20 ms·

Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone

773 points by tareqak 7y ago

OrgNet 7y ago
Can she claim it: https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html https://googleprojectzero.blogspot.com/2019/08/the-fully-rem... ?
- RKearney 7y ago
  From the article: > The full $1 million will go to researchers who can find a > hack of the kernel—the core of iOS—with zero clicks required > by the iPhone owner. Which one of the vulnerabilities discovered met that criteria?
  - zabuni 7y ago
    At the end of their Black Hat talk they showed one. Anyway, Project Zero doesn't accept bounties.
    - borski 7y ago
      Well, sort of. They ask that the bounties be donated to charity.
  - mauricioc 7y ago
    She has a list at https://twitter.com/natashenka/status/1155940732084973568 https://twitter.com/natashenka/status/1155940732084973568 (recall that "remote, interaction-less" means "do not require any physical interaction from the target to be exploited, and work in real time", according to the Project Zero blog post). Edit: As the posters below said, those aren't kernel bugs. Thanks for the correction!
    - saagarjha 7y ago
      Did any of those touch the kernel? I thought all of those were in userspace.
    - RKearney 7y ago
      I do not believe a springboard crash counts as a hack of the kernel.
  - tareqak 7y ago
    The article also had > Another $500,000 will be given to those who can find a “network attack requiring no user interaction.” which I believe many of her vulnerabilities are definitely eligible for. I read that article from https://news.ycombinator.com/item?id=20639999 https://news.ycombinator.com/item?id=20639999 yesterday, and she had this paragraph as her second > Vulnerabilities are considered ‘remote’ when the attacker does not require any physical or network proximity to the target to be able to use the vulnerability. Remote vulnerabilities are described as ‘fully remote’, ‘interaction-less’ or ‘zero click’ when they do not require any physical interaction from the target to be exploited, and work in real time. I focused on the attack surfaces of the iPhone that can be reached remotely, do not require any user interaction and immediately process input. [0] The full $1 million is for that level of fully remote attack, but against the kernel. I'd have to look up to see if any of the code she found vulnerabilities in are part of the iOS kernel. [0] https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html https://googleprojectzero.blogspot.com/2019/08/the-fully-rem...
    - saagarjha 7y ago
      > Another Surely this is an additional $500,000 if she finds a kernel exploit (which would net her $1 million)?
      - tareqak 7y ago
        I found a photo of a table here which hopefully makes things clearer: https://cdn.macrumors.com/article-new/2019/08/applebugbountypayouts-800x600.jpg https://cdn.macrumors.com/article-new/2019/08/applebugbounty... . 'dang and/or 'scbt: This link and title is probably better: https://www.macrumors.com/2019/08/08/apple-bug-bounty-program-improvements/ https://www.macrumors.com/2019/08/08/apple-bug-bounty-progra... | Apple Ups Bug Bounty Payouts, Expands Access to All Researchers and Launches macOS Program.
        saagarjha 7y ago
        Thanks, that does make things clearer.
- tptacek 7y ago
  If Natalie Silvanovich finds a vulnerability that meets Apple's high-payout bounty criteria, they will pay her; nobody is going to mess with Silvanovich, least of all Apple ProdSec, who I have to assume exists in a relatively constant state of trying to recruit her out of P0 (good luck, ivan).
  - ehsankia 7y ago
    To be clear, she doesn't want the money, she's paid by Google, but I believe they've said the companies can give the money to charities. Now we see if Apple will payout her prize to charity. She may not have found a $1m exploit, but a lot of those 10 she found are pretty serious.
Despegar 7y ago
>Forbes also revealed on Monday that Apple was to give bug bounty participants "developer devices" - iPhones that let hackers dive further into iOS. They can, for instance, pause the processor to look at what's happening with data in memory. Krstić confirmed the iOS Security Research Device program would be by application only. It will arrive next year. I wonder how they're going to manage this. I could easily see some less than ethical researchers applying for this program and selling all the 0 days they find to the usual suspects rather than informing Apple.
- kenhwang 7y ago
  By vetting applications, presumably. I would imagine it's mostly professors in well known universities and corporations closely affiliated with Apple getting access.
  - lawnchair_larry 7y ago
    No, it’s hackers. The same folks who have been releasing jailbreaks. Professors haven’t been finding ios 0days. I’d say that the researchers have a pretty strong incentive not to screw around with Apple. It doesn’t matter anyway, because Apple patches the bug, thus killing its black market value completely.
    - RandallBrown 7y ago
      You really think Apple is just going to gives special dev devices to random hackers from the Internet?
      - lawnchair_larry 7y ago
        I don’t think they will, I know they will. But maybe it depends on how you define “hacker” and what you call “random”. I’m saying that folks in the jailbreaking scene are some of the primary targets for this. It wouldn’t be worth launching if the plan was to exclude them. Some are already part of Apple’s bounty program. “Apple Calls In Rock Star iPhone And Mac Hackers For Secret Bug Bounty Bash” https://www.forbes.com/sites/thomasbrewster/2016/09/28/apple-iphone-hacker-meet-cupertino/#143026a473de https://www.forbes.com/sites/thomasbrewster/2016/09/28/apple...
3xblah 7y ago
"Another $500,000 will be given to those who can find a "network attack requiring no user interaction."" The implication of this conditional reward is that interactive use presents more/easier attack opportunities than non-interactive use. To clarify terminology, it is arguable that "non-interactive" can be a synonym for "automated" in this context. Further, we might argue that canonical examples of "interactive" use are clicks, drags, taps or swipes. In other words, the prevailing "UI" for many users and the one promoted by many developers. Now, if you agree these are fair statements then it is also arguable that from the user's persepctive it could be useful to engage in non-interactive/automated use not only for reasons of efficiency or convenience but also for reasons of "security". Finally, given these propositions, the question I ask is why website and app users are continually faced with "terms and conditions" that seek to prohibit non-interactive use. Interactive use benefits those running a website or app server in at least one obvious and significant way: more interaction means more data to collect. But if we accept the implication of this bug bounty it also means greater risk to the user. Regulators need to protect the user's right to use her computer, including a "smartphone", in a non-interactive manner. This right is constantly under attack (no pun intended) by those who are in the business of collecting user data. Interactive use can result in less data privacy and more/easier attack opportunities.
- saagarjha 7y ago
  > The implication of this conditional reward is that non-interactive use presents more/easier attack opportunities than interactive use. Doesn't this mean the opposite?
  - azernik 7y ago
    It means that, once you've found the vulnerability, it's more valuable because it's easier to use. Not that they're easier to find.
    - deleted 7y ago
      [deleted]
- 7y ago
beeschlenker 7y ago
