5 ms·

I like this idea. 1. Company verifies the bug 2. Assigns it a price according to impact 3. Keeps details hidden until Apple pays them, then reveals the bug.

I like this idea. 1. Company verifies the bug 2. Assigns it a price according to impact 3. Keeps details hidden until Apple pays them, then reveals the bug. Thus Apple is forced to pay, but bad actors dont get access. Different bug markets can compete to correctly price bugs.

saagarjha 6y ago
Who does the verification?
- adolph 6y ago
  NSA front company probably. They will do it for free so they can front-run the zero days.
- GoblinSlayer 6y ago
  Apple's own subdivision :) An alternative is public offer when Apple promises to not release a fix without payment. If it's not a bug, no need for a fix.
jonny_eh 6y ago
That may be considered black-mail by some courts.
- Itsdijital 6y ago
  I guess that's true. Whats the end state if Apple refuses to pay?
  - eyelidlessness 6y ago
    “It would be a shame if someone used this vulnerability”
  - albntomat0 6y ago
    Then Apple gets a reputation for refusing to pay, less folks look for and responsibly disclose vulns in Apple products, and their security posture as as whole suffers.
- ClumsyPilot 6y ago
  I dont think apple is entitled to that information on any basis, and i dont think its a legitimate threat to expose actual ill behaviour
  - young_unixer 6y ago
    I think they're talking about the implication that if Apple don't pay, then the vulnerability is published. I agree with you on a moral basis: what difference does it make if I get payed not to publish it vs. If I just publish it without even asking to get paid. But I'm not sure the law would agree with us.
    - ClumsyPilot 6y ago
      I think, like in many legal matters, precedent and intent is key. Without ill intent there is no 'mens rea', or "guilty mind". In this case you aren't just a vigilante targetting apple, there is established practice stretching decades. There is also a duty on you as a security proffeshional, and there is a significant public interest in knowing about the vulnerability. So , most likely, it will be you doing your job.
  - mdpopescu 6y ago
    All blackmail involves exposing something that someone doesn't want exposed - usually because the "something" is illegal. And yet, blackmail itself is illegal. Most countries have a culture against whistleblowers, starting from childhood ("don't be a tattletale", "don't be a rat").
    - ClumsyPilot 6y ago
      And that anti-whistleblower culture enables fraud like theranos to be undiscovered for years
- lovelyviking 6y ago
  Can you explain it more? What can make it a black-mail and why? If there is no intent to abuse the bug when not paied then there is no additional threat there from simply notifying the company that some threat is already present. How it can become a black-mail? So every report about discovered bug can be considered as black-mail? If one discovers a bug, reports it to the company and says that after 3 months it will be public it's a black-mail too? Or the payment request makes it different? And if person doesn't threat to publish the bug then it's ok?
  - IncRnd 6y ago
    Definition: Blackmail involves a threat to do something that would cause a person to suffer embarrassment or financial loss, unless that person meets certain demands. [0] [0] https://www.justia.com/criminal/offenses/white-collar-crimes/blackmail https://www.justia.com/criminal/offenses/white-collar-crimes...
  - fouc 6y ago
    The longer a bug goes without being reported, the greater the potential impact. So not reporting a bug could be considered a form of abusing the bug. There's probably a moral obligation to report bugs promptly. Bug bounty programs that companies have are ultimately a reward for being a nice person, as opposed to being a payment for services rendered.
  - fractionalhare 6y ago
    Yes, it's the payment request.
- asdfasgasdgasdg 6y ago
  It's only blackmail if the threat is to do something you are not otherwise legally allowed to do. It is legal to, say, announce a zero-day on Twitter. Or to sell the zero-day to the NSA, or some grey hat broker like Zerodium.
