that much for this bug (probably not) or anyone else (maybe?) but Apple in general has a poor track record of paying out bug bounties. They do sometimes, but it seems like it is far rarer than their website says they should.

>Apple in general has a poor track record of paying out bug bounties

What is this based on? My understanding is that Apple pays out 99% of the reported bug bounties and that's only because they include multiple submissions in the totals but not in the payouts (they only payout the first discovery or root discovery).

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#246

Post by smoldesu »

dpkonofa wrote: post #245
saagarjha wrote: post #232

Earlier quoted context omitted.

I have no idea if Zerodium would pay out that much for this bug (probably not) or anyone else (maybe?) but Apple in general has a poor track record of paying out bug bounties. They do sometimes, but it seems like it is far rarer than their website says they should.

>Apple in general has a poor track record of paying out bug bounties What is this based on? My understanding is that Apple pays out 99% of the reported bug bounties and that's only because they include multiple submissions in the totals but not in the payouts (they only payout the first discovery or root discovery).

https://habr.com/en/post/579714/

thunderspy.io/

Those are my favorite recent examples, but specifically Apple has huge issues with turnaround time. They also don't communicate with or assist the researchers who found these exploits either, which makes things particularly frustrating for people who ultimately both want to secure Apple's systems. Their overt hostility, history of poor communication, and frankly pathetic bug bounties are all contributors to how people perceive Apple's relationship with security experts.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#247

Post by reginold »

Buttons840 wrote: post #119
reginold wrote: post #22

Earlier quoted context omitted.

PinePhone is our only hope! Still a ways off from being consumer ready but it's heading in the right direction.

"Only option"? What about Purism phones?

Yes! Another option -- however, Purism are pursuing two challenges at once, developing both the software and the hardware. Pinephone just focuses on hardware.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#248

Post by dpkonofa »

smoldesu wrote: post #246
dpkonofa wrote: post #245

Earlier quoted context omitted.

>Apple in general has a poor track record of paying out bug bounties What is this based on? My understanding is that Apple pays out 99% of the reported bug bounties and that's only because they include multiple submissions in the totals but not in the payouts (they only payout the first discovery or root discovery).

https://habr.com/en/post/579714/ thunderspy.io/ Those are my favorite recent examples, but specifically Apple has huge issues with turnaround time. They also don't communicate with or assist the researchers who found these exploits either, which makes things particularly frustrating for people who ultimately both want to secure Apple's systems. Their overt hostility, history of poor communication, and frankly patheti…

You just posted the article that this whole thread is based on. You just posted the author's post instead of the blog's rewrite of it.

This makes it seem like this is a recurring problem yet there are only a handful of complaints.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#249

Post by spopejoy »

tptacek wrote: post #222
saagarjha wrote: post #198

Earlier quoted context omitted.

> If you pay out for weak, stuck-in-process bugs, you create incentives that redirect programmer time to those weak bugs and away from more significant bugs; as angry as you can reasonably be about a malicious app being able to snarf your contacts, if you're rational, you're a lot more concerned about memory corruption flaws, which is what you really want people spending their time on. I don't understand how this isn…

The point is that memory corruption vulnerabilities are complete device takeovers, not that they have extra aesthetic value.

Right, and responder is saying in a competition for resources, pay less for non-mem corruption bugs, which should mean they aren't as hard to verify.

Is your point that all bugs soak up time to fix? If so pay the bounty and add it to the backlog. Or is it too much time to verify? That seems to be something you can kick back to the reporter.

Apologetics for a bug bounty program dragging their feet on a payout because "it's not a mem corruption bug" alone is unconvincing.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#250

Post by jsjohnst »

smoldesu wrote: post #217
jsjohnst wrote: post #160

Earlier quoted context omitted.

> and may be those pay well and very fast Pay very well? Often, assuming they actually pay, sometimes you can get stiffed there too. Very fast? Nope. Easy to work with? Nope. Communicate with you any better than Apple through the process? Not usually.

Have you dealt with terrorist orgs in the past, or is this all conjecture?

> They could also sell it to some spying companies

The above type of organization is what I was referring to. So if you consider the grey market buyers[⋁] of exploits “terrorist orgs”, then yes. If you use the normal definition of “terrorist orgs”, then hell no.

[⋀] three letter government agencies, defense contractors, and those who sell to them

Post reply on HN