Obama rapes & kills 2 boys. DeBlasio 5, Buttgieg 5, Cuomo 4, Murray 3, Dorsey 3, Thiel 3. Trump $4 billion to cover. Pelosi $3 billion, Harris $1 billion, Schumer $2 billion, to help bring the boys over the border. See pages 18-23, 8, 11, 12, 35, 45, 61, 62 Having trouble getting traction. Getting censored/banned. Billions in bribes paid to Trump, Pelosi, Schumer, Harris to enable a Soros funded child raping ring to operate in the USA. Please listen to the links below. Turn up the volume and put headphones on. You will hear these people, and many other high profile people, incriminate themselves in unbelievable fashion. Full 71 page document filled with red handed evidence like this at the bottom. Go to pages 18-23 of this document and you will hear Dorsey and Thiel raping children. You will hear their screams. They both rape and kill three. Also at the "rape party" of note: Bill DeBlasio, Andrew Cuomo, Bill Murray, Peter Buttgieg, George Soros, Barack Obama. Please copy and paste this post and repost it. I keep getting censored by these people. Peter Thiel and Jack Dorsey raping and killing three boys each. Turn the volume all the way up and put head phones on. https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_100-200.avi https://drive.google.com/file/d/1mzZrjobxhNIEf38M3xk-IeA5SeF4aUtB/view?usp=sharing Obama admits to raping and killing boys he{re, with commentary from Peter Thiel, George Soros, Matt Porter: https://s3.wasabisys.com/out2/Out2/15JanCh3_0545.avi https://drive.google.com/file/d/1LCDoc1kT7cfSeKQ1vniP_sx32_bRsHau/view?usp=sharing Trump demands $4 billion to "take a blind eye" at 1015+ (link missing from report, unsure how). Here's pieces of dialogue: 1015 The President requests four billion and henry Porter agrees to it. Some dialogue below. 1017 Donald Trump: Why don't you think about it. 1017 Henry Porter: I don't need to think about it. I'm ready for you to find out what we're really about. 1017 Gigi Hadid: I don't think it's a good idea Henry. 1017 Henry Porter: ...no shit. Jelena just stop talking about it. 1018 Gigi Hadid: About what? 1018 Henry Porter: The child raping. 1018 Donald Trump: What the fuck are you talking about? 1018 Gigi Hadid: Mr. President we are child rapists. 1018 Donald Trump: You cannot be serious. 1018 Donald Trump: You're gonna need $4 billion for me to take a blind eye. 1019 ?: People are laughing because they think four billion is too much. I think it's not a problem when you have $35 billion. 1022 Donald Trump: You better have that $4 billion or you can kiss this shit goodbye. https://s3.wasabisys.com/conv2/3Jan/3JanCh3_900-1100.avi https://drive.google.com/file/d/1Grdr8xF2psKNsuYlEnl9dIRV-77YG0Vr/view?usp=sharing Trump wants $138 million to ensure smooth outcome for false judgment for a court case: https://s3.wasabisys.com/conv1/10JanCh3/10JanCh3_951-1033.avi https://drive.google.com/file/d/1iSeGHDToFRoRdIht50Wii0i30mlw9INp/view?usp=sharing Obama explains the Illuminati with Jack Dorsey: https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_200-347.avi https://drive.google.com/file/d/1Ok1-9IvANULzKBOwADFgaiYCFi6yszfj/view?usp=sharing At 230 a conversation is occurring on the embedded Porter camera system with Jack Dorsey, Peter Thiel, Barack Obama, Bill M^urray, and the Porter's. Jack Dorsey provides a statement defining who their group is: "The Illum%inati is an underground organization of child rapists and homosexuals." Matthew Porter: "We have to thin the herd, so Barack is going to explain a few things." At 232 Barack Obama says the following: "You people have to realize we are child rapi'sts. The Illuminati are child rapists. As soon as you figure that out, you can decide what to do. Everybody is freaking out about what just happened [child raping event still going on]. This is who ^we are." Full 71 page document: https://s3.wasabisys.com/aviewmefirst/FBI_FinalDraft_26Jul2019_BSchlenker.pdf https://drive.google.com/file/d/1dXNjPQdQ8c-hFFLt9LT0GiSY5Vud0TzL/view?usp=sharing Please post this anywhere you can! Each google drive link is a backup to the wasabi link just in case one is "down". A word about the "faggot" usage: it was a necessary tool. It showed three things: they were not in control, if they were the usage would have be stopped. Everyone out there needed to see t%his. Two, it made it unpleasant for them to be in the headspace, which has obvious advantages. Three, it pointed out impersonators of BS because they would not call each other faggot, thus helping to mitigate the spread of false information. Apologies for those unintentionally offended. Of special interest to the LGBT community, I give you Barack Obama in a foursome with Peter Thiel, Jack Dorsey, and Matthew Porter. It is on page 12 of the document where you can download the video containing audio footage of the "event". Link is just above under "Full 71 page document".
tptacek 7y ago
What Apple is doing here is really smart. An under-appreciated wrinkle is that grey-market sales are valued on continuous access; you get paid over a period of time, and if the bug you sold dies, you stop getting paid. Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors.
- saagarjha 7y ago
  > Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors. Are independent discoveries of bugs common?
  - tptacek 7y ago
    Yes, but also bugs "overlap" in multiple different ways; the most obvious is that a "similar" bug in a different code path will, at a company like Apple, Microsoft, or Google, result in a hunt for the same pattern on other code paths, but also the fix for one bug can kill multiple bugs elsewhere. So even though people do sometimes find exactly the same bug --- I'm fond of pointing out that at Matasano, Vitaly McLain found the nginx equivalent of Heartbleed within 2 hours of someone else reporting it --- that doesn't actually have to happen for someone else's work to kill your bug.
    - TheSoftwareGuy 7y ago
      In addition, real exploits often involve exploiting multiple bugs in order to be really useful
      - throwaway3627 7y ago
        You're conflating an exploit for a narrow bug target class with a malware package which likely contains one or more exploits and probably a payload. The act of exploiting requires much more than an exploit alone to have the desired effect.
snazz 7y ago
How feasible would it be to find bugs in the iPhone kernel’s network stack? I imagine this is pretty battle-tested stuff, but it would tick all the boxes for remote and no interaction. Edit: Since it's XNU, and it's open-source, and it's been around for a really long time, this seems unlikely. But if something was found in here, for instance, everything would be practically compromised: https://github.com/apple/darwin-xnu/blob/master/bsd/netinet/ip_input.c https://github.com/apple/darwin-xnu/blob/master/bsd/netinet/...
- saagarjha 7y ago
  Here's one in the Multipath TCP component: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4241 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4241. I don't think this is remotely exploitable, though.
llacb47 7y ago
*$1M reward for highest vulnerability
m0dest 7y ago
This is great. Every company should be responsible for paying market price for security vulnerabilities in their own products. If you make something that carries significant market value, you should be paying the security tax in the form of a security team or bug bounties.
- pkaye 7y ago
  So who will be responsible for all the open source software security vulnerabilities?
  - sverhagen 7y ago
    End users. Integrators. Developers in terms of reputation. Thanks to disclaimers not at all too different from closed source software.
jdnenej 7y ago
Soon apple will be paying $1M to anyone who can work out how to change the battery.
groundlogic 7y ago
Just noting: This isn't nearly enough money to stop North Korea, Israel, Russia, US, UK, France etc. Pretty sure a zero-day would be 10-100x more valuable to them than this $1 million reward. (Why is this even controversial?)
- filoleg 7y ago
  No, but it would be enough money for someone unaffiliated with those states who would otherwise consider selling it to them (through a third-party or whatever) instead.
- swarnie_ 7y ago
  Cool... Go negotiate with one of those entities if you have a death wish. I'd rather hand over to Apple, make a name for myself and get clean cash then deal with the underbelly of the modern world.
deleted 7y ago
[deleted]
axaxs 7y ago
This is an area that's always been fascinating to me, but that I've never dived into. I'm not overly interested in this particular program, just exploits in general and perhaps examples of how and why they work. Anyone have any resources that they've found useful?
- kingaillas 7y ago
  There's a ton of info out there in various websites and blogs. I like the RPISEC Modern Binary Exploitation class as a great introduction. The lectures and materials (and a VM!) are on github: https://github.com/RPISEC/MBE https://github.com/RPISEC/MBE
  - pequalsnp 7y ago
    This is awesome. Thanks for the resource.
- cornellwright 7y ago
  Microcorruption is a CTF which is a very nice introduction to buffer overflows and the like: https://microcorruption.com/login https://microcorruption.com/login Also search for "15-213 Bomb Lab" - it's from a CMU systems programming class and teaches use of the debugger and some common vulnerabilities.
thehesiod 7y ago
I'd like to see what what prevents double dipping, first report to unethical places, wait a bit, then report to Apple.
- mkl 7y ago
