6 ms·

> I'm not interested in waiting years for a bounty. I can't speak for anyone else, but my personal experience is that the Apple Security Bounty Program has been

> I'm not interested in waiting years for a bounty. I can't speak for anyone else, but my personal experience is that the Apple Security Bounty Program has been a disappointment, and I don't plan to participate again in the future. Yeah...Hint to Apple: When somebody discloses something, responsibly, you react to that with a proper process and understand you get 90 days in most cases as is industry standard (that's typically how Google Project Zero operates). Otherwise don't be surprised when exploits end up sold for much more on a black market because nobody wants to cooperate with you. Think we need a few more 0-days that cost Apple a few bad PR spins (as well as others like Valve) to make them wake up and actually have a proper process.

rydre 6y ago
I can confirm this! Back in 2017, I was 17 and found a flaw that affected the privacy of all browsers and required a web standards change. Google/Chromium (Andrew R. Whalley) paid me a good bounty for that, but Apple (mac, ios, iphone, watch) didn't pay. I didn't expect Mozilla to pay obviously since they were non profit.
- 3pt14159 6y ago
  What was the exploit? I've been sitting on one that's essentially as old as the web but I figured it was pointless to try to alert browers about it because too much functionality rests on it.
  - XCabbage 6y ago
    Don't tease us - what was your exploit? Just from the description, I'm happy taking a guess that this is going to involve somehow exploiting the browser cache (e.g. via timing how long it takes to request an image from another domain that may or may not have previously been cached) to determine whether the user has visited a page. That was first written up by academics decades ago, and has since been independently invented by several people (me included), but wasn't fixed as of whenever I last checked a couple of years ago. Is my wild guess right? :)
    - 3pt14159 6y ago
      No, though that is a good one.
  - rydre 6y ago
    > What was the exploit? Just file a security issue on bugs.chromium.org with demo/instructions. If it's a good one, they'll pay good. I don't wanna give it out since it's publicly linked to my twitter and I've bad mouthed Apple here... (I don't publicly speak against them for obvious reasons)
- miles 6y ago
  > I didn't expect Mozilla to pay obviously since they were non profit. Despite being a nonprofit organization, Mozilla's annual revenue is around half a billion dollars[1] and they do offer a client bug bounty of up to $10,000[2]. [1] https://en.wikipedia.org/wiki/Mozilla_Corporation https://en.wikipedia.org/wiki/Mozilla_Corporation [2] https://www.mozilla.org/en-US/security/client-bug-bounty/ https://www.mozilla.org/en-US/security/client-bug-bounty/
- fishywang 6y ago
  When the December 2014 git vulnerability was disclosed to git maintainers (I can't find the CVE number now, but this was the github blog about it: https://github.blog/2014-12-18-vulnerability-announced-update-your-git-clients/ https://github.blog/2014-12-18-vulnerability-announced-updat..., and this was the hn discuss then: https://news.ycombinator.com/item?id=8769667 https://news.ycombinator.com/item?id=8769667, tl;dr is git only checked and protected all lower-case .git directory from overwritten by clone/checkouts, which will becomes tricky when it's used on case-insensitive fs), they contacted both Microsoft and Apple to make sure that they fixed all the corner cases of their case-insensitive file systems. Microsoft was very cooperative at the time, pulled in someone from NT kernel team to make sure that the fix covered all the corner cases; Apple, on the other hand, didn't response. Even after the patched version of git is released, Apple didn't do a hot release of Xcode tool (which is how they distribute git officially on Apple's systems). They only included the fix on their next scheduled beta release of Xcode.
duxup 6y ago
It's such a tough culture to change. I sat next to one of a security team at a large networking equipment maker (who you would hope has a clue about security but not so much) for a while. Even after numerous meetings and agreements, dude still was on conference calls where various executives would first reach for the lawyer's phone number upon someone from the outside reporting a security problem. Talking these guys down from even the most absurd actions was a regular occurrence ... let alone just responding properly / graciously. It was so bad at one point the legal team would contact the security team to get background anytime someone notified them of anything security related... just to avoid the obvious PR disaster that would be suing someone who was genuinely being helpful. (The key there was the legal council was a good guy and had an appreciation for the damage a poorly timed legal threat could do.)
- numpad0 6y ago
  So the bossman can’t make distinction between human society lawyers and computer logic lawyers?
  - penagwin 6y ago
    The problem is they identify it as a criminal/legal issue not as a software/hardware issue.
    - kevin_thibedeau 6y ago
      That level of ignorance should disqualify someone from running a tech company.