  - j4yav 6y ago
    In the US at least I don’t believe the act has to be illegal.
  - treis 6y ago
    No it's not. Pay me $10,000 or I tell everyone you slept with your secretary is blackmail.
    - asdfasgasdgasdg 6y ago
      Ok, you got me. But there must be more to the definition of blackmail than simply, pay me or else. If that were the definition, then everyone would be a blackmailer by virtue of "pay me for this or else I'll sell it to someone else," which is a "threat" we all implicitly make every day.
- downandout 6y ago
  In the US, blackmail has a very specific meaning: it is a threat to inform law enforcement of a violation of federal law under demand of a thing of value. This would actually be extortion, which is defined in 18 USC 875(d): Whoever, with intent to extort from any person, firm, association, or corporation, any money or other thing of value, transmits in interstate or foreign commerce any communication containing any threat to injure the property or reputation of the addressee or of another or the reputation of a deceased person or any threat to accuse the addressee or any other person of a crime, shall be fined under this title or imprisoned not more than two years, or both. https://uscode.house.gov/view.xhtml?path=/prelim@title18/part1/chapter41&edition=prelim https://uscode.house.gov/view.xhtml?path=/prelim@title18/par...
cortesoft 6y ago
How would price discovery work to "correctly price bugs" What is a bugs correct price? The price that a bad actor would pay for it?
- eyelidlessness 6y ago
  Some value between the cost of not fixing it and the value of exploiting it
- llarsson 6y ago
  We have CVSS scores for grading vulnerabilities. So that could be useful as a start.
  - saagarjha 6y ago
    CVSS is pretty useless for categorizing severity.
deleted 6y ago
[deleted]
twox2 6y ago
Bug bounty doesn't mean that the reporter is selling the bug they find for a reward. It's a gesture of gratitude from the company. This whole conversation is coming from a place of entitlement.
- albntomat0 6y ago
  Here's an alternative view: - Apple is a $2T company, that we trust with our data. That valuation is in part based on that trust. It's entitled of Apple to produce a product that contains shitty exploitable symlink handling and continue to have no meaningful repercussions (which is true in the industry as a whole). If this was a bug in a small, under-resourced FOSS email client, or the exploit required many highly skilled person-years to find, maybe I'd feel differently.
  - twox2 6y ago
    Both of these points can be true.
fractionalhare 6y ago
In all likelihood, Apple would just refuse to play ball and tell them to go ahead and sell it to someone else if they're so confident. Zerodium and other markets already exist, and I don't think people at Apple lose much sleep over it. And you better hope you close that deal before Google Project Zero finds it independently and tells Apple for free. Plus the mere mention that a vulnerability exists in a specific piece of software may lead Apple engineers to finding and patching it before you can sell it. Give away too many details and it's burned. People tend to vastly overestimate the economic impact of an exploited security vulnerability. A vulnerability which can be patched in a centralized manner has a low value half-life: it rapidly decreases in value over time. I would guess over 90% of active daily users of macOS already have the patch for this bug due to automatic updates. New buyers are essentially guaranteed not to have the vulnerability at all. The vulnerability would have to be absolutely catastrophic to be worth something, and in that case it would probably be used for targeted exploitation and burned after a short period of time. Contrast with something like heartbleed, which is still around. That is a vulnerability with serious half-life and significant economic impact. The pool of available victims who can be exploited by heartbleed is nontrivial and persistent years later. Criminals will actually pay for something like that.