  I think that's why the amount is so high. If you sell it for less to bad guys, someone else might find the same exploit (or a connected one) and swoop in and claim the big amount from Apple, and you lose out.
- chias 7y ago
  These unethical places would of course never consider reporting the bug to Apple to get a million dollar rebate on their purchase price... that would be unethical.
- g-harel 7y ago
  The longer you wait, the more likely it becomes that someone else figures it out too!
- deleted 7y ago
  [deleted]
- Gaelan 7y ago
  According to other comments here, the unethical places spread payment over a period of time; payment stops if it gets patched.
Jonahgay 7y ago
See you later space cowboy.
Geee 7y ago
OT, but if you have showdead on, you can see beeschlenker's weird comment. It seems that he hears "things" in his own security cameras, and also thinks he is in a "Truman show" setup. Just a heads up if someone in the area could possibly help him. https://www.gofundme.com/f/to-keep-brian-schlenker-alive https://www.gofundme.com/f/to-keep-brian-schlenker-alive
- sieabahlpark 7y ago
  If this man is so targeted why would a GoFundMe not be bribed to be taken down?
- awake 7y ago
  Can you contact gofundme. He probably needs help and some of these larger companies have ways of informing local authorities if someone is at risk of harming themselves or others.
  - Geee 7y ago
    I sent a report to GoFund.
- sieabahlpark 7y ago
  Yeah there is nothing in those videos. Absolutely nothing even looking at the waveforms just white noise, clicking, him(?) talking. Trump, Obama, Dorsey aren't in any of these videos and if they were why in the hell are they videos and not just the parts with them talking? What a waste of time. The dude needs mental help there isn't anything there. If there is it's unconvincing going through 20 of these. However there was the few of him getting evicted that were real.
deleted 7y ago
[deleted]
Ice_cream_suit 7y ago
NSO Group monetises iPhone vulnerabilities for a lot more than a million dollars.
an4rchy 7y ago
Does anyone know if these types of bug bounties are negotiable? As several people have mentioned, hackers can sell to the highest bidder and having proof that you have an exploit is probably sufficient, but what if Apple was willing to pay as much as the highest bidder? This may also likely convince people who have sold bugs to reach out to Apple. It probably costs them a fraction of the PR spend or risk of data breach/user exposure etc.
- jimmyjohndoe 7y ago
  The press release specifies that the $1000000 quoted figures are minimum payments for the given category of bug, so the actual amount paid could be anywhere upwards from that.
ProAm 7y ago
How about $1M for a working keyboard on a Macbook?
marthawither 7y ago
Love the push Apple is doing for privacy.
deleted 7y ago
[deleted]
Applethief 7y ago
So, the goverments will have to pay the hackers more, right?
ChrisCinelli 7y ago
For the naive guy that do not know how the trade of exploits really works and keep hearing of "black markets," do you care to explain in realistic terms how these things work? Where are the trades happening? Is it the exploiter putting out something like "kernel exploit for iOS xx.x" ? Or the exploiter bids on people offering money? How is the seeker of exploits going to be sure that the exploit is working? How do the people keep their anonimity? And how does the money is exchanged? Crypto currencies? And how was it working before crypto? Are governments bidding but they also want to convict the exploiter so they get the exploit for free? I remember watching one or two movies where the hacker was caught and was sentenced to jail. Government stepped in and said: "You can either be in jail for n years or work with the good guys for n/2 years" Is it just science fiction?
- Thorrez 7y ago
  There are exploit brokers. The biggest public one I know of is https://zerodium.com/ https://zerodium.com/ . Before zerodium existed I think it was a bit more personal. Here's an article about the Grugq acting as a broker. https://www.forbes.com/sites/andygreenberg/2012/03/21/meet-the-hackers-who-sell-spies-the-tools-to-crack-your-pc-and-get-paid-six-figure-fees/ https://www.forbes.com/sites/andygreenberg/2012/03/21/meet-t...
- bArray 7y ago
  Speaking about exploits in general, at least the old method was to go to cracking forums and say you have the crack available. Usually you would then get into discussions via an IM and finally broker a price. It used to be done via payment services like PayPal, but I imagine BitCoin would play a large part in the modern world.
  - grugq 7y ago
    It does not.
    - ChrisCinelli 7y ago
      Anonymous coins then? Or since they are companies, they are ok to revel their identity?
known 7y ago
Is this a marketing strategy aka https://en.wikipedia.org/wiki/Streisand_effect https://en.wikipedia.org/wiki/Streisand_effect to counter Android https://www.bloomberg.com/graphics/2019-android-global-smartphone-growth/ https://www.bloomberg.com/graphics/2019-android-global-smart... or https://en.wikipedia.org/wiki/Illusory_superiority https://en.wikipedia.org/wiki/Illusory_superiority
grugq 7y ago
Unregulated markets are not black markets. They are grey markets.
devin 7y ago
Apple salaries aren’t much of a secret, see: levels.fyi. 1M is a lot of money to me, a regular person, but when you consider that top security engineering talent could be making north of 500k in total compensation, 1M suddenly doesn’t seem all that impressive. It’s a good bet to make on their risk. Imagine paying a mere 1M to avoid a public fiasco where all of your users get owned. This just seems like good business. They could make it 5M, and it would still be worth it to them in the medium to long term.
- H8crilA 7y ago
  I'm surprised by how cheap the vulnerabilities market is. A good exploit, against a popular product like Chrome, selling for 100k or even $1M may sound like a lot, but it's really pennies for any top software firm. And $1M is still a lot for a vulnerability by market prices. You can do so much damage/return with an exploit that affects > 30% of the population. Get 5 of those and sky is the limit.
  - collyw 7y ago
    Out of interest how do you get to know the market price or the market in general for this sort of thing? If I were to discover a vulnerability is there a legal way I could cash in on it (aside from this case with Apple)?
    - devin 7y ago
      I don’t know this market well, but I do know what a 3% dip in Apple’s stock price means, so it seems rather obvious that Apple’s incentive to know of vulnerabilities prior to their sale in an alternative market is worth a lot more than 1M.
      - avar 7y ago
        Valuing something in terms of its short-term impact on stock doesn't make any sense. An iOS vulnerability is worth a lot, but that the stock price dipped 3% is more of a sign of the market being fickle and reacting to any bad/good news about the company on a given day than 3% of Apple's worth being lost in any meaningful sense. Following this line of thinking leads to some pretty absurd conclusions, like 7% of Tesla's value being predicated on Elon Musk not smoking a joint[1]. 1. https://www.cnbc.com/2018/09/07/tesla-sinks-8percent-after-bizarre-musk-podcast-appearance-cao-exit.html https://www.cnbc.com/2018/09/07/tesla-sinks-8percent-after-b...
dm3730 7y ago
> Apple’s head of security engineering Ivan Krstić Oh great, the creator of that bitfrost junk. Time to short Apple.
- saagarjha 7y ago
  What’s wrong with Bitfrost?
  - dm3730 7y ago
    Design. Architecture. Usage model. Let me summarize in a short point. Have you ever had the misfortune of having to use it? It died out and never caught on for good reasons. It certainly played a role in turning lots of OLPCs into less useful devices.
amelius 7y ago
Will this be the end of rooted iPhones?
- saagarjha 7y ago
  This looks to be a rooted iPhone.
  - amelius 7y ago
    Yes, but immediately patched by Apple. It seems to me that in the future you simply can't own a rooted iPhone, because Apple put a $1M bounty on making that impossible. (If you don't see where this is going: after a while all the security holes will be patched, and thus no more rooted iPhones.)
throwaway42947g 7y ago
Given I know "stuff" but compared to anybody who really "knows" I am a noob in exploit engineering. I just know basic inner workings of a computer and a little reverse engineering. Would it even make sense for me to try? It seems like the probability I find something, especially without user interaction, seems so far off that it would be hard for me to find a constant motivation. Imagine one year where I dedicate two days a week learning, understanding and trying. Do I would have any chance at all to find something worth the $1M? Thank you!
