7 ms·

Yep, this lines up with my experience. I've been trying to work with Apple on a critical security vulnerability for over a year now that affects over 100 millio

Yep, this lines up with my experience. I've been trying to work with Apple on a critical security vulnerability for over a year now that affects over 100 million systems. When I'd ask the payout ranges at the beginning, I've had multiple people just block me as a contact and Apple themselves refuse to answer. Apple has a strict stance of submitting all of the research up front with no expectations as far as payment. Today, I've been ghosted by Apple, no reply to multiple emails. The last message I have is them saying they're fixing it. I chose the ethical route at a steep cost, the average price of the vulnerability from the other buyers I was talking to was 475K. There have been attempts to hack me 2 days after requesting a quote from some buyers. The most I can hope from Apple is 1/4th that. It really is the poorest communication out of any program I've done with the exception of AT&T's, who patched an RCE in their employee portal I reported (two months later) and then emailed me 6 months later saying there was no RCE. I've been told Apple is getting better with their communication over time, and now their average turnaround is 10 months.

jasonladuke0311 5y ago
Just curious - do you have an ethical stance against selling to ZDI/Zerodium?
- lolpython 5y ago
  OP edited their post to answer your question
- netsec_burn 5y ago
  ZDI, like Apple, doesn't tell you the average price of the vulnerabilities you can sell to them when you email them (yes, Apple has example payout ranges, but they aren't clear on classification). At Pwn2Own, ZDI paid roughly half of what Apple should pay. When you consider Apple themselves are 1/4th the market price, thereby making ZDI 1/8th, it becomes impossible to work to them. I raised my concerns with ZDI, no reply. I submitted some details (nothing technical, just the classification and affected platforms) of my vulnerability to Zerodium. Two days later someone tried to hack into all of my personal accounts and failed due to 2FA, and not many people have the email I used when I communicated with them. I've found other buyers outside the US, but I had ethical concerns and decided against them (at a 300K min loss).
  - petercooper 5y ago
    This isn't a judgment, by the way. I'm naive about this area and genuinely curious. I've found other buyers outside the US, but I had ethical concerns and decided against them (at a 300K min loss). What type of buyers exist who are unable to fix the vulnerability (in this case, who are not Apple or the affected vendor or do not collaborate with Apple, etc.) but might be considered ethical to sell to?
    - 0des 5y ago
      Come on, we both know the score here.. There is no ethical purchaser.
      - petercooper 5y ago
        That was my assumption, but my netsec knowledge could be written on a stamp, so who knows! ;-) I imagine some people think being rewarded for finding vulnerabilities is unethical entirely, but there seems to be a huge dose of pragmatism around the space.
    - netsec_burn 5y ago
      Answered here: https://news.ycombinator.com/item?id=27875883 https://news.ycombinator.com/item?id=27875883
      - petercooper 5y ago
        Thanks - that was helpful.
    - AlexAndScripts 5y ago
      Western intelligence agencies?
    - manquer 5y ago
      In theory a large corp netsec team may buy zero days vulnerabilites and then either disable the affected systems or engage directly with the vendor. Alternatively depending on how nationalistic someone feels NSA could be a eithical buyer for them as well.
concinds 5y ago
> There have been attempts to hack me 2 days after requesting a quote from some buyers How did you protect yourself against those? Also, as a security researcher, are there alternatives you'd recommend more? Would Linux/Windows be more secure?
- netsec_burn 5y ago
  TOTP two factor authentication protected me. They attacked my recovery email to go for my primary, at the time my recovery provider didn't offer 2FA. I think they may have social engineered the recovery with my SSN (it was a randomly generated password). Then they used the recovery provider to buy time by adding 2FA options, I began recovering within a minute. It was impressive how quickly they worked, they tried to compromise 5 other accounts in 3 minutes. Unfortunately for them, all of the accounts they targeted from that point on had 2FA, and they lost access in 15 minutes.
  - heavyset_go 5y ago
    If this happened to me, I'd send a tip to the FBI[1]. [1] https://tips.fbi.gov https://tips.fbi.gov
    - netsec_burn 5y ago
      Already done, with as much relevant information as I could compile. I hope they find who is attacking security researchers. If I had to guess, the motivation may be for the zerodays I have.
      - bawolff 5y ago
        Wait a minute... You tried to report to apple. You didn't like the way they "treated" you, so you decided to sell it on black market. The black market person tried to hack you. You then went to the fbi to complain about how your black market buyer treated you? Am i missing something from this story? That seems like a really bad plan.
bink 5y ago
I assume you didn't tell Apple that you were negotiating with other buyers? I think most bug bounty programs will cut off communications at that point. I've managed several programs for some very large companies and haggling over bounties with a researcher is a _really_ bad idea. You set your bounty amounts and stick to them. If people want to haggle over impact that's fine, but once you exceed your quoted bounty amount for one person then everyone expects it.
- netsec_burn 5y ago
  I looked for other buyers before Apple had a bug bounty program, not while talking with Apple. When I found an official way of submitting the vulnerability I cancelled my other negotiations (Apple is the correct channel and I wanted to see it fixed without exploitation). Regarding bounty amounts, I agree that they should clearly define the amounts for each factor of a complete exploit. That currently isn't done. The one thing everyone can give Zerodium credit for is being clear with their pricing, there's no ambiguity over whether you can keep your lights on by doing the research.
  - bink 5y ago
    That's good. It's unfortunate that the best signal most companies can use for whether their bounty amounts are sufficient is report volume and quality rather than a pro-active "here's what others are paying" or impact to customers. If they set bounties too high initially they'll get swamped with low-quality reports and that will slow response times for the good ones. The bean counters also play a big role. Most companies aren't ready for big bounty payouts when a program first starts. They set a fixed budget and are more likely to end a program completely if the bottom line cost is too high, regardless of the security impact. Security teams are aware of this and try to walk a fine line. For researchers who are having problems with programs I'd suggest trying to form a better relationship with the triage teams and security teams. Be helpful, not confrontational. Companies get their best bang-for-buck when they can court good researchers. They love getting quality researchers who report multiple findings and they'll do quite a lot to make them happy, including paying bonus bounties for future reports and being far more transparent with triage status.
ASalazarMX 5y ago
> Apple has a strict stance of submitting all of the research up front with no expectations as far as payment <Giant bold white letters fade in against a black background> A R R O G A N C E
- ryanmarsh 5y ago
  Serious question. If Apple won’t treat you in an ethical manner then why go the ethical route? Why not just sell the sploit to the highest bidder? Seems like there’s a misplaced and unreciprocated sense of integrity on the part of many researchers.
  - lucasyvas 5y ago
    I think this is a great question - In my opinion, carving the ethical path from the start can and should fulfill any moral obligation you might have. If they don't want to play ball, take it to someone that will appreciate your work. Should it be used nefariously, you are still helping because they might take you more seriously next time, as they should have in the first place. carrot versus stick.
  - saagarjha 5y ago
    One, just because someone else is being unethical doesn't mean you can drop your ethics. Two: you don't really want to expose users to the exploit.
    - paulryanrogers 5y ago
      Considering the half hearted and sluggish response of certain huge companies I can see why some researchers chose the middle path and publicly disclose immediately.
    - ryanmarsh 5y ago
      Sometimes the ethical thing to do is adversarial. It forces better behavior for short term pain. As far as exposing users, that makes assumptions about the actions of a number of people including the company in question which could, if it so desired, assemble the resources to push a fix within 48 hours.
not1ofU 5y ago
Maybe because their handelers are forbidding them to fix it until they are done with it... maybe I'm paranoid.

