14 ms·
>Forbes also revealed on Monday that Apple was to give bug bounty participants "developer devices" - iPhones that let hackers dive further into iOS. They can, f
by Despegar 7y ago
>Forbes also revealed on Monday that Apple was to give bug bounty participants "developer devices" - iPhones that let hackers dive further into iOS. They can, for instance, pause the processor to look at what's happening with data in memory. Krstić confirmed the iOS Security Research Device program would be by application only. It will arrive next year.
I wonder how they're going to manage this. I could easily see some less than ethical researchers applying for this program and selling all the 0 days they find to the usual suspects rather than informing Apple.
- kenhwang 7y agoBy vetting applications, presumably. I would imagine it's mostly professors in well known universities and corporations closely affiliated with Apple getting access.
- lawnchair_larry 7y agoNo, it’s hackers. The same folks who have been releasing jailbreaks. Professors haven’t been finding ios 0days. I’d say that the researchers have a pretty strong incentive not to screw around with Apple. It doesn’t matter anyway, because Apple patches the bug, thus killing its black market value completely.
- RandallBrown 7y agoYou really think Apple is just going to gives special dev devices to random hackers from the Internet?
- lawnchair_larry 7y agoI don’t think they will, I know they will. But maybe it depends on how you define “hacker” and what you call “random”. I’m saying that folks in the jailbreaking scene are some of the primary targets for this. It wouldn’t be worth launching if the plan was to exclude them. Some are already part of Apple’s bounty program. “Apple Calls In Rock Star iPhone And Mac Hackers For Secret Bug Bounty Bash” https://www.forbes.com/sites/thomasbrewster/2016/09/28/apple-iphone-hacker-meet-cupertino/#143026a473de https://www.forbes.com/sites/thomasbrewster/2016/09/28/apple...
- ksaj 7y agoThat alone suggests that they are already acquainted with every one of the people they'll accept for the program? They might have a "loose" vetting process, but I doubt they have a lack of one.
- mensetmanusman 7y agoApple could use these devices to track the hackers...
- saagarjha 7y agoGiving security researchers a “gift” that actually tracks them sounds like a really bad idea.
- saagarjha 7y agoNote that random hackers from the internet already have access to these devices.
- vokep 7y agoThe point is apple is likely to only aim for researchers for this program as the hackers could just resell most 0days, letting apple know about a small fraction to maintain reputation. It would make sense for apple to not allow hackers access to the program for this reason.
- lawnchair_larry 7y agoI’m using researchers and hackers interchangeably here. It isn’t intended for academics or companies affiliated with Apple, that’s for sure.
- azernik 7y agoIn this context, "security researchers" is just the preferred job title that white-hat hackers put on their business cards. The ones who go for bug bounties are generally not paid by universities or large corporations to do that work.
- tecleandor 7y agoDon't know about ios, but university researchers have found quite a bunch of Intel vulnerabilities. If they get some special "developer" devices on their hands, they might find some funny things...
- grugq 7y agoThe jailbreak community will not be getting these. They make more money continuing to sell to China than they will make selling to Apple.
- lawnchair_larry 7y agoSome are already in the “vetted” bounty program. That doesn’t necessarily mean they will sell Apple the bugs though. How much do they make selling to China? Aside from the Chinese part of the jb scene, it’s kind of disheartening to know that the rest of them are selling that capability to a hostile adversary (if that’s true). I’m surprised the five eyes aren’t offering enough to keep them out of China’s hands.
- diminoten 7y agoI forget who, but someone made a comment about this a long time ago that stuck with me. We often say, "They'll just sell all these 0 days on the black market." but honestly that's not like a literal market, and you have to make a lot of compromises to not only your own integrity, but also to your safety and ability to stay out of jail if you do something like that. I wish I remembered the specifics of the comment, but selling a 0day on the black market is not something a casual person can easily do, and even if someone figures out how, there's a lot that can go wrong, with many of those outcomes leading to jailtime. It's vastly superior to participate in a bug bounty program legitimately, from a risk standpoint, especially if you're standing to make $1M. 0days are (and I'm not an expert on this) not generally going for enough more to justify all that extra risk.