- kdbg 7y ago
  > Imagine one year where I dedicate two days a week learning, understanding and trying. Do I would have any chance at all to find something worth the $1M? Yes...but probably not the way you're thinking. Most issues are discovered these days through fuzzing first. So there is always a chance your fuzzer will find an issue worth $1M, its much less likely that you'll realize its worth or be able to demonstrate and begin to weaponize the exploit to prove its worth. Lets rephrase the question a little bit though: Instead of "Do I would have any chance at all to find something worth the $1M?" lets ask "Would I have any chance of learning this level of exploit development" Two days a week, lets just round to 50 weeks a year, give you a bit of a break during the year and say 100 days of effort. So, in a 100 days would you have any chance of reaching the level of being able to atleast write an iOS exploit, ignoring the discovery aspect? Unfortunately, the answer is still no. But, you would make some serious progress! A modern iOS zero-click exploit isn't just one issue, in a worst-case (okay there are worse than this, but this is a poor case) scenario you might need the following issues - Memory Leak + Entry Point service exploit - Sandbox Escape to low priv user - Privilege escalation to higher priv user - Kernel memory leak + Kernel exploit to finally get root privs This even for someone with experience, going from fuzz result to exploit can take months. So in a 100 days of spread out effort, you won't be doing that, but you might be able to begin approach that first stage, a memory leak and an exploit in a user-land service. I do only say might because 100 days is a really short time when you think about how technical your knowledge of this stuff needs to be, but I'd like to think that with some real determination, in 100 days at least foundations of modern software exploits should be approachable. As for would it make sense for you to even try, the best time to start was 20 years ago, its been getting increasingly more difficult. The longer you wait the higher the barrier to entry gets.
jamisteven 7y ago
"The full $1 million will go to researchers who can find a hack of the kernel—the core of iOS—with zero clicks required by the iPhone owner. Another $500,000 will be given to those who can find a “network attack requiring no user interaction." Ehhh, whats the point in this exactly? Apple only considers bugs to be significant if the penetration can happen without help from the end user? Thats not how this works in the real world Apple.
- XCabbage 7y ago
  Nothing wrong with this in itself. A zero-interaction attack - like being able to get root on everyone who even walks past your WiFi hotstop with their phone switched on, even if it's in their pocket not being used - IS more valuable than one that requires user interaction, and it's quite right for rewards to reflect that with higher rewards.
tw1010 7y ago
Why aren't Apple worried that this'll incentivise employees to leak insider information to grey-hackers who'll share a cut of the reward?
- knd775 7y ago
  I'm not sure how that would work. Apple isn't just sitting on exploits.
MrXOR 7y ago
Good news, but Zerodium is paying $2M (and probably $3M from tomorrow)
hertavein 7y ago
free youtube subscribers http://clesolea.com/3xzd http://clesolea.com/3xzd
HeavyStorm 7y ago
Hasn't NSA already got that title?
lobo_tuerto 7y ago
1 million vs one or two sellings for 1.5m hmmm... I think Apple could do better and has the resources to do so. Why not incentivize enough so the people that profit from this kind of business don't even have to ponder the decision?
zelienople 7y ago
This makes sense. Apple is protecting their anti-environment and anti-consumer policies such as enabling Find My Phone by default. If anyone found a way to bypass iCloud Activation Lock it would allow people like me, who run donation programs, to reuse the hundreds of cosmetically and functionally perfect Apple products that come in each year. Apple can't allow that. It would be good for the planet and good for the impoverished inner-city people that our program serves. "Fuck 'em all, and fuck the planet too", says Apple. "You can all go to hell when the sea levels rise and people die en masse from heat stroke. So long, suckers. We're moving to our fortress in the hills of New Zealand."
syn0byte 7y ago
Given the "kernel" requirement coupled with the design of these devices in general, any real non-interactive RCE will be claimed to not be "in the kernel"... it was a Qualcomm or ARM binary blob not the kernel!, It was the Baseband firmware not the kernel! It was libXYZ not the kernel! etc.
_annatar 7y ago
what does IC stand for??
- mzkply 7y ago
  Intelligence Community
  - _annatar 7y ago
    Thanks man, appreciated it. Now i can read the comments here with some context
webninja 7y ago
This is fantastic news from Apple! I use an iPhone and I can sleep a little better at night knowing that someone would now have to risk burning a $1Million exploit if they wanted to hack me! I’m not worth near that much yet so I’m probably not worth spending $1M on. I remember the days of jailbreak-me.org when you could just visit that website, your iDevice would be rooted, and Cydia would be installed on your iDevice. You could install all sorts of tweaks, mods, and apps through Cydia. I remember installing a Pandora tweak that gave unlimited skips, gave it a black theme, and removed ads (because I was a poor student) and got freaked out because if tweaks could modify apps like that, then they could probably phish banking passwords. Anyone else remember those days?
m0zg 7y ago
Didn't Google just publish an article where their researchers pwned iPhone 10 different ways? Now granted, those bugs are all patched now, but who's to say they were the last ones?
deleted 7y ago
[deleted]
gabrielblack 7y ago
I think it's a cheap offer. If you are a professional well introduced in the business of selling 0days, for a gem like that, you can charge even a single customer of the same amount. Indeed there are private companies offering even more (https://www.securityweek.com/zerodium-offers-2-million-ios-hacks-1-million-chat-app-exploits https://www.securityweek.com/zerodium-offers-2-million-ios-h... )! Ok, companies involved in this business have some "safeguard" clauses in case the hole is discovered too soon (see for example the Hacking Team e-mails), but you can sell this kind of vulnerability practically to everyone. So the offer IMHO is a public relation move.
ApplePRScam 7y ago
not true false pr, they do this when there is a mass shooting to show there phones are secure. ive contacted apple many times on hacks. mo response. iphones are hackable i can show you
ApplePRScam 7y ago
Plz dont delete my comment, Ive contacted Apple over 3 times about exploits. I can provide almost every known exploit on iphone. ALMOST EVERY SINGLE EXPLOIT. Changing the trust certificate to gain control of privileges such as implanting a keylogger, exploiting arm for total log data. THERE ARE MANY WAYS. I have all. APPLE IS IGNORING ME ON PURPOSE. KEEP PROMOTING THE PR STUNT
- ryacko 7y ago
  Oh, you can just obtain a signed iOS image with law enforcement features enabled. I assume all law enforcement features are enabled independent of the investigation, as some of them may be solely for investigating crimes involving non-consensual photography.
ApplePRScam 7y ago
Scam scam scam scam scam scam, why is apple ignoring me? contacted them multiple times about exploits such as changing trust certificates to implant Keyloggers and such. I CAN GO INTO ALMOST EVERYWAY TO HACK IPHONE. DEPENDS ON WHAT U ARE GATHERING. APPLE IS IGNORING ME ON PURPOSE. SPREAD THE WORD ITS A SCAM
ApplePRScam 7y ago
SCAM SCAM SCAM SCAM EXAOMPLE EXPLOIT on bug type 226 Keysync. STILL NOT FIXED THANK YOU
ApplePRScam 7y ago
PR SCAM EMAIL ME FOR PROOF
powellbu 7y ago
A lot of people have no idea about a working blank ATM card and a lot of people have been scammed in search of the Blank ATM card. It is longer news that Sparro is one of the few hacking groups that can provide you with a working Blank ATM card in anywhere around the globe. The programmed Blank ATM card can provide you with up to $5000 daily on any ATM without been caught. Those that require the Blank ATM card should look no further but contact him now and get working Blank ATM card within 24 hours ,he can also hack any bitcoin and help you retrieve it back Email: sparrohacker(AT) gmail