jasonladuke0311 5y ago

Just curious - do you have an ethical stance against selling to ZDI/Zerodium?

lolpython 5y ago
OP edited their post to answer your question
netsec_burn 5y ago
ZDI, like Apple, doesn't tell you the average price of the vulnerabilities you can sell to them when you email them (yes, Apple has example payout ranges, but they aren't clear on classification). At Pwn2Own, ZDI paid roughly half of what Apple should pay. When you consider Apple themselves are 1/4th the market price, thereby making ZDI 1/8th, it becomes impossible to work to them. I raised my concerns with ZDI, no reply. I submitted some details (nothing technical, just the classification and affected platforms) of my vulnerability to Zerodium. Two days later someone tried to hack into all of my personal accounts and failed due to 2FA, and not many people have the email I used when I communicated with them. I've found other buyers outside the US, but I had ethical concerns and decided against them (at a 300K min loss).
- petercooper 5y ago
  This isn't a judgment, by the way. I'm naive about this area and genuinely curious. I've found other buyers outside the US, but I had ethical concerns and decided against them (at a 300K min loss). What type of buyers exist who are unable to fix the vulnerability (in this case, who are not Apple or the affected vendor or do not collaborate with Apple, etc.) but might be considered ethical to sell to?
  - 0des 5y ago
    Come on, we both know the score here.. There is no ethical purchaser.
    - petercooper 5y ago
      That was my assumption, but my netsec knowledge could be written on a stamp, so who knows! ;-) I imagine some people think being rewarded for finding vulnerabilities is unethical entirely, but there seems to be a huge dose of pragmatism around the space.
  - netsec_burn 5y ago
    Answered here: https://news.ycombinator.com/item?id=27875883 https://news.ycombinator.com/item?id=27875883
    - petercooper 5y ago
      Thanks - that was helpful.
  - AlexAndScripts 5y ago
    Western intelligence agencies?
  - manquer 5y ago
    In theory a large corp netsec team may buy zero days vulnerabilites and then either disable the affected systems or engage directly with the vendor. Alternatively depending on how nationalistic someone feels NSA could be a eithical buyer for them as well.

