8 ms·
Apple only paid them $52k? Apple is a trillion dollar company. These hackers saved them easily millions of dollars in expenses. China or North Korea could easi
by iJohnDoe 6y ago
Apple only paid them $52k? Apple is a trillion dollar company. These hackers saved them easily millions of dollars in expenses.
China or North Korea could easily allocate a much larger team to something like this and disrupt Apple (not for bug bounties). Although, China and North Korea dedicate their resources to financial fraud where there is real money to be had.
Apple is a tightwad joke. If they laid out a scope of work for a professional pen testing company that included pen testing their 17.0.0.0/8 range then that contract would easily have been in the hundreds of thousands.
I’m sure foreign adversaries will take notice now. Apple’s cybersecurity posture has always been very weak. It’s known they don’t dedicated any resources to it.
- fishtoaster 6y agoFrom the article: "However, it appears that Apple does payments in batches and will likely pay for more of the issues in the following months."
- nunez 6y agoIf one bounty hunter got $100k for a single exploit, these guys should’ve gotten millions...
- dmlittle 6y agoNot to discredit the great work all these people did but not all exploits are created equally. Generally speaking the bug bounty amount is directly correlated to the blast radius of the exploit.
- JoblessWonder 6y agoBut that is the thing... their official Bug Bounty program scope didn't include most of these exploits so any payments/awards would have to be made outside of the traditional system and thus probably take more senior approval/time to make payments. They knew that they would possibly not get paid for them but took the risk anyways. I have a feeling they will end up getting at least a hundred thousand dollars total.
- Lammy 6y agoNot just saved Apple, but Apple users too. Wasn’t the “fappening” rooted in hacked iCloud accounts with weak credentials? Imagine what juicy political targets are out there using iPhones syncing with iCloud.
- danaris 6y agoiCloud wasn't cracked. They used social engineering to gain access to the accounts.
- hbosch 6y agoYou're right iCloud itself wasn't "cracked", per se, but the XSS exploit is (was) incredibly malicious and did not require any social engineering that I can see. https://samcurry.net/hacking-apple/#vuln3 https://samcurry.net/hacking-apple/#vuln3
- gowld 6y agoIs this linked exploit the same as the Fappening exploit?
- faceplanted 6y agoIt wasn't that, they did do password cracking, if I recall correctly iCloud itself had a limit on password attempts through the site but there was a way to attempt logins through the API that didn't have that limit which let them target those users for brute force attacks.
- wlesieutre 6y agoI think this was speculation at the time, but it later came out that they were phishing attacks which got access to iCloud accounts, and once you have that you have the person's device backups.
- intricatedetail 6y agoApple has a trillion because they found a way to exploit the gullible and greed. I am surprised they paid at all.
- JoblessWonder 6y agoLate reply: They just paid for 28 more issues, running total is now $288,500. https://twitter.com/samwcyo/status/1314310787243167744 https://twitter.com/samwcyo/status/1314310787243167744
- ogre_codes 6y ago$288k and Apple has only paid them for roughly half of the vulnerabilities. They expect the payout to exceed $500k. Well worth it for Apple and a decent payday for 3 months of spelunking.
- gowld 6y agoGross pay (not including employee benefits and before payroll tax deduction), split among a team of 5 people, unclear if they were working on this one project full time, and amortized over other months with less renumeration. It may not be better amortized pay than a regular software job.
- rewq4321 6y agoEspecially considering that the authors are some of the best bug bounty hunters in the world. $500 an hour is a fairly normal rate for a top security consultant, as far as I'm aware.
- iJohnDoe 6y agoAbsolutely wonderful news! Congrats to everyone involved. Kudos to Apple for following through. I hope this sets the standard for companies going forward.
- simonbarker87 6y agoApple are already behind the standard and times on this. Apple aren’t leading here, they are reluctantly catching up and doing the minimum they need.
- Yajirobe 6y agoHow is North Korea going to recruit top cybersecurity specialists?
- markdown 6y agoIt's a country of over 50 million people, all of whom are beholden to their government. They have all the top cybersecurity specialists they could ever need.
- michaelmrose 6y agoThe population of North Korea is only 25M and 43% of them are malnourished and only a small percentage have access to the internet. https://globalnews.ca/news/5029484/north-korea-malnutrition-food-insecurity-un/ https://globalnews.ca/news/5029484/north-korea-malnutrition-... Number of security researchers isn't a function of population size it is a function of population size * fraction with propensity to show requisite skill * fraction who go to work in the profession. Shockingly adding millions of more starving people who have never seen a computer doesn't get you many more cybersecurity specialists.
- ummonk 6y agoIt's also one of nine nuclear powers and one of ten to have developed space launch capability. It also scores near the top of the international math olympiad regularly. What makes you certain North Korea hasn't similarly invested in developing security researchers?
- michaelmrose 6y agoApples net income is bigger than their GDP and most of their people as impoverished, malnourished and poorly educated. The upper caste from which all their "talent" is drawn is a small fraction of its total population mostly composed of the descendants of the lower class peasants and workers who supported the rise of the current regime. They supported not an establishment of such a system but rather an inversion of the prior order. It's an impoverished field from which little of value grows. To be clear there is nothing inferior about North Koreans by nature it is that the regime wastes the value that it does get. Einsteins are in theory as apt to be born from the less privileged classes but there is only a 50 50 chance of getting enough food to be healthy let alone a chance at intellectual development.
- Aeolun 6y ago> China or North Korea could easily allocate a much larger team to something like this Chances are they already did, and are just sitting on the vulnerabilities.