6 ms·

Apple salaries aren’t much of a secret, see: levels.fyi. 1M is a lot of money to me, a regular person, but when you consider that top security engineering tale

• H8crilA 7y ago
  I'm surprised by how cheap the vulnerabilities market is. A good exploit, against a popular product like Chrome, selling for 100k or even $1M may sound like a lot, but it's really pennies for any top software firm. And $1M is still a lot for a vulnerability by market prices. You can do so much damage/return with an exploit that affects > 30% of the population. Get 5 of those and sky is the limit.
  • collyw 7y ago
    Out of interest how do you get to know the market price or the market in general for this sort of thing? If I were to discover a vulnerability is there a legal way I could cash in on it (aside from this case with Apple)?
    • devin 7y ago
      I don’t know this market well, but I do know what a 3% dip in Apple’s stock price means, so it seems rather obvious that Apple’s incentive to know of vulnerabilities prior to their sale in an alternative market is worth a lot more than 1M.
      • avar 7y ago
        Valuing something in terms of its short-term impact on stock doesn't make any sense. An iOS vulnerability is worth a lot, but that the stock price dipped 3% is more of a sign of the market being fickle and reacting to any bad/good news about the company on a given day than 3% of Apple's worth being lost in any meaningful sense. Following this line of thinking leads to some pretty absurd conclusions, like 7% of Tesla's value being predicated on Elon Musk not smoking a joint[1]. 1. https://www.cnbc.com/2018/09/07/tesla-sinks-8percent-after-bizarre-musk-podcast-appearance-cao-exit.html https://www.cnbc.com/2018/09/07/tesla-sinks-8percent-after-b...
        • floe 7y ago
          First paragraph: > Shares of Tesla plunge after news of a pair of C-suite executive resignations and a bizarre video showing CEO Elon Musk smoking pot on a podcast.
    • H8crilA 7y ago
      Some stuff on the internet: https://zerodium.com/program.html https://zerodium.com/program.html Also I heard in person, so I cannot quote. Not sure how legal this is, but there are even vulnerabilities brokers, who set you up with buyers.
      • ChrisCinelli 7y ago
        Interesting... they do not seem to be interested to processors exploits.
        • H8crilA 7y ago
          Well it doesn't cost much to put it up there (among the list of things they seek), now that we know it's feasible even against big players.
    • deleted 7y ago
      [deleted]
    • deleted 7y ago
      [deleted]
  • devin 7y ago
    Agreed. People talking in the top-rated comments of this thread seem to think 1M is a lot of money for a vulnerability that could cost Apple lifetime customer value 10-100x the amount they’re offering in bounty.
    • charlesdm 7y ago
      So the question is, assuming you have a valid exploit, could you not convince Apple to pay more than $1m? If you found an unfound gaping crater of an exploit somewhere -- how much would that be worth to them? Likely a lot more than $1m. I'm sure you could negotiate that number up, a lot.
      • selectodude 7y ago
        The problem is that technically finding the exploit at all is in violation of the CFAA. Once you approach Apple with the exploit, you're then skating on their goodwill. Trying to play hardball probably won't go well for you.
      • Cthulhu_ 7y ago
        Well how would you otherwise monetize the exploit? You could sell it on the black market, but I doubt you'd be able to make 1M off of it. Then again I don't know the black market so you could? But bug bounties like this are competing with the shadier markets. I suspect they found out the shady companies are offering more than their existing bug bounty program did.
      • lifeisstillgood 7y ago
        Quite simply if you have your name on apple.com that says they paid you $1m under this program you just walk into any VC office in SF or Tel Aviv and say "how much have you got?" As Warren Buffet says there is plenty of money to be made in the centre
    • tptacek 7y ago
      This is silly. Apple is going to have bugs almost no matter what they do, as will Google and Microsoft. It makes sense to invest way over the top if you can kill bug classes outright --- and Apple does this, too. For example, people that were doing DMA hardware attacks against macOS a couple years ago are now on Apple's payroll, designing hardware to defend against those attacks. That's a meaningful serious investment in defense. Rewriting their kernel in a memory safe language would be another example (one they haven't done yet). Massively outbidding the current spot price for a bug doesn't accomplish anything like that. Think about who they're really bidding against. They can drive the price of bugs way up, and they are doing that gradually, but there will still be a price and people selling them. The important thing they're doing on this is making unlocked devices available for researchers, and lowering the bar for research for people who would never sell to brokers.
  • baybal2 7y ago
    And even your estimates are way higher than that of typical "warez forum." 100k exploits most likely what has been resold few times over before it reached the "professional infosec" space
    • devin 7y ago
      Eh, I think that’s a bit presumptuous. There can be honor among thieves.
  • DrJaws 7y ago
    The NSA or any other agency would pay you 10x that if you go to them instead of report it.
    • devin 7y ago
      I’m assuming you know from experience.
      • DrJaws 7y ago
        If one million for hacking or accessing an iphone is more than the real world value, there wouldn't exists business dedicated to unlock protected iphones or hack them, but they do and make business with countries while earning millions. I'm absolutely sure that saudi arabia would pay much more than that for an exploit like that and I don't need to have experience doing it, it's common sense.
  • ChrisCinelli 7y ago
    I think that not all companies are the same. Some companies put a lot of effort in security (Apple, Google, Facebook, etc). Usually they have engineering driven cultures. The other majority of companies see security just as a cost center that needs to be covered in order to reduce legal liabilities. The second kind of companies do not have a bug bounty programs because they know that they have too many holes and prefer not to attract too much interest. For those companies that may have huge capitalization and profits, paying $1M for a vulnerability is not practical. I expect that in general all companies (including those in the first group) detect compromised accounts and services from time to time but unless they have to disclosed because the laws demand it, they prefer to avoid the bad PR and potential lawsuits. But while I expect the first kind of companies doing a root cause analysis and improving the systems, the companies in the second group of companies usually just clean up the detected compromised systems and avoid to look too much deep because either they do not have the skills or they are afraid to find things they will have to disclose and be liable for.
