4 ms·
>Zerodium could just offer 2x as much as Apples bounty, and Apple can never win on price. I'm a die-hard Android fan, but even I'm forced to admit that iPhone
by desdiv 9y ago
>Zerodium could just offer 2x as much as Apples bounty, and Apple can never win on price.
I'm a die-hard Android fan, but even I'm forced to admit that iPhone has much better security. And security is a big selling point.
Raising the bug bounty to $10 million and it would still be pocket change to Apple, but it would result in:
1. Free advertisement
2. Good PR
3. Outbid the black market for iOS exploits
4. Encourage more white hats to look into iOS security
- dsl 9y ago> 3. Outbid the black market for iOS exploits That will never work. Zerodium and others are just middlemen that sell to the US/CA/UK/AU/NZ government. They aren't selling these exploits to random companies or underground hackers. The NSA will pay an unlimited amount of money to have iOS remote 0days sitting on the shelf because they might have a small window where say, an ISIS leader's kid left his iPhone in the room during an important meeting.
- heartbreak 9y agoWhy do you think that organized crime and governments can't afford $10 million per zero day? There are amounts that they can't afford, but those amounts would stretch Apple's wallet as well.
- PeterisP 9y agoGovernments certainly can afford such amounts. If you're developing a cyberweapon with an important purpose (e.g. Stuxnet) then putting in 3-5 zerodays at $10m each is within your budget, it's comparable to the cost of physical military hardware that they'd gladly buy and use (and destroy) for goals of similar importance.