6 ms·

Is not Apple's move mostly a PR stunt? Standard people will read "The iPhone is so secure that Apple is willing to pays $1M for somebody that find a security v

Is not Apple's move mostly a PR stunt? Standard people will read "The iPhone is so secure that Apple is willing to pays $1M for somebody that find a security vulnerability." The reality is that they only pay that much for bugs in the kernel that do not require a user interaction. Other bugs that use a common action on an app that everybody uses, for example opening the stock mail application, may be enough in order to compromise almost all iPhones. Apple seems to pay "only" $100k for those problems. I just scanned through the comments and clicked on some links so correct me if what I wrote is not accurate.

tptacek 7y ago
No, this is not a PR stunt.
Rotdhizon 7y ago
I'd imagine this is to combat marketplaces like zerodium and the deep web. Traditionally grey hat hackers don't always go through bug bounty programs because the pay is awful compared to what you can get through less ethical sources. By flexing that much cash at bug hunters, they are potentially now offering even more than what you could get on the mentioned markets. The only reason people go underground to sell exploits is for the money. Take away that variable and suddenly there's no reason to sell exploits to bad actors, just sell them straight to the source at Apple and get a fat paycheck.
- xkcd-sucks 7y ago
  On these marketplaces, how do people demonstrate PoC without giving away the intellectual property? Or is it unproven and completely reputation based
  - jakobegger 7y ago
    I imagine that a remote exploit should be pretty easy to demonstrate without giving away how you did it?
    - shellcoder 7y ago
      Harder than you might think. Who gets to control the server being compromised? 1. The buyer or someone the buyer trusts, then the buyer can log all the network traffic and find the incoming attack traffic and work out the exploit from there. 2. The seller or someone the seller trusts, can backdoor the software to fake it. 3. Someone they both trust, that would require they have some mutual contacts which while possible I wouldn't count on it. 4. A random victim, more possible, but neither party would want to risk prematurely burning the exploit. And of course there are a ton of exploits that are not remote, all sorts of local privilege escalations, and there are partial exploits that are sold. Like a multistage exploits like say just the exploit to escape a sandbox, or even just an exploit that requires a memory leak could be sold without a memory leak, or just selling the memory leak. Obviously a fully weaponized exploit sells for the most, but there are buyers for stages also.
      - jakobegger 7y ago
        > Who gets to control the server being compromised? I was thinking about phones, not servers. > then the buyer can log all the network traffic and find the incoming attack traffic and work out the exploit from there. Is it really that easy? I'm not a security researcher, but I imagine that most exploits aren't just a magic byte sequence you send to the victim -- so I assumed that just a single observation of a successful attack is not enough to understand it easily.
        shellcoder 7y ago
        > I was thinking about phones, not servers. that doesn't change things too much, it does introduce some potential difficulties with intercepting certain types of traffic/input to the phone. The question just becomes who controls the hardware being compromised. > but I imagine that most exploits aren't just a magic byte sequence you send to the victim Its not, and its not like you can just replay those very same bytes, but its not magic, it all has a meaning and a purpose. While its not easy, you can work out plenty from logs. The entire exploit necessarily is there, things will change, but all the instructions[0] that get injected to do later stages necessarily needs to be sent, or the instructions to generate/cause them. Its not an easy skill, but its not unheard of. [0] I'm simplifying a bit to avoid getting into various code execution techniques