    • pankajdoharey 7y ago
      Well it is also a signalling to Apple Users that they is serious about security and privacy. This helps them sell more iThings.
  • throwaway3627 7y ago
    It depends on how an exploit is monetized; the devils is in the terms: exclusivity, duration, scope and level of access. A non-exclusively-licensed exploit that can be sold 50x for $50k/year is bank ($2.5m/yr). If I were to spend 6-9 months developing a good exploit, I wouldn't give it Apple if and only if money were the primary and sole motivation. However, it makes sense to blog about it, turn it in to Apple and leverage such a discovery into outside Angel funding for a startup... that is if Apple doesn't require onerous NDAs. If the terms from Apple weren't favorable (they're likely to be terrible), then reselling it makes sense if you were really broke or going nonprofit security disclosure route at least parlays it into cred.
  • raxxorrax 7y ago
    > I'm surprised by how cheap the vulnerabilities market is I think this has a lot to do with government agencies buying any exploit they can get their hands and there is basically no market besides that. I don't know if that is illegal in the US, but it seems that government is the only buyer.
    • paulriddle 7y ago
      I'm wondering if hedge funds would buy something that would allow access to private data. I heard insider trading is not an unusual thing, so a polished series of exploites wrapped up as a tool with clear interface might be taken seriously.
      • pbhjpbhj 7y ago
        A major vuln can probably pretty reliably blip a share price, with FAANG and similar companies' shares that's going to be a chance to make fast bucks.
      • MagnumOpus 7y ago
        > if hedge funds would buy something that would allow access to private data Extremely unlikely. The risk/reward if found out is too lopsided. Conviction for insider trading has you pay a penalty and transform your fund into a family office -- Raj Rajaratnam going to prison for a decade is a unique exception not the rule. Conviction for insider trading in combination with wire fraud, espionage, and all the other exploit-related charges will send everyone involved to prison for 10-20 years, pretty much guaranteed. What use is a bigger hedge fund if you have that sword of Damocles hanging over you?
        • mason55 7y ago
          Well, for what it’s worth, if you purchase an exploit and use it to hack phones and then trade on the info you steal, I don’t think there would be any insider trading charges involved. Lots and lots of other charges but if no insider is giving you info then it wouldn’t be insider trading. What would be 100% legal would be if you bought an exploit and then traded on the release of that exploit. Depending on the severity of the exploit it could move the stock price a bit. And, even though people wouldn’t like it, that’s kind of the point of the market. You get rewarded for helping with information and price discovery.
  • onetimemanytime 7y ago
    >>I'm surprised by how cheap the vulnerabilities market is. I presume that it is a legal minefield, selling 0days and extortion are first cousins, at least. If you could hold a bid, no doubt an Arab country would pay $50 Mil for one...but they buy them from companies that sell "software" and services.
• drstewart 7y ago
  I'd like to propose a new form of Betteridge's Law that states any time a monetary figure is given in reference to a large company the top comment will always be a form of "That's nothing. It should be at least 10x that number!"
  • devin 7y ago
    I don’t know the law of which you speak, but the risk of not catching an ugly vulnerability after posturing themselves as a secure platform all over the media could easily cost them a lot more than 1M. That’s why their bounty is actually a lowball. It’s not that they’re a big company, it’s that they have a lot to lose. Does that make sense?
    • makosharky 7y ago
      They're offering about 100x more than is common in these programs. Despite that, folks like yourself are whinging about the company that pays the most, instead of the ones who pay the least. Y'all are a joke. Does that make sense?
• jobigoud 7y ago
  Bounties on security vulns have difficult dynamics on incentives though. At these levels you start running the risk of an insider subtly introducing a vulnerability and share it with a secret aquaintance.
  • devin 7y ago
    I’ll say it once more. This isn’t that big of a bounty when you consider what Apple’s iPhone security crew make on average/year.
    • bsaul 7y ago
      Don't know why you got downvoted. I think that's a pretty good argument against the particular scenario OP mentionned. Why would an apple employee take the risk to loose his 300k+ / year salary for a 1M bounty (he'll have to share with the acquaintance) ?
  • akersten 7y ago
    I would hope there is sufficient discouragement for that sort of behavior - that's definitely breaking at least two federal laws. Maybe I'm naive, but I would think that any programmer skilled and privileged enough to be able to insert a vulnerability into a mainline product, get it past code review, and make it look like an innocent mistake during the inevitable root-cause analysis would not only know better, but would also value their career enough that whatever payout they got from the bounty wouldn't be worth jeopardizing all they've worked for. And anyway, how's that conversation supposed to play out? "Sorry about that bug boss, yeah could've happened to anyone. Anyway, about my retirement in two weeks..."
    • jobigoud 7y ago
      Another scenario is, having access to the code, being in a much better position to test and find vulnerabilities in the first place. Instead of disclosing them internally which may just be expected and get you little extra, leak them to a trusted external partner for a share of the bounty.
• Yajirobe 7y ago
  > bUt 1M dOLlArS iS nOt tHaT mUcH
• roboys 7y ago
  Imo it's worth more than a million dollars for an organization to not disclose a flaw to Apple and make the attack vector available to clients. Governments are more than willing to pay $100,000-$1,000,000 per unlock.