11 ms·
It says here he was awarded $75,000, instead of the $150,000 listed on the Apple page for this type of exploit. Later on, Apple specifies: > Reports that i
by tolmasky 7y ago
It says here he was awarded $75,000, instead of the $150,000 listed on the Apple page for this type of exploit. Later on, Apple specifies:
> Reports that include a basic proof of concept instead of a working exploit are eligible to receive no more than 50% of the maximum payout amount.
Can someone explain to me what would have counted as a “working exploit” here vs. simple proof of concept? They can’t mean actually finding it in the wild right? The OP’s example seems working enough to me, and this looks like a really bad bug.
- tw04 7y ago$75,000. One-click remote partial access to sensitive data. $150,000. One-click remote broad access to sensitive data. Only having access to the camera is partial access. It's not full access to the system - I'd agree with that.
- tolmasky 7y agoGoing along with other comments on this thread, if it's the case that you have access to anything that domain has access to, and the webcam is just a flashy way of demonstrating this, I would certainly consider it broad access. I would assume this is the case since the problem appears to be in URI parsing, not webcam code. Of course, if the bug was reported as a webcam issue then I suppose it could be maybe argued that it's fine that they paid for it as such.
- tw04 7y agoI'm not saying I agree or disagree with what Apple gave him, I'm just stating that's why. His proof of concept wasn't god-mode, it was access to the webcam. If he wants the extra $75k, and the exploit allows full access, I'd imagine he'd be incentivized to show full access.
- dodobirdlord 7y agoIt gives access code only to things that the user has given a domain access to, which is not something the attacker can influence.
- floatingatoll 7y agoPlease don't use four-space indents to blockquote non-code here. It doesn't wrap and isn't readable on mobile. You can use > * ... * instead, as so: > Reports that include a basic proof of concept instead of a working exploit are eligible to receive no more than 50% of the maximum payout amount.
- Avamander 7y agoPlease don't use italics, it makes it more difficult to read for dyslexics.
- floatingatoll 7y agoConsider emailing the site admins (footer Contact link) and ask them for a userpref to disable italics. They provided the italics feature and so it will be used for various purposes, but if it's materially impacting your ability to use the site, they'll certainly want to hear about that. I'm not guaranteeing that they will reply or agree, as I'm not an admin. Do you have any recommendations for browser addons/extensions/etc. that strip italics from all sites? I wasn't able to find any in a simple search and I imagine you'd have more experience in this area for others seeing your comment, agreeing with it, and then wishing something like that existed.
- dlivingston 7y agoRather than waiting on people to change their behavior (stopping the use of one of the fundamental elements of typography), you would have greater luck installing a browser plugin that removes <i> tags from webpages.
- Avamander 7y agoThe same argument can be applied to the use of code blocks and for example git commit message length.
- tolmasky 7y agoThank you for the suggestion! I also hate the scrolling and this is much better.