concinds 5y ago

> There have been attempts to hack me 2 days after requesting a quote from some buyers How did you protect yourself against those? Also, as a security researcher, are there alternatives you'd recommend more? Would Linux/Windows be more secure?

netsec_burn 5y ago
TOTP two factor authentication protected me. They attacked my recovery email to go for my primary, at the time my recovery provider didn't offer 2FA. I think they may have social engineered the recovery with my SSN (it was a randomly generated password). Then they used the recovery provider to buy time by adding 2FA options, I began recovering within a minute. It was impressive how quickly they worked, they tried to compromise 5 other accounts in 3 minutes. Unfortunately for them, all of the accounts they targeted from that point on had 2FA, and they lost access in 15 minutes.
- heavyset_go 5y ago
  If this happened to me, I'd send a tip to the FBI[1]. [1] https://tips.fbi.gov https://tips.fbi.gov
  - netsec_burn 5y ago
    Already done, with as much relevant information as I could compile. I hope they find who is attacking security researchers. If I had to guess, the motivation may be for the zerodays I have.
    - bawolff 5y ago
      Wait a minute... You tried to report to apple. You didn't like the way they "treated" you, so you decided to sell it on black market. The black market person tried to hack you. You then went to the fbi to complain about how your black market buyer treated you? Am i missing something from this story? That seems like a really bad plan.

bink 5y ago

I assume you didn't tell Apple that you were negotiating with other buyers? I think most bug bounty programs will cut off communications at that point. I've managed several programs for some very large companies and haggling over bounties with a researcher is a _really_ bad idea. You set your bounty amounts and stick to them. If people want to haggle over impact that's fine, but once you exceed your quoted bounty amount for one person then everyone expects it.

netsec_burn 5y ago
I looked for other buyers before Apple had a bug bounty program, not while talking with Apple. When I found an official way of submitting the vulnerability I cancelled my other negotiations (Apple is the correct channel and I wanted to see it fixed without exploitation). Regarding bounty amounts, I agree that they should clearly define the amounts for each factor of a complete exploit. That currently isn't done. The one thing everyone can give Zerodium credit for is being clear with their pricing, there's no ambiguity over whether you can keep your lights on by doing the research.
- bink 5y ago
  That's good. It's unfortunate that the best signal most companies can use for whether their bounty amounts are sufficient is report volume and quality rather than a pro-active "here's what others are paying" or impact to customers. If they set bounties too high initially they'll get swamped with low-quality reports and that will slow response times for the good ones. The bean counters also play a big role. Most companies aren't ready for big bounty payouts when a program first starts. They set a fixed budget and are more likely to end a program completely if the bottom line cost is too high, regardless of the security impact. Security teams are aware of this and try to walk a fine line. For researchers who are having problems with programs I'd suggest trying to form a better relationship with the triage teams and security teams. Be helpful, not confrontational. Companies get their best bang-for-buck when they can court good researchers. They love getting quality researchers who report multiple findings and they'll do quite a lot to make them happy, including paying bonus bounties for future reports and being far more transparent with triage status.

ASalazarMX 5y ago

> Apple has a strict stance of submitting all of the research up front with no expectations as far as payment <Giant bold white letters fade in against a black background> A R R O G A N C E

ryanmarsh 5y ago
Serious question. If Apple won’t treat you in an ethical manner then why go the ethical route? Why not just sell the sploit to the highest bidder? Seems like there’s a misplaced and unreciprocated sense of integrity on the part of many researchers.
- lucasyvas 5y ago
  I think this is a great question - In my opinion, carving the ethical path from the start can and should fulfill any moral obligation you might have. If they don't want to play ball, take it to someone that will appreciate your work. Should it be used nefariously, you are still helping because they might take you more seriously next time, as they should have in the first place. carrot versus stick.
- saagarjha 5y ago
  One, just because someone else is being unethical doesn't mean you can drop your ethics. Two: you don't really want to expose users to the exploit.
  - paulryanrogers 5y ago
    Considering the half hearted and sluggish response of certain huge companies I can see why some researchers chose the middle path and publicly disclose immediately.
  - ryanmarsh 5y ago
    Sometimes the ethical thing to do is adversarial. It forces better behavior for short term pain. As far as exposing users, that makes assumptions about the actions of a number of people including the company in question which could, if it so desired, assemble the resources to push a fix within 48 hours.

not1ofU 5y ago

Maybe because their handelers are forbidding them to fix it until they are done with it... maybe I'm paranoid.