Zero-Click Calendar invite vulnerability chain in macOS

Post by jtbayly » Fri, Sep 13, 2024, 8:58 PM UTC

planetpluta wrote: post #67

akira2501 wrote: post #56

Earlier quoted context omitted.

Other than bad press there's no immediate incentive for the company to avoid stiffing researchers. Bug bounty programs work if the company is vulnerable to bad press and it would actually impact their bottom line. This is not from an examination of when bug programs work but when they have very demonstrably not worked in the past.

Maybe not “immediate” but withholding rewards results in fewer researchers participating in bounty programs which defeats the purpose.

Post by jujube3 » Fri, Sep 13, 2024, 9:00 PM UTC

tptacek wrote: post #74

bakztfutur3 wrote: post #68

Earlier quoted context omitted.

No, it's because Apple's 'product security' team that investigates and pays out bug bounties is horribly mismanaged and ineffective. It was recently moved from the SWE program office to SEAR (security engineering & arch), and the manager was recently shown the door and went to AirBNB. The team members are mostly new college grads (ICT2's and 3's) who wouldn't pass a coding interview elsewhere in the company, and most…

I have no idea about how well the bounty program at Apple is managed, so, without affirming this, I acknowledge this is another plausible explanation: it's just an understaffed team that needs to get its act together. The only crusade I'm on is against the idea that companies ruthlessly avoid paying bounties, which is, on information and belief, flatly false, like, the opposite of the truth. I think it's valuable for…

Post by tptacek » Fri, Sep 13, 2024, 9:01 PM UTC

LegionMammal978 wrote: post #79

tptacek wrote: post #78

Earlier quoted context omitted.

Look, I believe you, but people complain about all these bounty programs, some of which I know to have been extraordinarily well managed, and usually when you get to the bottom of those complaints it comes down to a misapprehension the researchers have about what the bounty program is doing and what its internal constraints are. I acknowledge that another possibility is that the bounty program itself isn't performing…

My point is that while the sums might be "not real money", the costs of stiffing researchers is even moreso "not real money", so that it makes sense on the margin to do it, whenever the situation isn't incredibly clear-cut. After all, it's not like Apple goes around handing out free iPhones on the street, even though a few thousand units are similarly "not real money". Businesses care about small effects on the margi…

Post by LegionMammal978 » Fri, Sep 13, 2024, 9:04 PM UTC

tptacek wrote: post #86

LegionMammal978 wrote: post #79

Earlier quoted context omitted.

My point is that while the sums might be "not real money", the costs of stiffing researchers is even moreso "not real money", so that it makes sense on the margin to do it, whenever the situation isn't incredibly clear-cut. After all, it's not like Apple goes around handing out free iPhones on the street, even though a few thousand units are similarly "not real money". Businesses care about small effects on the margi…

No, I don't think this logic holds, at all.

Post by tptacek » Fri, Sep 13, 2024, 9:06 PM UTC

vlovich123 wrote: post #60

dadrian wrote: post #53

Earlier quoted context omitted.

It's unclear that NSO group is interested in gaining access to iCloud accounts or Photos, nor is it clear that this entrypoint is something that would meet the bar or be useful for signals intelligence, since it requires sending a calendar invite and clicking on the attachment. Bug bounties will pay for any bug. Offensive firms only pay for things that are practical, and they don't pay everything up front---it depend…

> since it requires sending a calendar invite and clicking on the attachment. I thought it was a zero click exploit? As for being interested in iCloud and photos, is the argument that the people they’re looking to attack are unlikely to use iCloud? Cause otherwise getting photos and potentially email access seems quite valuable.