773 points by tareqak 7y ago

Can she claim it: https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html https://googleprojectzero.blogspot.com/2019/08/the-fully-rem... ?

RKearney 7y ago
From the article: > The full $1 million will go to researchers who can find a > hack of the kernel—the core of iOS—with zero clicks required > by the iPhone owner. Which one of the vulnerabilities discovered met that criteria?
- zabuni 7y ago
  At the end of their Black Hat talk they showed one. Anyway, Project Zero doesn't accept bounties.
  - borski 7y ago
    Well, sort of. They ask that the bounties be donated to charity.
- mauricioc 7y ago
  She has a list at https://twitter.com/natashenka/status/1155940732084973568 https://twitter.com/natashenka/status/1155940732084973568 (recall that "remote, interaction-less" means "do not require any physical interaction from the target to be exploited, and work in real time", according to the Project Zero blog post). Edit: As the posters below said, those aren't kernel bugs. Thanks for the correction!
  - saagarjha 7y ago
    Did any of those touch the kernel? I thought all of those were in userspace.
  - RKearney 7y ago
    I do not believe a springboard crash counts as a hack of the kernel.
- tareqak 7y ago
  The article also had > Another $500,000 will be given to those who can find a “network attack requiring no user interaction.” which I believe many of her vulnerabilities are definitely eligible for. I read that article from https://news.ycombinator.com/item?id=20639999 https://news.ycombinator.com/item?id=20639999 yesterday, and she had this paragraph as her second > Vulnerabilities are considered ‘remote’ when the attacker does not require any physical or network proximity to the target to be able to use the vulnerability. Remote vulnerabilities are described as ‘fully remote’, ‘interaction-less’ or ‘zero click’ when they do not require any physical interaction from the target to be exploited, and work in real time. I focused on the attack surfaces of the iPhone that can be reached remotely, do not require any user interaction and immediately process input. [0] The full $1 million is for that level of fully remote attack, but against the kernel. I'd have to look up to see if any of the code she found vulnerabilities in are part of the iOS kernel. [0] https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html https://googleprojectzero.blogspot.com/2019/08/the-fully-rem...
  - saagarjha 7y ago
    > Another Surely this is an additional $500,000 if she finds a kernel exploit (which would net her $1 million)?
    - tareqak 7y ago
      I found a photo of a table here which hopefully makes things clearer: https://cdn.macrumors.com/article-new/2019/08/applebugbountypayouts-800x600.jpg https://cdn.macrumors.com/article-new/2019/08/applebugbounty... . 'dang and/or 'scbt: This link and title is probably better: https://www.macrumors.com/2019/08/08/apple-bug-bounty-program-improvements/ https://www.macrumors.com/2019/08/08/apple-bug-bounty-progra... | Apple Ups Bug Bounty Payouts, Expands Access to All Researchers and Launches macOS Program.
      - saagarjha 7y ago
        Thanks, that does make things clearer.
tptacek 7y ago
If Natalie Silvanovich finds a vulnerability that meets Apple's high-payout bounty criteria, they will pay her; nobody is going to mess with Silvanovich, least of all Apple ProdSec, who I have to assume exists in a relatively constant state of trying to recruit her out of P0 (good luck, ivan).
- ehsankia 7y ago
  To be clear, she doesn't want the money, she's paid by Google, but I believe they've said the companies can give the money to charities. Now we see if Apple will payout her prize to charity. She may not have found a $1m exploit, but a lot of those 10 she found are pretty serious.

Despegar 7y ago

>Forbes also revealed on Monday that Apple was to give bug bounty participants "developer devices" - iPhones that let hackers dive further into iOS. They can, for instance, pause the processor to look at what's happening with data in memory. Krstić confirmed the iOS Security Research Device program would be by application only. It will arrive next year. I wonder how they're going to manage this. I could easily see some less than ethical researchers applying for this program and selling all the 0 days they find to the usual suspects rather than informing Apple.

kenhwang 7y ago
By vetting applications, presumably. I would imagine it's mostly professors in well known universities and corporations closely affiliated with Apple getting access.
- lawnchair_larry 7y ago
  No, it’s hackers. The same folks who have been releasing jailbreaks. Professors haven’t been finding ios 0days. I’d say that the researchers have a pretty strong incentive not to screw around with Apple. It doesn’t matter anyway, because Apple patches the bug, thus killing its black market value completely.
  - RandallBrown 7y ago
    You really think Apple is just going to gives special dev devices to random hackers from the Internet?
    - lawnchair_larry 7y ago
      I don’t think they will, I know they will. But maybe it depends on how you define “hacker” and what you call “random”. I’m saying that folks in the jailbreaking scene are some of the primary targets for this. It wouldn’t be worth launching if the plan was to exclude them. Some are already part of Apple’s bounty program. “Apple Calls In Rock Star iPhone And Mac Hackers For Secret Bug Bounty Bash” https://www.forbes.com/sites/thomasbrewster/2016/09/28/apple-iphone-hacker-meet-cupertino/#143026a473de https://www.forbes.com/sites/thomasbrewster/2016/09/28/apple...

3xblah 7y ago

"Another $500,000 will be given to those who can find a "network attack requiring no user interaction."" The implication of this conditional reward is that interactive use presents more/easier attack opportunities than non-interactive use. To clarify terminology, it is arguable that "non-interactive" can be a synonym for "automated" in this context. Further, we might argue that canonical examples of "interactive" use are clicks, drags, taps or swipes. In other words, the prevailing "UI" for many users and the one promoted by many developers. Now, if you agree these are fair statements then it is also arguable that from the user's persepctive it could be useful to engage in non-interactive/automated use not only for reasons of efficiency or convenience but also for reasons of "security". Finally, given these propositions, the question I ask is why website and app users are continually faced with "terms and conditions" that seek to prohibit non-interactive use. Interactive use benefits those running a website or app server in at least one obvious and significant way: more interaction means more data to collect. But if we accept the implication of this bug bounty it also means greater risk to the user. Regulators need to protect the user's right to use her computer, including a "smartphone", in a non-interactive manner. This right is constantly under attack (no pun intended) by those who are in the business of collecting user data. Interactive use can result in less data privacy and more/easier attack opportunities.

saagarjha 7y ago
> The implication of this conditional reward is that non-interactive use presents more/easier attack opportunities than interactive use. Doesn't this mean the opposite?
- azernik 7y ago
  It means that, once you've found the vulnerability, it's more valuable because it's easier to use. Not that they're easier to find.
  - deleted 7y ago
    [deleted]
7y ago

