5 ms·
Worth noting that the Safari and iOS vulnerabilities that allow this to happen are worth up to $1 million if reported to Apple.
by modeless 6y ago
Worth noting that the Safari and iOS vulnerabilities that allow this to happen are worth up to $1 million if reported to Apple.
- titanomachy 6y agoNSO is worth a billion dollars, and they've probably made a lot more by renting out these hacks to governments than they ever could have made through responsible disclosure. It seems like Apple has patched it in iOS 9.3.5, though: https://nvd.nist.gov/vuln/detail/CVE-2016-4657 https://nvd.nist.gov/vuln/detail/CVE-2016-4657
- thoughtstheseus 6y agoMaybe $1 million is not enough.
- tarikjn 6y agoDoes Apple allow anonymous reports/crypto payouts? There could be anti-money laundering issues to sort out, but perhaps this could incentivize individual actors to break ranks and leak vulnerabilities upstream.
- inglor 6y ago"Break ranks"? If you work for one of these actors (NSO with intentionally "sassy" PR or "quiet" ones like Verint or ones in the middle like Cellebrite) and leak info - you will get jailed. Breaking ranks in this case is a 10 year jail sentence if you get caught. Funnily enough, the ex-head of malware analysis for NSO recently released this https://www.jsof-tech.com/ripple20/ https://www.jsof-tech.com/ripple20/ and "switched ranks" to the light side.