5 ms·

I'm a different security guy from the one above. I have a root exploit in macOS that Apple has refused to discuss with me for half a year. I told them it affect

I'm a different security guy from the one above. I have a root exploit in macOS that Apple has refused to discuss with me for half a year. I told them it affected Big Sur (even since the betas) and they were unfazed. I have reached out to everyone I know at Apple to schedule a demo or even a phone call and they've been met with silence from their product security team. How is that for some perspective on Apple's security?

edoceo 6y ago
Publish your research
- netsec_burn 6y ago
  Can't do it if there is no way to keep my lights on and food on my table.
zepto 6y ago
Apple routinely interacts with security researchers, and pays bug bounties. It sounds like you haven’t told them any technical details about the exploit, at all. If this is the case, then they have no way to tell you apart from a timewaster or scammer. If all you have done is tell them you have an exploit and tried to schedule a meeting, it’s unlikely they’ll take you seriously.
- netsec_burn 6y ago
  In fact, I have given them technical details as to what the capabilities are and the affected macOS versions. I refuse to submit all of my research without them telling me roughly what the bounty ranges are for the vulnerabilities in the same class/equivalent impact. I've done many bounty programs in the past. Companies will always choose to pay nothing or close to nothing when it is favorable to them. Apple refuses to share what the bounty ranges are given technical information about it, and asked me to submit the entirety of my research without having any idea of what the compensation may be. So they made it impossible for me and perhaps many others to help improve the security of their OS ethically. For every 1 company that pays you in bug bounties, 10 don't. If you're a security researcher, you can't afford the possibility of getting nothing for months of research.
  - easton 6y ago
    https://developer.apple.com/security-bounty/payouts/ https://developer.apple.com/security-bounty/payouts/ It's somewhere between $5,000 and these numbers (as $5,000 is the minimum).
    - netsec_burn 6y ago
      $5,000 is the minimum for all categories. I have been unsuccessful at confirming with Apple that a local privilege escalation (LPE) to root is in any one of those categories, even though it's a widely understood type of vulnerability. So I've been trying to get their response on a category or at least have some frame of reference so I can have a reasonable expectation of what the ranges are. That is what Apple will not provide.
  - zepto 6y ago
    > For every 1 company that pays you in bug bounties, 10 don't. Do you have reason to believe that Apple doesn’t pay, or are you basing this on other companies behavior?
    - netsec_burn 6y ago
      A bit of both. I've read some articles about Apple's bounty program from people who were less than thrilled with it, and Apple went back and revised the bounty payouts when it ended up being bad PR/in the news. In the bug bounty programs I've done, I found nothing but P1 vulnerabilities (LPE, RCE, SQLi, LFI). The payouts have always been far below minimum wage, which gave me perspective on how much I could have made working in fast food instead. I have no reason to believe Apple will be more fair to researchers based on their track record, and their unwillingness to talk about it doesn't inspire any confidence.
      - zepto 6y ago
        Seems like an interesting dilemma for both you an Apple. I’m sure they get a bunch of bullshit and scams from people trying to sell them exploits, so the distrust is mutual. This does represent a trust issue in the industry, but I don’t see how it demonstrates that they ‘Don’t care about security’.
fortran77 6y ago
One of the oddest things about Apple's reaction is they come to Hacker News and try to bury people talking about real problems that real users see.
- zepto 6y ago
  “Apple's reaction is they come to Hacker News and try to bury people talking about real problems that real users see.” The seems like bullshit but to me. Also claiming people are shills is against HN guidelines.

edoceo 6y ago

Publish your research

netsec_burn 6y ago
Can't do it if there is no way to keep my lights on and food on my table.

zepto 6y ago

Apple routinely interacts with security researchers, and pays bug bounties. It sounds like you haven’t told them any technical details about the exploit, at all. If this is the case, then they have no way to tell you apart from a timewaster or scammer. If all you have done is tell them you have an exploit and tried to schedule a meeting, it’s unlikely they’ll take you seriously.

netsec_burn 6y ago
In fact, I have given them technical details as to what the capabilities are and the affected macOS versions. I refuse to submit all of my research without them telling me roughly what the bounty ranges are for the vulnerabilities in the same class/equivalent impact. I've done many bounty programs in the past. Companies will always choose to pay nothing or close to nothing when it is favorable to them. Apple refuses to share what the bounty ranges are given technical information about it, and asked me to submit the entirety of my research without having any idea of what the compensation may be. So they made it impossible for me and perhaps many others to help improve the security of their OS ethically. For every 1 company that pays you in bug bounties, 10 don't. If you're a security researcher, you can't afford the possibility of getting nothing for months of research.
- easton 6y ago
  https://developer.apple.com/security-bounty/payouts/ https://developer.apple.com/security-bounty/payouts/ It's somewhere between $5,000 and these numbers (as $5,000 is the minimum).
  - netsec_burn 6y ago
    $5,000 is the minimum for all categories. I have been unsuccessful at confirming with Apple that a local privilege escalation (LPE) to root is in any one of those categories, even though it's a widely understood type of vulnerability. So I've been trying to get their response on a category or at least have some frame of reference so I can have a reasonable expectation of what the ranges are. That is what Apple will not provide.
- zepto 6y ago
  > For every 1 company that pays you in bug bounties, 10 don't. Do you have reason to believe that Apple doesn’t pay, or are you basing this on other companies behavior?
  - netsec_burn 6y ago
    A bit of both. I've read some articles about Apple's bounty program from people who were less than thrilled with it, and Apple went back and revised the bounty payouts when it ended up being bad PR/in the news. In the bug bounty programs I've done, I found nothing but P1 vulnerabilities (LPE, RCE, SQLi, LFI). The payouts have always been far below minimum wage, which gave me perspective on how much I could have made working in fast food instead. I have no reason to believe Apple will be more fair to researchers based on their track record, and their unwillingness to talk about it doesn't inspire any confidence.
    - zepto 6y ago
      Seems like an interesting dilemma for both you an Apple. I’m sure they get a bunch of bullshit and scams from people trying to sell them exploits, so the distrust is mutual. This does represent a trust issue in the industry, but I don’t see how it demonstrates that they ‘Don’t care about security’.

fortran77 6y ago

One of the oddest things about Apple's reaction is they come to Hacker News and try to bury people talking about real problems that real users see.

zepto 6y ago
“Apple's reaction is they come to Hacker News and try to bury people talking about real problems that real users see.” The seems like bullshit but to me. Also claiming people are shills is against HN guidelines.