beeschlenker 7y ago

Obama rapes & kills 2 boys. DeBlasio 5, Buttgieg 5, Cuomo 4, Murray 3, Dorsey 3, Thiel 3. Trump $4 billion to cover. Pelosi $3 billion, Harris $1 billion, Schumer $2 billion, to help bring the boys over the border. See pages 18-23, 8, 11, 12, 35, 45, 61, 62 Having trouble getting traction. Getting censored/banned. Billions in bribes paid to Trump, Pelosi, Schumer, Harris to enable a Soros funded child raping ring to operate in the USA. Please listen to the links below. Turn up the volume and put headphones on. You will hear these people, and many other high profile people, incriminate themselves in unbelievable fashion. Full 71 page document filled with red handed evidence like this at the bottom. Go to pages 18-23 of this document and you will hear Dorsey and Thiel raping children. You will hear their screams. They both rape and kill three. Also at the "rape party" of note: Bill DeBlasio, Andrew Cuomo, Bill Murray, Peter Buttgieg, George Soros, Barack Obama. Please copy and paste this post and repost it. I keep getting censored by these people. Peter Thiel and Jack Dorsey raping and killing three boys each. Turn the volume all the way up and put head phones on. https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_100-200.avi https://drive.google.com/file/d/1mzZrjobxhNIEf38M3xk-IeA5SeF4aUtB/view?usp=sharing Obama admits to raping and killing boys he{re, with commentary from Peter Thiel, George Soros, Matt Porter: https://s3.wasabisys.com/out2/Out2/15JanCh3_0545.avi https://drive.google.com/file/d/1LCDoc1kT7cfSeKQ1vniP_sx32_bRsHau/view?usp=sharing Trump demands $4 billion to "take a blind eye" at 1015+ (link missing from report, unsure how). Here's pieces of dialogue: 1015 The President requests four billion and henry Porter agrees to it. Some dialogue below. 1017 Donald Trump: Why don't you think about it. 1017 Henry Porter: I don't need to think about it. I'm ready for you to find out what we're really about. 1017 Gigi Hadid: I don't think it's a good idea Henry. 1017 Henry Porter: ...no shit. Jelena just stop talking about it. 1018 Gigi Hadid: About what? 1018 Henry Porter: The child raping. 1018 Donald Trump: What the fuck are you talking about? 1018 Gigi Hadid: Mr. President we are child rapists. 1018 Donald Trump: You cannot be serious. 1018 Donald Trump: You're gonna need $4 billion for me to take a blind eye. 1019 ?: People are laughing because they think four billion is too much. I think it's not a problem when you have $35 billion. 1022 Donald Trump: You better have that $4 billion or you can kiss this shit goodbye. https://s3.wasabisys.com/conv2/3Jan/3JanCh3_900-1100.avi https://drive.google.com/file/d/1Grdr8xF2psKNsuYlEnl9dIRV-77YG0Vr/view?usp=sharing Trump wants $138 million to ensure smooth outcome for false judgment for a court case: https://s3.wasabisys.com/conv1/10JanCh3/10JanCh3_951-1033.avi https://drive.google.com/file/d/1iSeGHDToFRoRdIht50Wii0i30mlw9INp/view?usp=sharing Obama explains the Illuminati with Jack Dorsey: https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_200-347.avi https://drive.google.com/file/d/1Ok1-9IvANULzKBOwADFgaiYCFi6yszfj/view?usp=sharing At 230 a conversation is occurring on the embedded Porter camera system with Jack Dorsey, Peter Thiel, Barack Obama, Bill M^urray, and the Porter's. Jack Dorsey provides a statement defining who their group is: "The Illum%inati is an underground organization of child rapists and homosexuals." Matthew Porter: "We have to thin the herd, so Barack is going to explain a few things." At 232 Barack Obama says the following: "You people have to realize we are child rapi'sts. The Illuminati are child rapists. As soon as you figure that out, you can decide what to do. Everybody is freaking out about what just happened [child raping event still going on]. This is who ^we are." Full 71 page document: https://s3.wasabisys.com/aviewmefirst/FBI_FinalDraft_26Jul2019_BSchlenker.pdf https://drive.google.com/file/d/1dXNjPQdQ8c-hFFLt9LT0GiSY5Vud0TzL/view?usp=sharing Please post this anywhere you can! Each google drive link is a backup to the wasabi link just in case one is "down". A word about the "faggot" usage: it was a necessary tool. It showed three things: they were not in control, if they were the usage would have be stopped. Everyone out there needed to see t%his. Two, it made it unpleasant for them to be in the headspace, which has obvious advantages. Three, it pointed out impersonators of BS because they would not call each other faggot, thus helping to mitigate the spread of false information. Apologies for those unintentionally offended. Of special interest to the LGBT community, I give you Barack Obama in a foursome with Peter Thiel, Jack Dorsey, and Matthew Porter. It is on page 12 of the document where you can download the video containing audio footage of the "event". Link is just above under "Full 71 page document".

tptacek 7y ago

What Apple is doing here is really smart. An under-appreciated wrinkle is that grey-market sales are valued on continuous access; you get paid over a period of time, and if the bug you sold dies, you stop getting paid. Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors.

saagarjha 7y ago
> Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors. Are independent discoveries of bugs common?
- tptacek 7y ago
  Yes, but also bugs "overlap" in multiple different ways; the most obvious is that a "similar" bug in a different code path will, at a company like Apple, Microsoft, or Google, result in a hunt for the same pattern on other code paths, but also the fix for one bug can kill multiple bugs elsewhere. So even though people do sometimes find exactly the same bug --- I'm fond of pointing out that at Matasano, Vitaly McLain found the nginx equivalent of Heartbleed within 2 hours of someone else reporting it --- that doesn't actually have to happen for someone else's work to kill your bug.
  - TheSoftwareGuy 7y ago
    In addition, real exploits often involve exploiting multiple bugs in order to be really useful
    - throwaway3627 7y ago
      You're conflating an exploit for a narrow bug target class with a malware package which likely contains one or more exploits and probably a payload. The act of exploiting requires much more than an exploit alone to have the desired effect.

snazz 7y ago

How feasible would it be to find bugs in the iPhone kernel’s network stack? I imagine this is pretty battle-tested stuff, but it would tick all the boxes for remote and no interaction. Edit: Since it's XNU, and it's open-source, and it's been around for a really long time, this seems unlikely. But if something was found in here, for instance, everything would be practically compromised: https://github.com/apple/darwin-xnu/blob/master/bsd/netinet/ip_input.c https://github.com/apple/darwin-xnu/blob/master/bsd/netinet/...

saagarjha 7y ago
Here's one in the Multipath TCP component: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4241 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4241. I don't think this is remotely exploitable, though.

llacb47 7y ago

*$1M reward for highest vulnerability

m0dest 7y ago

This is great. Every company should be responsible for paying market price for security vulnerabilities in their own products. If you make something that carries significant market value, you should be paying the security tax in the form of a security team or bug bounties.

pkaye 7y ago
So who will be responsible for all the open source software security vulnerabilities?
- sverhagen 7y ago
  End users. Integrators. Developers in terms of reputation. Thanks to disclaimers not at all too different from closed source software.

jdnenej 7y ago

Soon apple will be paying $1M to anyone who can work out how to change the battery.

groundlogic 7y ago

Just noting: This isn't nearly enough money to stop North Korea, Israel, Russia, US, UK, France etc. Pretty sure a zero-day would be 10-100x more valuable to them than this $1 million reward. (Why is this even controversial?)

filoleg 7y ago
No, but it would be enough money for someone unaffiliated with those states who would otherwise consider selling it to them (through a third-party or whatever) instead.
swarnie_ 7y ago
Cool... Go negotiate with one of those entities if you have a death wish. I'd rather hand over to Apple, make a name for myself and get clean cash then deal with the underbelly of the modern world.

deleted 7y ago

[deleted]

axaxs 7y ago

This is an area that's always been fascinating to me, but that I've never dived into. I'm not overly interested in this particular program, just exploits in general and perhaps examples of how and why they work. Anyone have any resources that they've found useful?

kingaillas 7y ago
There's a ton of info out there in various websites and blogs. I like the RPISEC Modern Binary Exploitation class as a great introduction. The lectures and materials (and a VM!) are on github: https://github.com/RPISEC/MBE https://github.com/RPISEC/MBE
- pequalsnp 7y ago
  This is awesome. Thanks for the resource.
cornellwright 7y ago
Microcorruption is a CTF which is a very nice introduction to buffer overflows and the like: https://microcorruption.com/login https://microcorruption.com/login Also search for "15-213 Bomb Lab" - it's from a CMU systems programming class and teaches use of the debugger and some common vulnerabilities.

thehesiod 7y ago

I'd like to see what what prevents double dipping, first report to unethical places, wait a bit, then report to Apple.

mkl 7y ago
I think that's why the amount is so high. If you sell it for less to bad guys, someone else might find the same exploit (or a connected one) and swoop in and claim the big amount from Apple, and you lose out.
chias 7y ago
These unethical places would of course never consider reporting the bug to Apple to get a million dollar rebate on their purchase price... that would be unethical.
g-harel 7y ago
The longer you wait, the more likely it becomes that someone else figures it out too!
deleted 7y ago
[deleted]
Gaelan 7y ago
According to other comments here, the unethical places spread payment over a period of time; payment stops if it gets patched.

