6 ms·
For all those people who are complaining that Apple is taking its time paying out a bounty, and suggesting Zerodium: The end result of selling 0-click RCE vect
by rfd4sgmk8u 6y ago
For all those people who are complaining that Apple is taking its time paying out a bounty, and suggesting Zerodium:
The end result of selling 0-click RCE vectors like this to brokers is sliced up bodies in embassies. Do folks think where the money coming from, and who would pay? No, its an 'easy' pay day.
Some of us fix security bugs to keep people safe.
Some of us try to earn an honest living doing so.
Others try to earn a dishonest living with pain and death in their wake.
Are you using your skills to improve life on this rock, or are you trying to make it worse for a pay day?
- distribot 6y agoI agree with and appreciate your position. I'm more annoyed with Apple than with the security researchers. Apple is preying on your desire to do good. They could easily afford to pay a reasonable amount and promptly.
- whimsicalism 6y agoI don't see how selling to zerodium is more morally bankrupt than working for defense contractors, which plenty of tech people do.
- rfd4sgmk8u 6y agoThe output of the defense industry is used to hurt civilians less frequently. But I'm not here to excuse either.
- whimsicalism 6y ago> defense industry is used to hurt civilians less frequently ... based on?
- person_of_color 6y agoUm, how does that gel with thousands of engineers who work for FB?
- btheshoe 6y agois there any reason to not just sell to zerodium and then report to apple afterwards?
- jagger27 6y agoFrom Zerodium’s FAQ: “By signing the agreement, you will accept an exclusive sale of your research to ZERODIUM and transfer all related intellectual property rights to us, meaning that the research becomes the exclusive property of ZERODIUM and you are not allowed to re-sell, share, publish, or report the research to any other person or entity.”
- 2OEH8eoCRo0 6y agoHow would they enforce that? Even if Apple patches it Zerodium would have to sue Apple to find out.
- PeterisP 6y agoMoney in escrow, paid out in multiple installments if certain conditions are met e.g. the bug does not become public until a certain date.
- sillysaurusx 6y agoNice morals. In reality, people often take their morals with a side of cash. Let's turn it around. In Russia, the average salary is around $600 per year. Would you turn down a $50k payout? That's 83 years of an average salary. Consider that you may be in a privileged position if you can say no to that kind of money. The solution to this is for vendors to match what the market is paying. If an RCE is worth $50k on Zerodium, perhaps it's worth something similar to Apple not to have headlines about so-and-so exploit being used for cutting up bodies in an embassy. EDIT: Oops. Divide 83 by 12. But you'll find it hard to locate someone willing to say no to 7 years of salary for ~zero additional work.
- cozzyd 6y ago$600 / month is the average salary per month (according to probably the same Google search you did). Presumably someone reporting security vulnerabilities makes well more than the average.
- sillysaurusx 6y agoOof. It's what I get for groggily typing something. 7 years of salary is a lifechanging amount of money too, but I admit the thrust of the argument isn't quite as strong with a basic error. :) A better comment is probably "We've tried the alternative, and it doesn't seem to work. It's better to pay market rate."
- tgsovlerkhgsel 6y agoThat said... if someone pays me one or multiple annual salaries for something perfectly legal that's slightly morally questionable and indirectly linked to nasty things... I wish I could confidently say I'd say no, but I'm making no guarantees.
- pcthrowaway 6y agoCan you be a bit more clear on what you're implying? Genuinely curious. I thought Zerodium was selling to government agencies.. so I'm not sure what you mean by sliced up bodies in embassies. Perhaps I'm just not thinking creatively/pessimistically enough.
- Hnrobert42 6y agoThe sliced up bodies seems like a reference to Jamil Khashoggi. [1] I am not sure why GP links Khashoggi’s death to Zerodium. 1- https://en.m.wikipedia.org/wiki/Jamal_Khashoggi https://en.m.wikipedia.org/wiki/Jamal_Khashoggi
- pcthrowaway 6y agoVery confusing; A Saudi national was assassinated in the Saudi embassy by agents of the Saudi government. Linking this to Zerodium makes Zero sense. You don't need to do any digging to find out when someone is at your doorstep
- iudqnolq 6y agoWrong. They used tools by the Israeli NSO group to track him. https://edition.cnn.com/2019/01/12/middleeast/khashoggi-phone-malware-intl/index.html https://edition.cnn.com/2019/01/12/middleeast/khashoggi-phon...
- Tepix 6y agoThe Saudi's secret service is infamous for hacking dissidents' phones.
- iudqnolq 6y agoNot Zerodium, but there's some evidence a different hacking for hire group helped them track him https://edition.cnn.com/2019/01/12/middleeast/khashoggi-phone-malware-intl/index.html https://edition.cnn.com/2019/01/12/middleeast/khashoggi-phon...
- albntomat0 6y agoI think the real alternative here is that fewer folks will spend time looking at Apple products or not fully investigating weird behavior encountered normally that could be a security issue. The author specifically said that they were looking based on bug bounty guidelines. The next person in the same shoes will look at some other company's products instead.