saagarjha 6y ago

Who does the verification?

adolph 6y ago
NSA front company probably. They will do it for free so they can front-run the zero days.
GoblinSlayer 6y ago
Apple's own subdivision :) An alternative is public offer when Apple promises to not release a fix without payment. If it's not a bug, no need for a fix.

jonny_eh 6y ago

That may be considered black-mail by some courts.

Itsdijital 6y ago
I guess that's true. Whats the end state if Apple refuses to pay?
- eyelidlessness 6y ago
  “It would be a shame if someone used this vulnerability”
- albntomat0 6y ago
  Then Apple gets a reputation for refusing to pay, less folks look for and responsibly disclose vulns in Apple products, and their security posture as as whole suffers.
ClumsyPilot 6y ago
I dont think apple is entitled to that information on any basis, and i dont think its a legitimate threat to expose actual ill behaviour
- young_unixer 6y ago
  I think they're talking about the implication that if Apple don't pay, then the vulnerability is published. I agree with you on a moral basis: what difference does it make if I get payed not to publish it vs. If I just publish it without even asking to get paid. But I'm not sure the law would agree with us.
  - ClumsyPilot 6y ago
    I think, like in many legal matters, precedent and intent is key. Without ill intent there is no 'mens rea', or "guilty mind". In this case you aren't just a vigilante targetting apple, there is established practice stretching decades. There is also a duty on you as a security proffeshional, and there is a significant public interest in knowing about the vulnerability. So , most likely, it will be you doing your job.
- mdpopescu 6y ago
  All blackmail involves exposing something that someone doesn't want exposed - usually because the "something" is illegal. And yet, blackmail itself is illegal. Most countries have a culture against whistleblowers, starting from childhood ("don't be a tattletale", "don't be a rat").
  - ClumsyPilot 6y ago
    And that anti-whistleblower culture enables fraud like theranos to be undiscovered for years
lovelyviking 6y ago
Can you explain it more? What can make it a black-mail and why? If there is no intent to abuse the bug when not paied then there is no additional threat there from simply notifying the company that some threat is already present. How it can become a black-mail? So every report about discovered bug can be considered as black-mail? If one discovers a bug, reports it to the company and says that after 3 months it will be public it's a black-mail too? Or the payment request makes it different? And if person doesn't threat to publish the bug then it's ok?
- IncRnd 6y ago
  Definition: Blackmail involves a threat to do something that would cause a person to suffer embarrassment or financial loss, unless that person meets certain demands. [0] [0] https://www.justia.com/criminal/offenses/white-collar-crimes/blackmail https://www.justia.com/criminal/offenses/white-collar-crimes...
- fouc 6y ago
  The longer a bug goes without being reported, the greater the potential impact. So not reporting a bug could be considered a form of abusing the bug. There's probably a moral obligation to report bugs promptly. Bug bounty programs that companies have are ultimately a reward for being a nice person, as opposed to being a payment for services rendered.
- fractionalhare 6y ago
  Yes, it's the payment request.
asdfasgasdgasdg 6y ago
It's only blackmail if the threat is to do something you are not otherwise legally allowed to do. It is legal to, say, announce a zero-day on Twitter. Or to sell the zero-day to the NSA, or some grey hat broker like Zerodium.
- j4yav 6y ago
  In the US at least I don’t believe the act has to be illegal.
- treis 6y ago
  No it's not. Pay me $10,000 or I tell everyone you slept with your secretary is blackmail.
  - asdfasgasdgasdg 6y ago
    Ok, you got me. But there must be more to the definition of blackmail than simply, pay me or else. If that were the definition, then everyone would be a blackmailer by virtue of "pay me for this or else I'll sell it to someone else," which is a "threat" we all implicitly make every day.
downandout 6y ago
In the US, blackmail has a very specific meaning: it is a threat to inform law enforcement of a violation of federal law under demand of a thing of value. This would actually be extortion, which is defined in 18 USC 875(d): Whoever, with intent to extort from any person, firm, association, or corporation, any money or other thing of value, transmits in interstate or foreign commerce any communication containing any threat to injure the property or reputation of the addressee or of another or the reputation of a deceased person or any threat to accuse the addressee or any other person of a crime, shall be fined under this title or imprisoned not more than two years, or both. https://uscode.house.gov/view.xhtml?path=/prelim@title18/part1/chapter41&edition=prelim https://uscode.house.gov/view.xhtml?path=/prelim@title18/par...

cortesoft 6y ago

How would price discovery work to "correctly price bugs" What is a bugs correct price? The price that a bad actor would pay for it?

eyelidlessness 6y ago
Some value between the cost of not fixing it and the value of exploiting it
llarsson 6y ago
We have CVSS scores for grading vulnerabilities. So that could be useful as a start.
- saagarjha 6y ago
  CVSS is pretty useless for categorizing severity.

deleted 6y ago

[deleted]

twox2 6y ago

Bug bounty doesn't mean that the reporter is selling the bug they find for a reward. It's a gesture of gratitude from the company. This whole conversation is coming from a place of entitlement.

albntomat0 6y ago
Here's an alternative view: - Apple is a $2T company, that we trust with our data. That valuation is in part based on that trust. It's entitled of Apple to produce a product that contains shitty exploitable symlink handling and continue to have no meaningful repercussions (which is true in the industry as a whole). If this was a bug in a small, under-resourced FOSS email client, or the exploit required many highly skilled person-years to find, maybe I'd feel differently.
- twox2 6y ago
  Both of these points can be true.

fractionalhare 6y ago

In all likelihood, Apple would just refuse to play ball and tell them to go ahead and sell it to someone else if they're so confident. Zerodium and other markets already exist, and I don't think people at Apple lose much sleep over it. And you better hope you close that deal before Google Project Zero finds it independently and tells Apple for free. Plus the mere mention that a vulnerability exists in a specific piece of software may lead Apple engineers to finding and patching it before you can sell it. Give away too many details and it's burned. People tend to vastly overestimate the economic impact of an exploited security vulnerability. A vulnerability which can be patched in a centralized manner has a low value half-life: it rapidly decreases in value over time. I would guess over 90% of active daily users of macOS already have the patch for this bug due to automatic updates. New buyers are essentially guaranteed not to have the vulnerability at all. The vulnerability would have to be absolutely catastrophic to be worth something, and in that case it would probably be used for targeted exploitation and burned after a short period of time. Contrast with something like heartbleed, which is still around. That is a vulnerability with serious half-life and significant economic impact. The pool of available victims who can be exploited by heartbleed is nontrivial and persistent years later. Criminals will actually pay for something like that.