6 ms·

From experience, I'll suggest all serious security researchers to never, ever, sign any agreement with the company whose products they are researching. This pa

• ballenf 6y ago
  Kind of humorous to imagine a researcher suing apple under the anti-gig California law. Would be a factual question of whether the researcher has sufficient control over their work under the agreement. Apple would almost certainly win the suit, but I think there's reasonable odds the suit would survive an early motion to dismiss before factual discovery.
• ghshephard 6y ago
  I read the terms of the SRD [1] to suggest if you get one, and use it, you aren't eligible for bounties on any bugs you find while using it. So, you are an entirely unpaid Apple QA engineer. Knowledge is its own reward I guess. [1] "If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple and, if the bug is in third-party code, to the appropriate third party. If you didn’t use the SRD for any aspect of your work with a vulnerability, Apple strongly encourages (and rewards, through the Apple Security Bounty) that you report the vulnerability, but you are not required to do so."
  • xondono 6y ago
    It doesn’t suggest that you aren’t eligible for bounties, but rather that you are not allowed to not disclose a vulnerability.
    • usmannk 6y ago
      It certainly suggests this. Full bullet: If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple and, if the bug is in third-party code, to the appropriate third party. If you didn’t use the SRD for any aspect of your work with a vulnerability, Apple strongly encourages (and rewards, through the Apple Security Bounty) that you report the vulnerability, but you are not required to do so.
      • xondono 6y ago
        Maybe it’s me but what I read in that paragraph is: If you use the SRD, you are required to report any vulnerability. If you didn’t, you are not required but encouraged. It doesn’t say if you used it you aren’t eligible for reward
    • wdb 6y ago
      It's probably hard to resist to use this SRD while trying to find a vulnerability if you have it such a device. If you use it for something you won't be eligible for the bounty.
  • vngzs 6y ago
    The (and rewards) bit isn't saying that SRD users are ineligible for rewards! Rather, it's trying to encourage non-SRD users to report vulnerabilities they find. If Apple explicitly stated that SRD users are ineligible for bounties, I'd be pretty confident Apple has lost their minds, as the SRD devices would be completely worthless to vulnerability researchers - only serving to contractually restrict them, and offering no practical benefit. To show that "you aren't eligible for bounties on any bugs you find while using it" is false, let's break Apple's quote into two separate statements, and only consider things that are explicitly stated in them. First: > If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple and, if the bug is in third-party code, to the appropriate third party. If you use SRD in the process of discovering a vulnerability, you have to disclose it to the software authors. Got it. Second: > If you didn’t use the SRD for any aspect of your work with a vulnerability, Apple strongly encourages (and rewards, through the Apple Security Bounty) that you report the vulnerability, but you are not required to do so." If you don't use SRD, Apple strongly encourages you to report the vulnerability. But they have no way to force it. I understand how a casual interpretation of those quotes could be seen to imply that SRD excludes you from bounties, but that's not what Apple is saying.
  • avianlyric 6y ago
    Read a little further, the last bullet says > Vulnerabilities found with an SRD are automatically considered for reward through the Apple Security Bounty. I would say that pretty explicit about being eligible for bounties.
    • saagarjha 6y ago
      (That bullet point did not exist before.)
      • deleted 6y ago
        [deleted]
• tptacek 6y ago
  To whatever extent these devices are distributed, my guess is that they land predominantly in the hands of consultancies and security product firms, where the bulk of bread-and-butter security research is done. Those firms will all have their legal vet the actual contract (which this page is not). And, of course, that's the case with Corellium as well; it's not like Hopper or Binja, a tool that random people just buy to kick the tires on. The front page of Corellium's site is a "contact sales" mailto; the term of art we use for that pricing plan is "if you have to ask...".
• donarb 6y ago
  > They are only doing this now because ... Apple announced these devices last year at Black Hat.
  • saagarjha 6y ago
    Right before they promptly sued Corellium.
    • donarb 6y ago
      But after Corellium had shown their product to Apple and tried to get Apple to buy them. Apple did nothing until Corellium started selling access to the public with their product.
      • saagarjha 6y ago
        Apple did nothing for years after Corellium sold their product to the public, coincidentally they did file the lawsuit right after announcing that they would do “research-fused devices”. Surprise, surprise: guess what shows up at the top of the lawsuit as the “legal” way for researchers to do their work…