  - shellcoder 7y ago
    Reputation plays a big part in it on both sides. Most buys are not Zerodium and putting themselves out there as buyers. So, there is a certain degree of vouching that happens as someone introduces a buyer to a seller. So, when either party violates the agreement, it reflects poorly on that person who made the introduction, making it harder for them to make those connections in the future. And, these introductions matters, most sellers don't want to just sell to anyone, there needs to be some trust that who you're selling to will be selling it to friendly governments or whatever. Its not like a craigslist ad where you sell to just anyone who answers. So that acts as a deterrent on the buyer side. It'll be harder to get new sellers if you have a poor, or no reputation. On the seller side, you're not going to get too many people willing to vouch for you as you start burning bridges by selling non-working exploits. And on that, the payment scheme acts as a deterrent, like teh great-grandparent said: > grey-market sales are valued on continuous access; you get paid over a period of time, and if the bug you sold dies, you stop getting paid. That is, you might get XX Thousand upfront, and then an agreed upon XXX thousand based on the exploit surviving XX days. So trying to scam the buyer will net you a small amount of the total at best, but I mean, often times they'll hold payment until its confirmed and contracts are written and signed over these sales too, its not under the table payments or anything for the most part. Legitimate business transactions. So, I guess to sum it up, reputation and a demonstrated, or atleast vouched for past record. There is a lot of trust on both sides.
    - grugq 7y ago
      Exactly
    - tptacek 7y ago
      What's interesting to me about this --- and I've got no firsthand knowledge of the markets --- is that Apple doesn't have to outbid brokers; a broker could offer 50% more than Apple, but that comes with an X% uncertainty penalty. You can sell to Apple and pocket $1MM, or try to structure a deal for $1.5MM and gamble that the bug will survive. I'm betting that's often not a good deal; the lump sum payment is the better option.
      - 7y ago
  - stuartd 7y ago
    I can imagine it being pretty easy. Hacker: I have a no user-interaction RCE Apple: ok yeah Hacker: gimme a phone number Apple: here you go Hacker: … iPhone: I am pwned Apple: ok lets do the deal
- lbatx 7y ago
  >The only reason people go underground to sell exploits is for the money. Not reputation? Not the thrill of it? Not hatred of Apple? Not plain maliciousness?
  - izzydata 7y ago
    Some amount of money will likely be able to buyout those reasons, but that isn't guaranteed and all of those reasons are still reasons.
  - FrozenTuna 7y ago
    I don't know anyone who hates apple that much. This way, you still get the reputation and thrill. The only people left are malicious actors, like state sponsored attacks.
- auiya 7y ago
  > I'd imagine this is to combat marketplaces like Zerodium Zerodium already pays double what Apple does. Where's the incentive?
  - esmi 7y ago
    There is no question on the legality of accepting money from Apple. Accepting money from Zerodium comes with some risk for some people. https://law.stackexchange.com/questions/502/is-it-legal-to-sell-zero-day-exploits https://law.stackexchange.com/questions/502/is-it-legal-to-s...
jazzyjackson 7y ago
I think it transcends PR stunt if it actually changes the market for vulnerabilities. $1mil for kernel hacks and 100k for app interactions is just being price competitive with the market.
draw_down 7y ago
Come on
kccqzy 7y ago
I don't think it's a PR stunt. The typical layperson doesn't know what's a kernel, so the difference between a drive-by kernel exploit and an app exploit couldn't easily be summarized and made understood. Yes a layperson will understand the difference after you give them a five-minute primer of operating system theory, but in this age of social media who still has the attention span to sit through that, if their interest isn't in computer science? So to me, this isn't a PR stunt. It's a necessary "dumbing down" we see all too often. It's no different from journalists digesting and simplifying the content of an advancement in biology or physics.