      - ironmagma 6y ago
        We're stuck with this until we decide it's time to start regulating ourselves.
    - numpad0 6y ago
      Yeah so let’s merge those categories to a same one within corporate, something like “internal externalized product business risks” so both the boss and classification isn’t wrong (and ideally cut/reroute/raise the pay according to requisite nursing for idiot bossman)
saagarjha 6y ago
I tried as well, not for the bounty (I didn’t get one) but because I thought I should responsibly disclosure for bugs I had found in sandbox enforcement. I have them a demo, they sat on it for a while (to be fair, if you emailed them they’d respond quickly saying they were still working on it, unlike things submitted through Feedback Assistant.) Then I got an email a month later saying that they had fixed my specific case for App Store apps and couldn’t see what the problem was, as they had apparently pushed a fix just after I first submitted my bug without telling me or posting the source code for dyld (a fix which happened to apparently break some apps, so they got their bundle IDs hardcoded in AMFI as an exception). They seemed to only be interested in the App Store, which I couldn’t test obviously, but I submitted a slight variation to work around the changes within a day, and a month later another variation that made exploiting the bug even easier. After the last one they asked for an extension to work on the last one, which I granted them; when that one started expiring I sent them an email asking what had become of the bug. This time they said they fixed it in the App Store and they wanted to credit me with a fix; there was no mention of sandbox enforcement outside of the App Store. Still, as they had run over the discretionary disclosure and said they fixed the things they cared about I went ahead and published a writeup…but it was a bit annoying because they didn’t even assign me a CVE or something to link to so people could get more information, so I’m not sure why they were asking for details about me…
- mox1 6y ago
  Out of curiosity why would it matter if they "assign you" a CVE? If your intentions were purely altruistic then the CVE matters not. Just make a blog post with the details and link there. But if perhaps on some level you were after recognition then yes I can see the desire for a CVE...
  - saagarjha 6y ago
    Because I can give people a CVE and they can find it easily rather than "oh it's actually a blog post I wrote, oh you didn't find it by search, here is the link" and absolves me of coming up with a descriptive name, reduces confusion if I ever find another sandbox escape, and centralizes the bug so that future researchers can do things like look up all the bugs for the component or build on it by seeing what's been done in the past. Same reason you might want your book to have an ISBN and show up in a library catalogue, for example.
tptacek 6y ago
There is probably no market at all for the privacy bypass where you make an illicit copy of Safari and arrange for it to be run so you can access files in ~/Library/Safari. This is simply not a high-severity bug. A good find, and an interesting writeup, but it's no RCE.
- saagarjha 6y ago
  Perhaps, but for Apple it’s (or should be) a major headache when apps from the App Store steal and upload people’s browsing histories, as they were doing for a while until this change came in. Clearly they care enough about it that they were willing to piss off developers when it rolled out, so it might as work right… Also do note that Apple does claim to offer a bounty for such access, regardless of what the market is willing to pay. So clearly it is valuable to them.
  - Wowfunhappy 6y ago
    > Perhaps, but for Apple it’s (or should be) a major headache when apps from the App Store steal and upload people’s browsing histories, as they were doing for a while until this change came in. Isn't this what Apple's approval process is supposed to be for? Or is that only good for preventing Apple-Tax Evasion nowadays?
    - saagarjha 6y ago
      App Store Review is a joke on macOS.
      - Wowfunhappy 6y ago
        It's different than on iOS?
        saagarjha 6y ago
        I’d say it’s worse, which is saying something considering a jailbreak once shipped in the App Store on iOS.
Abishek_Muthian 6y ago
>Think we need a few more 0-days that cost Apple a few bad PR spins I doubt it, "The exploit was used only against oppressed ethnic people"[1] was good enough to give Apple clean chit last time. [1]https://arstechnica.com/information-technology/2019/09/apple-takes-flak-for-disputing-ios-security-bombshell-dropped-by-google/ https://arstechnica.com/information-technology/2019/09/apple...
- saagarjha 6y ago
  Says who? The link you posted is one of many calling out Apple for their poor response.
  - godelski 6y ago
    He's referring to Apple's official response. Which was basically along the lines of "Nothing to worry about everyone! Exploit was only used on the 12 most popular websites for Ughygur related content. Therefore you have nothing to worry about."
    - saagarjha 6y ago
      Well, it was nowhere "good enough"; it was just the best they could come up with.
deleted 6y ago
[deleted]

