6 ms·

Ok, remind me never to approach Apple directly if I happen to find a vulnerability. Zerodium (or a 3-letter agency) it is!

mhh__ 6y ago
> 3-letter agency From the wikipedia page for Meltdown: "On 8 May 1995, a paper called "The Intel 80x86 Processor Architecture: Pitfalls for Secure Systems" published at the 1995 IEEE Symposium on Security and Privacy warned against a covert timing channel in the CPU cache and translation lookaside buffer (TLB). This analysis was performed under the auspices of the National Security Agency's Trusted Products Evaluation Program (TPEP)." i.e. did they know even in 1995?
- vmladenov 6y ago
  My understanding is that people at the time were aware of potential problems but no vulnerability had been identified. I found some discussion here: https://security.stackexchange.com/a/177256 https://security.stackexchange.com/a/177256
- gumby 6y ago
  NSA used to have an active effort on information assurance, under the philosophy that it defended the country to have good civilian security (same reason for the NSA’s modification to the DES S-box). This unfortunately has fallen by the wayside. (NSA shortened the key as well so it wasn’t all bunnies and chocolate)
gruez 6y ago
Is this referencing the slow turnaround time, or the lack of a bounty paid so far? If it's the latter, I think it's already well known that bug bounties pay far less than the "market" value of such exploits.
- igammarays 6y ago
  > well known Well I didn't know, until now. I saw the bug bounty page at Apple before, was dazzled by the numbers, and didn't think twice about approaching them if I found a bug. Now after this article I know better than to trust them to pay.
sillysaurusx 6y ago
Zerodium is interesting. Apparently this bug would fetch "Up to $50k": https://zerodium.com/images/zerodium_prices.png https://zerodium.com/images/zerodium_prices.png Is there a way to verify whether Zerodium might be advertising large payouts (for attention) and then offering much smaller payouts for the actual bugs? It's pretty risky for Zerodium. There's nothing stopping a researcher from collecting a payout and then reporting the bug to the vendor.
- paulryanrogers 6y ago
  > There's nothing stopping a researcher from collecting a payout and then reporting the bug to the vendor. Wouldn't the payout contract prohibit reporting to anyone else?
  - sillysaurusx 6y ago
    What're they going to do if you break it? Sue? They might pay out over a long period of time for some guarantee that you'll play by their rules, though.
    - rfd4sgmk8u 6y ago
      There is a non-zero probability of not being alive any more. I don't think you understand the nature of that game.
  - hnick 6y ago
    I think so, but would Zerodium etc be able to prove it was the same person in each case? An independent researcher might have submitted the same issue to Apple coincidentally shortly after, presented in a slightly different way.
    - saagarjha 6y ago
      Contracts usually pay out on a schedule. If the bug gets patched then you don’t get paid.
vmception 6y ago
Yes, the current meaning of “responsible disclosure” is bullshit There should likely be a governing body that independently values an exploit and forces companies to pay Like how the SEC’s whistleblower program works Its completely broken to have corporations pinky promise not to sue you if you tell them and arbitrarily decide payouts if at all
mpd 6y ago
Oh yeah, for Apple, just throw it up on Twitter. and tbh, it's probably the same answer for most providers these days.
foodstances 6y ago
What's to stop someone from selling a vuln to Zerodium and then just reporting it to Apple shortly after? You get paid and Apple gets to fix it.
- sillysaurusx 6y ago
  Probably a payout over a long period of time. Lots of people would prefer a free $50k over the course of one year. (Just guessing though.)
  - rfd4sgmk8u 6y ago
    I would guess it would have a Non Disclosure Agreement attached, along with the mercenary reputation damage one take on by breaking the contract. One would not be let back in the club. Do you think it wise to break a contract (eg: steal from) a weapons dealer?

mhh__ 6y ago

> 3-letter agency From the wikipedia page for Meltdown: "On 8 May 1995, a paper called "The Intel 80x86 Processor Architecture: Pitfalls for Secure Systems" published at the 1995 IEEE Symposium on Security and Privacy warned against a covert timing channel in the CPU cache and translation lookaside buffer (TLB). This analysis was performed under the auspices of the National Security Agency's Trusted Products Evaluation Program (TPEP)." i.e. did they know even in 1995?

vmladenov 6y ago
My understanding is that people at the time were aware of potential problems but no vulnerability had been identified. I found some discussion here: https://security.stackexchange.com/a/177256 https://security.stackexchange.com/a/177256
gumby 6y ago
NSA used to have an active effort on information assurance, under the philosophy that it defended the country to have good civilian security (same reason for the NSA’s modification to the DES S-box). This unfortunately has fallen by the wayside. (NSA shortened the key as well so it wasn’t all bunnies and chocolate)

gruez 6y ago

Is this referencing the slow turnaround time, or the lack of a bounty paid so far? If it's the latter, I think it's already well known that bug bounties pay far less than the "market" value of such exploits.

igammarays 6y ago
> well known Well I didn't know, until now. I saw the bug bounty page at Apple before, was dazzled by the numbers, and didn't think twice about approaching them if I found a bug. Now after this article I know better than to trust them to pay.

sillysaurusx 6y ago

Zerodium is interesting. Apparently this bug would fetch "Up to $50k": https://zerodium.com/images/zerodium_prices.png https://zerodium.com/images/zerodium_prices.png Is there a way to verify whether Zerodium might be advertising large payouts (for attention) and then offering much smaller payouts for the actual bugs? It's pretty risky for Zerodium. There's nothing stopping a researcher from collecting a payout and then reporting the bug to the vendor.

paulryanrogers 6y ago
> There's nothing stopping a researcher from collecting a payout and then reporting the bug to the vendor. Wouldn't the payout contract prohibit reporting to anyone else?
- sillysaurusx 6y ago
  What're they going to do if you break it? Sue? They might pay out over a long period of time for some guarantee that you'll play by their rules, though.
  - rfd4sgmk8u 6y ago
    There is a non-zero probability of not being alive any more. I don't think you understand the nature of that game.
- hnick 6y ago
  I think so, but would Zerodium etc be able to prove it was the same person in each case? An independent researcher might have submitted the same issue to Apple coincidentally shortly after, presented in a slightly different way.
  - saagarjha 6y ago
    Contracts usually pay out on a schedule. If the bug gets patched then you don’t get paid.

vmception 6y ago

Yes, the current meaning of “responsible disclosure” is bullshit There should likely be a governing body that independently values an exploit and forces companies to pay Like how the SEC’s whistleblower program works Its completely broken to have corporations pinky promise not to sue you if you tell them and arbitrarily decide payouts if at all

mpd 6y ago

Oh yeah, for Apple, just throw it up on Twitter. and tbh, it's probably the same answer for most providers these days.

foodstances 6y ago

What's to stop someone from selling a vuln to Zerodium and then just reporting it to Apple shortly after? You get paid and Apple gets to fix it.

sillysaurusx 6y ago
Probably a payout over a long period of time. Lots of people would prefer a free $50k over the course of one year. (Just guessing though.)
- rfd4sgmk8u 6y ago
  I would guess it would have a Non Disclosure Agreement attached, along with the mercenary reputation damage one take on by breaking the contract. One would not be let back in the club. Do you think it wise to break a contract (eg: steal from) a weapons dealer?