- ChrisCinelli 7y ago
  It could be explained to people ... But look at the titles that the press is putting out.
- Fnoord 7y ago
  > I don't think it's a PR stunt. I don't get this it is either A or B reasoning. Why can't it be also a PR stunt? Or also contain PR?
  - erikpukinskis 7y ago
    PR stunt implies that it was cooked up by PR people as something to be in the media. It’s either that or it’s not. If a company wants to do something and PR gets involved and makes sure the messaging is good, that’s not a PR “stunt” anymore. A stunt is a trick.
onion2k 7y ago
When I read the article my first reaction was "Only a million?" Considering the importance of a bug like this to Apple's business and the size of their cash hoard, this sounds like they don't actually care that much.
- stagas 7y ago
  Yeah, right? Considering they were about to buy Greece[0] at some point, one would assume that they would hand more budget for something that potentially saves their own business. [0]: https://www.independent.co.uk/news/business/news/should-apple-buy-greece-10244988.html https://www.independent.co.uk/news/business/news/should-appl...
- d35007 7y ago
  I know some security companies have higher payouts, but do any manufacturers? As far as I can tell, Google’s highest bounty for an Android exploit is $200k. Apple will pay up to $1.5m if you can hack the kernel in a prerelease version of iOS. Zerodium tops out at $2m.
r_singh 7y ago
Did your comment just refer to non hackers as "standard people"?
- vntok 7y ago
  Well it's true. The Hacker News audience is so specific it is not similar to any specific country's population, let alone world population (ie "people" in the general sense). That's certainly not to say the HN audience is an elite (it's not) but it is comprised of outliers in the sense of people having abnormal jobs and/or abnormal interests compared to the average population in any city-sized slice taken pretty much anywhere in the real world.
throw0101a 7y ago
> Is not Apple's move mostly a PR stunt? Standard people will read "The iPhone is so secure that Apple is willing to pays $1M for somebody that find a security vulnerability." ¿Porque no los dos? Security and PR.
cryptonector 7y ago
It has that effect (good PR) as well, but I think tptacek is correct that this will have an effect on the 0day market. If you find a vuln and build an exploit you get to choose whether to do something risky (criminal liability, others might find the same vuln and take the reward, the bug might not live long enough for you to make more than $1M from the black market, further criminal liability from money laundering you ill-gotten gains, ...) or... take the easy $1M. Which would you do? It's obvious. Now, by keeping these 0days off the market, Apple also gets to further burnish their reputation. It's a good play no matter how you look at it. Of course, first Apple needed to be fairly certain that there aren't tens of thousands of vulns left to patch!
d35007 7y ago
Before this, some people complained that Apple’s bug bounty rewards were too low. Now they’re higher and a different set of people are complaining that they only did it for PR. It seems like a bit of a “damned if you do, damned if you don’t” scenario. It’s true that Apple pins its rewards to specific outcomes, but I think a lot of bug bounty programs do something like this. For instance, Google’s top bounty for Android ($200k) is only awarded if you can provide an exploit compromises that the trusted execution environment (see https://www.google.com/about/appsecurity/android-rewards/ https://www.google.com/about/appsecurity/android-rewards/).
- Mirioron 7y ago
  Does it really matter if it's for PR or not? It seems to me like Apple is hitting two birds with one stone.