- Despegar 7y agoI don't see how there's any risk when it gets sold to a broker like Zerodium who then sells it to some government.
- lawnchair_larry 7y agoSelling bugs and exploits is not illegal just about everywhere, so there is really no risk. Plus, law enforcement and intelligence agencies, or their contractors, are the ones buying on the “black market”. Nobody has to worry about jail for knowing about a mistake that Apple made in their code and telling someone else.
- TheRealSteel 7y agoIsn't the idea of a bug bounty at this scale that the monetary reward (especially combined with the lowered legal risk, but also when considered in isolation) is higher from reporting it to the vendor than from selling it on the black market? I.E. presumably Apple has done their research and one million dollars is more than they believe you'd getting selling a zero day to somebody else. I don't work in the security field nor am I a business number cruncher, but that was the gist I had of what these programs achieved. Edit: see Despegar's reply, I should have RTFA! However worth pointing out that there would be some incentive for researchers to go to Apple instead of a third party, which might tip the scales in their favour.
- corobo 7y agoDepends who’s buying I imagine. Not sure about everyone else but I always picture the entities buying on the black market as singular people for some reason When you consider it could be the likes of the three digit shoe inspectors over there in the US it could be a fair chunk of change
- grugq 7y agoWho are these individuals that will pay millions of dollars for an exploit? Cyber criminals rely almost exclusively on dead bugs, frequently using exploits from the metasploit framework. That gives then sufficient access to a broad range of victims so they can generate revenue through volume. 0days are used against hardened targets. Think “Iranian nuclear facilities” rather than “grandma’s PC”
- corobo 7y agoThey are made up, in my head, figments of my imagination. Hence “for some reason”.
- grugq 7y agoYeah. They don’t exist. People don’t think about things rationally, they see phrases like “black market” and assume it is some sort of criminal transaction with armed guards and meetings at midnight and shit. It is nothing like that. It is the same as freelance development work, except there are very few customers and the developer writes something that may or may not have any value.
- umeshunni 7y ago> I could easily see some less than ethical researchers applying for this program and selling all the 0 days they find to the usual suspects rather than informing Apple. That's what has been happening so far. Here's a report from a couple of years ago about this: https://www.vice.com/en_us/article/gybppx/iphone-bugs-are-too-valuable-to-report-to-apple https://www.vice.com/en_us/article/gybppx/iphone-bugs-are-to... The announcement today is actually raising the rewards 5x (from $200K to $1M) to make it more valuable to report this to Apple.
- buzzert 7y agoAnother thing to keep in mind is that these devices already exist (used by Apple internally), only on the black market. A lot of these development fused devices are stolen from the factory and sold to black hat/gray hat hackers (and companies) already. I think one of the intentions here is to lessen the demand for black market dev-fused phones, which is already a huge problem for Apple. This is similar to the idea of officially allowing Linux on the PlayStation — give hackers no legitimate reason to pwn your console
- saagarjha 7y agoI wonder how loose the "application" will be.
- ben174 7y agoDoesn't really matter. It's a formality at this point. It's basically public once they do this and they're aware of that.
- joosters 7y agoI thought that the Linux-on-PlayStation was actually a tax dodge? Something like it let them claim the devices were not just games consoles and so their import duties could be reduced in some regions.
- voltagex_ 7y agoYou'd think someone would have dug up a citation for this, but Wikipedia says (for the PS2): >Some incorrectly speculate it was used as an attempt to help classify the PS2 as a computer to achieve tax exempt status from certain EU taxes that apply to game consoles and not computers (It was the Yabasic included with EU units that was intended to do that).[citation needed] and Linux on the PS3 was used as a marketing point. https://en.wikipedia.org/wiki/OtherOS https://en.wikipedia.org/wiki/OtherOS - both these pages are really bad :/
- reaperducer 7y agoI wonder how they're going to manage this. I could easily see some less than ethical researchers applying for this program and selling all the 0 days they find to the usual suspects rather than informing Apple. My guess is that they're not going to let just any rando h4xx0r into the program. They'll take on well-known security researchers and academics who have something to lose by leaking zero days.
- deleted 7y ago[deleted]