4 ms·
$75,000. One-click remote partial access to sensitive data. $150,000. One-click remote broad access to sensitive data. Only having access to the camera is par
by tw04 7y ago
$75,000. One-click remote partial access to sensitive data.
$150,000. One-click remote broad access to sensitive data.
Only having access to the camera is partial access. It's not full access to the system - I'd agree with that.
- tolmasky 7y agoGoing along with other comments on this thread, if it's the case that you have access to anything that domain has access to, and the webcam is just a flashy way of demonstrating this, I would certainly consider it broad access. I would assume this is the case since the problem appears to be in URI parsing, not webcam code. Of course, if the bug was reported as a webcam issue then I suppose it could be maybe argued that it's fine that they paid for it as such.
- tw04 7y agoI'm not saying I agree or disagree with what Apple gave him, I'm just stating that's why. His proof of concept wasn't god-mode, it was access to the webcam. If he wants the extra $75k, and the exploit allows full access, I'd imagine he'd be incentivized to show full access.
- dodobirdlord 7y agoIt gives access code only to things that the user has given a domain access to, which is not something the attacker can influence.