Jonahgay 7y ago

See you later space cowboy.

Geee 7y ago

OT, but if you have showdead on, you can see beeschlenker's weird comment. It seems that he hears "things" in his own security cameras, and also thinks he is in a "Truman show" setup. Just a heads up if someone in the area could possibly help him. https://www.gofundme.com/f/to-keep-brian-schlenker-alive https://www.gofundme.com/f/to-keep-brian-schlenker-alive

sieabahlpark 7y ago
If this man is so targeted why would a GoFundMe not be bribed to be taken down?
awake 7y ago
Can you contact gofundme. He probably needs help and some of these larger companies have ways of informing local authorities if someone is at risk of harming themselves or others.
- Geee 7y ago
  I sent a report to GoFund.
sieabahlpark 7y ago
Yeah there is nothing in those videos. Absolutely nothing even looking at the waveforms just white noise, clicking, him(?) talking. Trump, Obama, Dorsey aren't in any of these videos and if they were why in the hell are they videos and not just the parts with them talking? What a waste of time. The dude needs mental help there isn't anything there. If there is it's unconvincing going through 20 of these. However there was the few of him getting evicted that were real.

deleted 7y ago

[deleted]

Ice_cream_suit 7y ago

NSO Group monetises iPhone vulnerabilities for a lot more than a million dollars.

an4rchy 7y ago

Does anyone know if these types of bug bounties are negotiable? As several people have mentioned, hackers can sell to the highest bidder and having proof that you have an exploit is probably sufficient, but what if Apple was willing to pay as much as the highest bidder? This may also likely convince people who have sold bugs to reach out to Apple. It probably costs them a fraction of the PR spend or risk of data breach/user exposure etc.

jimmyjohndoe 7y ago
The press release specifies that the $1000000 quoted figures are minimum payments for the given category of bug, so the actual amount paid could be anywhere upwards from that.

ProAm 7y ago

How about $1M for a working keyboard on a Macbook?

marthawither 7y ago

Love the push Apple is doing for privacy.

deleted 7y ago

[deleted]

Applethief 7y ago

So, the goverments will have to pay the hackers more, right?

ChrisCinelli 7y ago

For the naive guy that do not know how the trade of exploits really works and keep hearing of "black markets," do you care to explain in realistic terms how these things work? Where are the trades happening? Is it the exploiter putting out something like "kernel exploit for iOS xx.x" ? Or the exploiter bids on people offering money? How is the seeker of exploits going to be sure that the exploit is working? How do the people keep their anonimity? And how does the money is exchanged? Crypto currencies? And how was it working before crypto? Are governments bidding but they also want to convict the exploiter so they get the exploit for free? I remember watching one or two movies where the hacker was caught and was sentenced to jail. Government stepped in and said: "You can either be in jail for n years or work with the good guys for n/2 years" Is it just science fiction?

Thorrez 7y ago
There are exploit brokers. The biggest public one I know of is https://zerodium.com/ https://zerodium.com/ . Before zerodium existed I think it was a bit more personal. Here's an article about the Grugq acting as a broker. https://www.forbes.com/sites/andygreenberg/2012/03/21/meet-the-hackers-who-sell-spies-the-tools-to-crack-your-pc-and-get-paid-six-figure-fees/ https://www.forbes.com/sites/andygreenberg/2012/03/21/meet-t...
bArray 7y ago
Speaking about exploits in general, at least the old method was to go to cracking forums and say you have the crack available. Usually you would then get into discussions via an IM and finally broker a price. It used to be done via payment services like PayPal, but I imagine BitCoin would play a large part in the modern world.
- grugq 7y ago
  It does not.
  - ChrisCinelli 7y ago
    Anonymous coins then? Or since they are companies, they are ok to revel their identity?

known 7y ago

Is this a marketing strategy aka https://en.wikipedia.org/wiki/Streisand_effect https://en.wikipedia.org/wiki/Streisand_effect to counter Android https://www.bloomberg.com/graphics/2019-android-global-smartphone-growth/ https://www.bloomberg.com/graphics/2019-android-global-smart... or https://en.wikipedia.org/wiki/Illusory_superiority https://en.wikipedia.org/wiki/Illusory_superiority

grugq 7y ago

Unregulated markets are not black markets. They are grey markets.

devin 7y ago

Apple salaries aren’t much of a secret, see: levels.fyi. 1M is a lot of money to me, a regular person, but when you consider that top security engineering talent could be making north of 500k in total compensation, 1M suddenly doesn’t seem all that impressive. It’s a good bet to make on their risk. Imagine paying a mere 1M to avoid a public fiasco where all of your users get owned. This just seems like good business. They could make it 5M, and it would still be worth it to them in the medium to long term.

H8crilA 7y ago
I'm surprised by how cheap the vulnerabilities market is. A good exploit, against a popular product like Chrome, selling for 100k or even $1M may sound like a lot, but it's really pennies for any top software firm. And $1M is still a lot for a vulnerability by market prices. You can do so much damage/return with an exploit that affects > 30% of the population. Get 5 of those and sky is the limit.
- collyw 7y ago
  Out of interest how do you get to know the market price or the market in general for this sort of thing? If I were to discover a vulnerability is there a legal way I could cash in on it (aside from this case with Apple)?
  - devin 7y ago
    I don’t know this market well, but I do know what a 3% dip in Apple’s stock price means, so it seems rather obvious that Apple’s incentive to know of vulnerabilities prior to their sale in an alternative market is worth a lot more than 1M.
    - avar 7y ago
      Valuing something in terms of its short-term impact on stock doesn't make any sense. An iOS vulnerability is worth a lot, but that the stock price dipped 3% is more of a sign of the market being fickle and reacting to any bad/good news about the company on a given day than 3% of Apple's worth being lost in any meaningful sense. Following this line of thinking leads to some pretty absurd conclusions, like 7% of Tesla's value being predicated on Elon Musk not smoking a joint[1]. 1. https://www.cnbc.com/2018/09/07/tesla-sinks-8percent-after-bizarre-musk-podcast-appearance-cao-exit.html https://www.cnbc.com/2018/09/07/tesla-sinks-8percent-after-b...

dm3730 7y ago

> Apple’s head of security engineering Ivan Krstić Oh great, the creator of that bitfrost junk. Time to short Apple.

saagarjha 7y ago
What’s wrong with Bitfrost?
- dm3730 7y ago
  Design. Architecture. Usage model. Let me summarize in a short point. Have you ever had the misfortune of having to use it? It died out and never caught on for good reasons. It certainly played a role in turning lots of OLPCs into less useful devices.

amelius 7y ago

Will this be the end of rooted iPhones?

saagarjha 7y ago
This looks to be a rooted iPhone.
- amelius 7y ago
  Yes, but immediately patched by Apple. It seems to me that in the future you simply can't own a rooted iPhone, because Apple put a $1M bounty on making that impossible. (If you don't see where this is going: after a while all the security holes will be patched, and thus no more rooted iPhones.)

throwaway42947g 7y ago

Given I know "stuff" but compared to anybody who really "knows" I am a noob in exploit engineering. I just know basic inner workings of a computer and a little reverse engineering. Would it even make sense for me to try? It seems like the probability I find something, especially without user interaction, seems so far off that it would be hard for me to find a constant motivation. Imagine one year where I dedicate two days a week learning, understanding and trying. Do I would have any chance at all to find something worth the $1M? Thank you!