rydre 6y ago

I can confirm this! Back in 2017, I was 17 and found a flaw that affected the privacy of all browsers and required a web standards change. Google/Chromium (Andrew R. Whalley) paid me a good bounty for that, but Apple (mac, ios, iphone, watch) didn't pay. I didn't expect Mozilla to pay obviously since they were non profit.

3pt14159 6y ago
What was the exploit? I've been sitting on one that's essentially as old as the web but I figured it was pointless to try to alert browers about it because too much functionality rests on it.
- XCabbage 6y ago
  Don't tease us - what was your exploit? Just from the description, I'm happy taking a guess that this is going to involve somehow exploiting the browser cache (e.g. via timing how long it takes to request an image from another domain that may or may not have previously been cached) to determine whether the user has visited a page. That was first written up by academics decades ago, and has since been independently invented by several people (me included), but wasn't fixed as of whenever I last checked a couple of years ago. Is my wild guess right? :)
  - 3pt14159 6y ago
    No, though that is a good one.
- rydre 6y ago
  > What was the exploit? Just file a security issue on bugs.chromium.org with demo/instructions. If it's a good one, they'll pay good. I don't wanna give it out since it's publicly linked to my twitter and I've bad mouthed Apple here... (I don't publicly speak against them for obvious reasons)
miles 6y ago
> I didn't expect Mozilla to pay obviously since they were non profit. Despite being a nonprofit organization, Mozilla's annual revenue is around half a billion dollars[1] and they do offer a client bug bounty of up to $10,000[2]. [1] https://en.wikipedia.org/wiki/Mozilla_Corporation https://en.wikipedia.org/wiki/Mozilla_Corporation [2] https://www.mozilla.org/en-US/security/client-bug-bounty/ https://www.mozilla.org/en-US/security/client-bug-bounty/
fishywang 6y ago
When the December 2014 git vulnerability was disclosed to git maintainers (I can't find the CVE number now, but this was the github blog about it: https://github.blog/2014-12-18-vulnerability-announced-update-your-git-clients/ https://github.blog/2014-12-18-vulnerability-announced-updat..., and this was the hn discuss then: https://news.ycombinator.com/item?id=8769667 https://news.ycombinator.com/item?id=8769667, tl;dr is git only checked and protected all lower-case .git directory from overwritten by clone/checkouts, which will becomes tricky when it's used on case-insensitive fs), they contacted both Microsoft and Apple to make sure that they fixed all the corner cases of their case-insensitive file systems. Microsoft was very cooperative at the time, pulled in someone from NT kernel team to make sure that the fix covered all the corner cases; Apple, on the other hand, didn't response. Even after the patched version of git is released, Apple didn't do a hot release of Xcode tool (which is how they distribute git officially on Apple's systems). They only included the fix on their next scheduled beta release of Xcode.

duxup 6y ago

It's such a tough culture to change. I sat next to one of a security team at a large networking equipment maker (who you would hope has a clue about security but not so much) for a while. Even after numerous meetings and agreements, dude still was on conference calls where various executives would first reach for the lawyer's phone number upon someone from the outside reporting a security problem. Talking these guys down from even the most absurd actions was a regular occurrence ... let alone just responding properly / graciously. It was so bad at one point the legal team would contact the security team to get background anytime someone notified them of anything security related... just to avoid the obvious PR disaster that would be suing someone who was genuinely being helpful. (The key there was the legal council was a good guy and had an appreciation for the damage a poorly timed legal threat could do.)

