5 ms·

I sorted exploits by date, it made a fun short headline summary of how productive they were. Short answer: very. I know it’s hard for senior management to want

I sorted exploits by date, it made a fun short headline summary of how productive they were. Short answer: very. I know it’s hard for senior management to want to really commit to bug bounty programs like this because it feels embarrassing and vulnerable, but posts like this should be sent around the boardroom when discussing — apple rented an AMAZING security team here. Sam, can you disclose what you got paid for all this?

CGamesPlay 6y ago
End of the post it says 51k so far. I'd expect the price to go up a LOT more, because otherwise the sane (monetary) advice becomes "report some vulnerabilities to apple, and then keep finding them and sell them to third parties".
- oarsinsync 6y ago
  That's only true if you have no way to be put in (financial) risk by the vulnerability you're not disclosing to Apple.
  - bogwog 6y ago
    If you're a security researcher, you probably know how to cover your tracks.
    - saagarjha 6y ago
      Yes, but the risk if you’re caught is huge.
      - stjohnswarts 6y ago
        not if you're selling them to -your- government. Then you're a patriot but also a rich patriot.
    - searchableguy 6y ago
      Where do security researchers sell their investigation on the black market? Links?
      - shmatt 6y ago
        any company that builds software for government tracking like NSO Group will happily pay, and have very deep pockets
      - nixgeek 6y ago
        Zerodium is probably the closest thing to a “legitimate” acquirer of exploits, those which aren’t being disclosed to the vendor and then fixed.
      - nbk_2000 6y ago
        The following companies buy 0-days. Each has a slightly different business model: Zerodium - http://zerodium.com/ http://zerodium.com/ Azimuth Security - https://www.azimuthsecurity.com/ https://www.azimuthsecurity.com/ NSO Group - https://www.nsogroup.com/ https://www.nsogroup.com/ ZDI - https://www.zerodayinitiative.com/ https://www.zerodayinitiative.com/ SSD - https://ssd-disclosure.com/ https://ssd-disclosure.com/
    - XMPPwocky 6y ago
      Do you? The skills involved in VR and exploit dev don't necessarily mean you're good at opsec.
      - nbk_2000 6y ago
        True, plus "opsec life sucks" so most of us don't do it.
- anonymousisme 6y ago
  There are defense contractors that do exactly this. Governments pay more than Apple will ever pay, so if you are in it for the money (and don't care about the ethical repercussions), selling the discovered exploits to governments is the way to go.
- JoblessWonder 6y ago
  Yeah, that is only for 4 vulnerabilities out of 55. And 3 of them were only "High." They still have 10 (!!) more critical vulnerabilities they may receive payment on. Also, they state in the article: "However, it appears that Apple does payments in batches and will likely pay for more of the issues in the following months."
  - JoblessWonder 6y ago
    Update: They just paid for 28 more issues, running total is now $288,500. https://twitter.com/samwcyo/status/1314310787243167744 https://twitter.com/samwcyo/status/1314310787243167744
- stjohnswarts 6y ago
  Yeah I imagine you can make a lot more money selling them to state actors than to apple.
ehsankia 6y ago
It seems like this cooperative approach was very effective. I assume rubber duck debugging and having multiple minds attacking the problem from from multiple directions greatly improves the efficiency.

CGamesPlay 6y ago

End of the post it says 51k so far. I'd expect the price to go up a LOT more, because otherwise the sane (monetary) advice becomes "report some vulnerabilities to apple, and then keep finding them and sell them to third parties".

oarsinsync 6y ago
That's only true if you have no way to be put in (financial) risk by the vulnerability you're not disclosing to Apple.
- bogwog 6y ago
  If you're a security researcher, you probably know how to cover your tracks.
  - saagarjha 6y ago
    Yes, but the risk if you’re caught is huge.
    - stjohnswarts 6y ago
      not if you're selling them to -your- government. Then you're a patriot but also a rich patriot.
  - searchableguy 6y ago
    Where do security researchers sell their investigation on the black market? Links?
    - shmatt 6y ago
      any company that builds software for government tracking like NSO Group will happily pay, and have very deep pockets
    - nixgeek 6y ago
      Zerodium is probably the closest thing to a “legitimate” acquirer of exploits, those which aren’t being disclosed to the vendor and then fixed.
    - nbk_2000 6y ago
      The following companies buy 0-days. Each has a slightly different business model: Zerodium - http://zerodium.com/ http://zerodium.com/ Azimuth Security - https://www.azimuthsecurity.com/ https://www.azimuthsecurity.com/ NSO Group - https://www.nsogroup.com/ https://www.nsogroup.com/ ZDI - https://www.zerodayinitiative.com/ https://www.zerodayinitiative.com/ SSD - https://ssd-disclosure.com/ https://ssd-disclosure.com/
  - XMPPwocky 6y ago
    Do you? The skills involved in VR and exploit dev don't necessarily mean you're good at opsec.
    - nbk_2000 6y ago
      True, plus "opsec life sucks" so most of us don't do it.
anonymousisme 6y ago
There are defense contractors that do exactly this. Governments pay more than Apple will ever pay, so if you are in it for the money (and don't care about the ethical repercussions), selling the discovered exploits to governments is the way to go.
JoblessWonder 6y ago
Yeah, that is only for 4 vulnerabilities out of 55. And 3 of them were only "High." They still have 10 (!!) more critical vulnerabilities they may receive payment on. Also, they state in the article: "However, it appears that Apple does payments in batches and will likely pay for more of the issues in the following months."
- JoblessWonder 6y ago
  Update: They just paid for 28 more issues, running total is now $288,500. https://twitter.com/samwcyo/status/1314310787243167744 https://twitter.com/samwcyo/status/1314310787243167744
stjohnswarts 6y ago
Yeah I imagine you can make a lot more money selling them to state actors than to apple.

ehsankia 6y ago

It seems like this cooperative approach was very effective. I assume rubber duck debugging and having multiple minds attacking the problem from from multiple directions greatly improves the efficiency.