tptacek 7y ago

No, this is not a PR stunt.

Rotdhizon 7y ago

I'd imagine this is to combat marketplaces like zerodium and the deep web. Traditionally grey hat hackers don't always go through bug bounty programs because the pay is awful compared to what you can get through less ethical sources. By flexing that much cash at bug hunters, they are potentially now offering even more than what you could get on the mentioned markets. The only reason people go underground to sell exploits is for the money. Take away that variable and suddenly there's no reason to sell exploits to bad actors, just sell them straight to the source at Apple and get a fat paycheck.

xkcd-sucks 7y ago
On these marketplaces, how do people demonstrate PoC without giving away the intellectual property? Or is it unproven and completely reputation based
- jakobegger 7y ago
  I imagine that a remote exploit should be pretty easy to demonstrate without giving away how you did it?
  - shellcoder 7y ago
    Harder than you might think. Who gets to control the server being compromised? 1. The buyer or someone the buyer trusts, then the buyer can log all the network traffic and find the incoming attack traffic and work out the exploit from there. 2. The seller or someone the seller trusts, can backdoor the software to fake it. 3. Someone they both trust, that would require they have some mutual contacts which while possible I wouldn't count on it. 4. A random victim, more possible, but neither party would want to risk prematurely burning the exploit. And of course there are a ton of exploits that are not remote, all sorts of local privilege escalations, and there are partial exploits that are sold. Like a multistage exploits like say just the exploit to escape a sandbox, or even just an exploit that requires a memory leak could be sold without a memory leak, or just selling the memory leak. Obviously a fully weaponized exploit sells for the most, but there are buyers for stages also.
    - jakobegger 7y ago
      > Who gets to control the server being compromised? I was thinking about phones, not servers. > then the buyer can log all the network traffic and find the incoming attack traffic and work out the exploit from there. Is it really that easy? I'm not a security researcher, but I imagine that most exploits aren't just a magic byte sequence you send to the victim -- so I assumed that just a single observation of a successful attack is not enough to understand it easily.
      - shellcoder 7y ago
        > I was thinking about phones, not servers. that doesn't change things too much, it does introduce some potential difficulties with intercepting certain types of traffic/input to the phone. The question just becomes who controls the hardware being compromised. > but I imagine that most exploits aren't just a magic byte sequence you send to the victim Its not, and its not like you can just replay those very same bytes, but its not magic, it all has a meaning and a purpose. While its not easy, you can work out plenty from logs. The entire exploit necessarily is there, things will change, but all the instructions[0] that get injected to do later stages necessarily needs to be sent, or the instructions to generate/cause them. Its not an easy skill, but its not unheard of. [0] I'm simplifying a bit to avoid getting into various code execution techniques
- shellcoder 7y ago
  Reputation plays a big part in it on both sides. Most buys are not Zerodium and putting themselves out there as buyers. So, there is a certain degree of vouching that happens as someone introduces a buyer to a seller. So, when either party violates the agreement, it reflects poorly on that person who made the introduction, making it harder for them to make those connections in the future. And, these introductions matters, most sellers don't want to just sell to anyone, there needs to be some trust that who you're selling to will be selling it to friendly governments or whatever. Its not like a craigslist ad where you sell to just anyone who answers. So that acts as a deterrent on the buyer side. It'll be harder to get new sellers if you have a poor, or no reputation. On the seller side, you're not going to get too many people willing to vouch for you as you start burning bridges by selling non-working exploits. And on that, the payment scheme acts as a deterrent, like teh great-grandparent said: > grey-market sales are valued on continuous access; you get paid over a period of time, and if the bug you sold dies, you stop getting paid. That is, you might get XX Thousand upfront, and then an agreed upon XXX thousand based on the exploit surviving XX days. So trying to scam the buyer will net you a small amount of the total at best, but I mean, often times they'll hold payment until its confirmed and contracts are written and signed over these sales too, its not under the table payments or anything for the most part. Legitimate business transactions. So, I guess to sum it up, reputation and a demonstrated, or atleast vouched for past record. There is a lot of trust on both sides.
  - grugq 7y ago
    Exactly
  - tptacek 7y ago
    What's interesting to me about this --- and I've got no firsthand knowledge of the markets --- is that Apple doesn't have to outbid brokers; a broker could offer 50% more than Apple, but that comes with an X% uncertainty penalty. You can sell to Apple and pocket $1MM, or try to structure a deal for $1.5MM and gamble that the bug will survive. I'm betting that's often not a good deal; the lump sum payment is the better option.
    - 7y ago
- stuartd 7y ago
  I can imagine it being pretty easy. Hacker: I have a no user-interaction RCE Apple: ok yeah Hacker: gimme a phone number Apple: here you go Hacker: … iPhone: I am pwned Apple: ok lets do the deal
lbatx 7y ago
>The only reason people go underground to sell exploits is for the money. Not reputation? Not the thrill of it? Not hatred of Apple? Not plain maliciousness?
- izzydata 7y ago
  Some amount of money will likely be able to buyout those reasons, but that isn't guaranteed and all of those reasons are still reasons.
- FrozenTuna 7y ago
  I don't know anyone who hates apple that much. This way, you still get the reputation and thrill. The only people left are malicious actors, like state sponsored attacks.
auiya 7y ago
> I'd imagine this is to combat marketplaces like Zerodium Zerodium already pays double what Apple does. Where's the incentive?
- esmi 7y ago
  There is no question on the legality of accepting money from Apple. Accepting money from Zerodium comes with some risk for some people. https://law.stackexchange.com/questions/502/is-it-legal-to-sell-zero-day-exploits https://law.stackexchange.com/questions/502/is-it-legal-to-s...