numpad0 6y ago
So the bossman can’t make distinction between human society lawyers and computer logic lawyers?
- penagwin 6y ago
  The problem is they identify it as a criminal/legal issue not as a software/hardware issue.
  - kevin_thibedeau 6y ago
    That level of ignorance should disqualify someone from running a tech company.
    - ironmagma 6y ago
      We're stuck with this until we decide it's time to start regulating ourselves.
  - numpad0 6y ago
    Yeah so let’s merge those categories to a same one within corporate, something like “internal externalized product business risks” so both the boss and classification isn’t wrong (and ideally cut/reroute/raise the pay according to requisite nursing for idiot bossman)

saagarjha 6y ago

I tried as well, not for the bounty (I didn’t get one) but because I thought I should responsibly disclosure for bugs I had found in sandbox enforcement. I have them a demo, they sat on it for a while (to be fair, if you emailed them they’d respond quickly saying they were still working on it, unlike things submitted through Feedback Assistant.) Then I got an email a month later saying that they had fixed my specific case for App Store apps and couldn’t see what the problem was, as they had apparently pushed a fix just after I first submitted my bug without telling me or posting the source code for dyld (a fix which happened to apparently break some apps, so they got their bundle IDs hardcoded in AMFI as an exception). They seemed to only be interested in the App Store, which I couldn’t test obviously, but I submitted a slight variation to work around the changes within a day, and a month later another variation that made exploiting the bug even easier. After the last one they asked for an extension to work on the last one, which I granted them; when that one started expiring I sent them an email asking what had become of the bug. This time they said they fixed it in the App Store and they wanted to credit me with a fix; there was no mention of sandbox enforcement outside of the App Store. Still, as they had run over the discretionary disclosure and said they fixed the things they cared about I went ahead and published a writeup…but it was a bit annoying because they didn’t even assign me a CVE or something to link to so people could get more information, so I’m not sure why they were asking for details about me…

mox1 6y ago
Out of curiosity why would it matter if they "assign you" a CVE? If your intentions were purely altruistic then the CVE matters not. Just make a blog post with the details and link there. But if perhaps on some level you were after recognition then yes I can see the desire for a CVE...
- saagarjha 6y ago
  Because I can give people a CVE and they can find it easily rather than "oh it's actually a blog post I wrote, oh you didn't find it by search, here is the link" and absolves me of coming up with a descriptive name, reduces confusion if I ever find another sandbox escape, and centralizes the bug so that future researchers can do things like look up all the bugs for the component or build on it by seeing what's been done in the past. Same reason you might want your book to have an ISBN and show up in a library catalogue, for example.

tptacek 6y ago

There is probably no market at all for the privacy bypass where you make an illicit copy of Safari and arrange for it to be run so you can access files in ~/Library/Safari. This is simply not a high-severity bug. A good find, and an interesting writeup, but it's no RCE.

saagarjha 6y ago
Perhaps, but for Apple it’s (or should be) a major headache when apps from the App Store steal and upload people’s browsing histories, as they were doing for a while until this change came in. Clearly they care enough about it that they were willing to piss off developers when it rolled out, so it might as work right… Also do note that Apple does claim to offer a bounty for such access, regardless of what the market is willing to pay. So clearly it is valuable to them.
- Wowfunhappy 6y ago
  > Perhaps, but for Apple it’s (or should be) a major headache when apps from the App Store steal and upload people’s browsing histories, as they were doing for a while until this change came in. Isn't this what Apple's approval process is supposed to be for? Or is that only good for preventing Apple-Tax Evasion nowadays?
  - saagarjha 6y ago
    App Store Review is a joke on macOS.
    - Wowfunhappy 6y ago
      It's different than on iOS?
      - saagarjha 6y ago
        I’d say it’s worse, which is saying something considering a jailbreak once shipped in the App Store on iOS.

Abishek_Muthian 6y ago

>Think we need a few more 0-days that cost Apple a few bad PR spins I doubt it, "The exploit was used only against oppressed ethnic people"[1] was good enough to give Apple clean chit last time. [1]https://arstechnica.com/information-technology/2019/09/apple-takes-flak-for-disputing-ios-security-bombshell-dropped-by-google/ https://arstechnica.com/information-technology/2019/09/apple...

saagarjha 6y ago
Says who? The link you posted is one of many calling out Apple for their poor response.
- godelski 6y ago
  He's referring to Apple's official response. Which was basically along the lines of "Nothing to worry about everyone! Exploit was only used on the 12 most popular websites for Ughygur related content. Therefore you have nothing to worry about."
  - saagarjha 6y ago
    Well, it was nowhere "good enough"; it was just the best they could come up with.

deleted 6y ago

[deleted]