4 ms·

Khaos Tian published a writeup a few days ago about how he discovered a wide-open HomeKit vulnerability [0]. He reported it properly months prior, but Apple ign

Khaos Tian published a writeup a few days ago about how he discovered a wide-open HomeKit vulnerability [0]. He reported it properly months prior, but Apple ignored his followups and was unresponsive. After this extended radio silence, Tian reached out to a media contact. Within hours of being contacted by the website, Apple finally pushed a hotfix for the vulnerability. Apple subsequently denied Tian access to their bug bounty program because going to the press "voided the qualification for the invitation." [1] [0]: https://medium.com/@khaost/your-home-was-not-so-secure-after-all-af52fbd6777c https://medium.com/@khaost/your-home-was-not-so-secure-after... [1]: https://twitter.com/KhaosT/status/943283519119179776 https://twitter.com/KhaosT/status/943283519119179776

pixl97 9y ago
And this kids, is why blackhats are selling your vulns to other blackhats.
ztjio 9y ago
Clearly a problematic exchange, but, nowhere is it said that this is a bug bounty program interaction nor is it an account of Apple denying promised payment for such a program. I'm certainly not justifying a poor communication and response to the report, but, it seems like a very different kind of problem, and not one reflective of the kind of corporate sleaze often seen from Uber.