jazzyjackson 7y ago

I think it transcends PR stunt if it actually changes the market for vulnerabilities. $1mil for kernel hacks and 100k for app interactions is just being price competitive with the market.

draw_down 7y ago

Come on

kccqzy 7y ago

I don't think it's a PR stunt. The typical layperson doesn't know what's a kernel, so the difference between a drive-by kernel exploit and an app exploit couldn't easily be summarized and made understood. Yes a layperson will understand the difference after you give them a five-minute primer of operating system theory, but in this age of social media who still has the attention span to sit through that, if their interest isn't in computer science? So to me, this isn't a PR stunt. It's a necessary "dumbing down" we see all too often. It's no different from journalists digesting and simplifying the content of an advancement in biology or physics.

ChrisCinelli 7y ago
It could be explained to people ... But look at the titles that the press is putting out.
Fnoord 7y ago
> I don't think it's a PR stunt. I don't get this it is either A or B reasoning. Why can't it be also a PR stunt? Or also contain PR?
- erikpukinskis 7y ago
  PR stunt implies that it was cooked up by PR people as something to be in the media. It’s either that or it’s not. If a company wants to do something and PR gets involved and makes sure the messaging is good, that’s not a PR “stunt” anymore. A stunt is a trick.

onion2k 7y ago

When I read the article my first reaction was "Only a million?" Considering the importance of a bug like this to Apple's business and the size of their cash hoard, this sounds like they don't actually care that much.

stagas 7y ago
Yeah, right? Considering they were about to buy Greece[0] at some point, one would assume that they would hand more budget for something that potentially saves their own business. [0]: https://www.independent.co.uk/news/business/news/should-apple-buy-greece-10244988.html https://www.independent.co.uk/news/business/news/should-appl...
d35007 7y ago
I know some security companies have higher payouts, but do any manufacturers? As far as I can tell, Google’s highest bounty for an Android exploit is $200k. Apple will pay up to $1.5m if you can hack the kernel in a prerelease version of iOS. Zerodium tops out at $2m.

r_singh 7y ago

Did your comment just refer to non hackers as "standard people"?

vntok 7y ago
Well it's true. The Hacker News audience is so specific it is not similar to any specific country's population, let alone world population (ie "people" in the general sense). That's certainly not to say the HN audience is an elite (it's not) but it is comprised of outliers in the sense of people having abnormal jobs and/or abnormal interests compared to the average population in any city-sized slice taken pretty much anywhere in the real world.

throw0101a 7y ago

> Is not Apple's move mostly a PR stunt? Standard people will read "The iPhone is so secure that Apple is willing to pays $1M for somebody that find a security vulnerability." ¿Porque no los dos? Security and PR.

cryptonector 7y ago

It has that effect (good PR) as well, but I think tptacek is correct that this will have an effect on the 0day market. If you find a vuln and build an exploit you get to choose whether to do something risky (criminal liability, others might find the same vuln and take the reward, the bug might not live long enough for you to make more than $1M from the black market, further criminal liability from money laundering you ill-gotten gains, ...) or... take the easy $1M. Which would you do? It's obvious. Now, by keeping these 0days off the market, Apple also gets to further burnish their reputation. It's a good play no matter how you look at it. Of course, first Apple needed to be fairly certain that there aren't tens of thousands of vulns left to patch!

d35007 7y ago

Before this, some people complained that Apple’s bug bounty rewards were too low. Now they’re higher and a different set of people are complaining that they only did it for PR. It seems like a bit of a “damned if you do, damned if you don’t” scenario. It’s true that Apple pins its rewards to specific outcomes, but I think a lot of bug bounty programs do something like this. For instance, Google’s top bounty for Android ($200k) is only awarded if you can provide an exploit compromises that the trusted execution environment (see https://www.google.com/about/appsecurity/android-rewards/ https://www.google.com/about/appsecurity/android-rewards/).

Mirioron 7y ago
Does it really matter if it's for PR or not? It seems to me like Apple is hitting two birds with one stone.