kdbg 7y ago
> Imagine one year where I dedicate two days a week learning, understanding and trying. Do I would have any chance at all to find something worth the $1M? Yes...but probably not the way you're thinking. Most issues are discovered these days through fuzzing first. So there is always a chance your fuzzer will find an issue worth $1M, its much less likely that you'll realize its worth or be able to demonstrate and begin to weaponize the exploit to prove its worth. Lets rephrase the question a little bit though: Instead of "Do I would have any chance at all to find something worth the $1M?" lets ask "Would I have any chance of learning this level of exploit development" Two days a week, lets just round to 50 weeks a year, give you a bit of a break during the year and say 100 days of effort. So, in a 100 days would you have any chance of reaching the level of being able to atleast write an iOS exploit, ignoring the discovery aspect? Unfortunately, the answer is still no. But, you would make some serious progress! A modern iOS zero-click exploit isn't just one issue, in a worst-case (okay there are worse than this, but this is a poor case) scenario you might need the following issues - Memory Leak + Entry Point service exploit - Sandbox Escape to low priv user - Privilege escalation to higher priv user - Kernel memory leak + Kernel exploit to finally get root privs This even for someone with experience, going from fuzz result to exploit can take months. So in a 100 days of spread out effort, you won't be doing that, but you might be able to begin approach that first stage, a memory leak and an exploit in a user-land service. I do only say might because 100 days is a really short time when you think about how technical your knowledge of this stuff needs to be, but I'd like to think that with some real determination, in 100 days at least foundations of modern software exploits should be approachable. As for would it make sense for you to even try, the best time to start was 20 years ago, its been getting increasingly more difficult. The longer you wait the higher the barrier to entry gets.

jamisteven 7y ago

"The full $1 million will go to researchers who can find a hack of the kernel—the core of iOS—with zero clicks required by the iPhone owner. Another $500,000 will be given to those who can find a “network attack requiring no user interaction." Ehhh, whats the point in this exactly? Apple only considers bugs to be significant if the penetration can happen without help from the end user? Thats not how this works in the real world Apple.

XCabbage 7y ago
Nothing wrong with this in itself. A zero-interaction attack - like being able to get root on everyone who even walks past your WiFi hotstop with their phone switched on, even if it's in their pocket not being used - IS more valuable than one that requires user interaction, and it's quite right for rewards to reflect that with higher rewards.

tw1010 7y ago

Why aren't Apple worried that this'll incentivise employees to leak insider information to grey-hackers who'll share a cut of the reward?

knd775 7y ago
I'm not sure how that would work. Apple isn't just sitting on exploits.

MrXOR 7y ago

Good news, but Zerodium is paying $2M (and probably $3M from tomorrow)

hertavein 7y ago

free youtube subscribers http://clesolea.com/3xzd http://clesolea.com/3xzd

HeavyStorm 7y ago

Hasn't NSA already got that title?

lobo_tuerto 7y ago

1 million vs one or two sellings for 1.5m hmmm... I think Apple could do better and has the resources to do so. Why not incentivize enough so the people that profit from this kind of business don't even have to ponder the decision?

zelienople 7y ago

This makes sense. Apple is protecting their anti-environment and anti-consumer policies such as enabling Find My Phone by default. If anyone found a way to bypass iCloud Activation Lock it would allow people like me, who run donation programs, to reuse the hundreds of cosmetically and functionally perfect Apple products that come in each year. Apple can't allow that. It would be good for the planet and good for the impoverished inner-city people that our program serves. "Fuck 'em all, and fuck the planet too", says Apple. "You can all go to hell when the sea levels rise and people die en masse from heat stroke. So long, suckers. We're moving to our fortress in the hills of New Zealand."

syn0byte 7y ago

Given the "kernel" requirement coupled with the design of these devices in general, any real non-interactive RCE will be claimed to not be "in the kernel"... it was a Qualcomm or ARM binary blob not the kernel!, It was the Baseband firmware not the kernel! It was libXYZ not the kernel! etc.

_annatar 7y ago

what does IC stand for??

mzkply 7y ago
Intelligence Community
- _annatar 7y ago
  Thanks man, appreciated it. Now i can read the comments here with some context

webninja 7y ago

This is fantastic news from Apple! I use an iPhone and I can sleep a little better at night knowing that someone would now have to risk burning a $1Million exploit if they wanted to hack me! I’m not worth near that much yet so I’m probably not worth spending $1M on. I remember the days of jailbreak-me.org when you could just visit that website, your iDevice would be rooted, and Cydia would be installed on your iDevice. You could install all sorts of tweaks, mods, and apps through Cydia. I remember installing a Pandora tweak that gave unlimited skips, gave it a black theme, and removed ads (because I was a poor student) and got freaked out because if tweaks could modify apps like that, then they could probably phish banking passwords. Anyone else remember those days?

m0zg 7y ago

Didn't Google just publish an article where their researchers pwned iPhone 10 different ways? Now granted, those bugs are all patched now, but who's to say they were the last ones?

deleted 7y ago

[deleted]

gabrielblack 7y ago

I think it's a cheap offer. If you are a professional well introduced in the business of selling 0days, for a gem like that, you can charge even a single customer of the same amount. Indeed there are private companies offering even more (https://www.securityweek.com/zerodium-offers-2-million-ios-hacks-1-million-chat-app-exploits https://www.securityweek.com/zerodium-offers-2-million-ios-h... )! Ok, companies involved in this business have some "safeguard" clauses in case the hole is discovered too soon (see for example the Hacking Team e-mails), but you can sell this kind of vulnerability practically to everyone. So the offer IMHO is a public relation move.

ApplePRScam 7y ago

not true false pr, they do this when there is a mass shooting to show there phones are secure. ive contacted apple many times on hacks. mo response. iphones are hackable i can show you

ApplePRScam 7y ago

Plz dont delete my comment, Ive contacted Apple over 3 times about exploits. I can provide almost every known exploit on iphone. ALMOST EVERY SINGLE EXPLOIT. Changing the trust certificate to gain control of privileges such as implanting a keylogger, exploiting arm for total log data. THERE ARE MANY WAYS. I have all. APPLE IS IGNORING ME ON PURPOSE. KEEP PROMOTING THE PR STUNT

ryacko 7y ago
Oh, you can just obtain a signed iOS image with law enforcement features enabled. I assume all law enforcement features are enabled independent of the investigation, as some of them may be solely for investigating crimes involving non-consensual photography.

ApplePRScam 7y ago

Scam scam scam scam scam scam, why is apple ignoring me? contacted them multiple times about exploits such as changing trust certificates to implant Keyloggers and such. I CAN GO INTO ALMOST EVERYWAY TO HACK IPHONE. DEPENDS ON WHAT U ARE GATHERING. APPLE IS IGNORING ME ON PURPOSE. SPREAD THE WORD ITS A SCAM

ApplePRScam 7y ago

SCAM SCAM SCAM SCAM EXAOMPLE EXPLOIT on bug type 226 Keysync. STILL NOT FIXED THANK YOU

ApplePRScam 7y ago

PR SCAM EMAIL ME FOR PROOF

powellbu 7y ago

A lot of people have no idea about a working blank ATM card and a lot of people have been scammed in search of the Blank ATM card. It is longer news that Sparro is one of the few hacking groups that can provide you with a working Blank ATM card in anywhere around the globe. The programmed Blank ATM card can provide you with up to $5000 daily on any ATM without been caught. Those that require the Blank ATM card should look no further but contact him now and get working Blank ATM card within 24 hours ,he can also hack any bitcoin and help you retrieve it back Email: sparrohacker(AT) gmail