20 ms·

Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

600 points by DemiGuru 5y ago

post_break 5y ago
What a slap in the face. This guy is owed a boatload of cash, and typical Apple just kicks the can down the road. Next time I hope he sells his next vuln to the highest bidder.
- gjs278 5y ago
  there is no next highest bidder, you live in a cyberpunk fantasy land
- ambientenv 5y ago
  > Next time I hope he sells his next vuln to the highest bidder And thereby accomplishing what, exactly? There is still merit, albeit not from a material wealth standpoint, for doing the right thing for the right reasons.
  - vadfa 5y ago
    >And thereby accomplishing what, exactly? ...$$$$?
    - basisword 5y ago
      I could accomplish the same thing by robbing a bank - doesn’t make it the right thing to do.
      - spicybright 5y ago
        Doesn't make free work for a for trillion dollar corporation something noble to do. By that logic, a grocery store giving away everything for free is the right thing to do. Doesn't lead to anything sustainable though.
        dpkonofa 5y ago
        What suggests that any of this is "free work for a trillion dollar corporation"? Apple hasn't acknowledged that this person discovered this bug yet. They've only acknowledged that it existed and that they were going to patch it in the future. Crediting someone for a bug bounty isn't as easy as you all are making it out to be.
      - akomtu 5y ago
        Unless it's a mafia's bank.
        justshowpost 5y ago
        You're also either a victim or an oppressor. No wrong can be done by anyone in the former group, and no good by the latter. Such ideas of victimization do nothing but justify the use of power and engender intergroup conflict.
      - young_unixer 5y ago
        Robbing a bank is immoral, selling information about how a piece of software works, in my humble opinion, is not. Or if it is, then it's not even close to the level of "wrong" that is robbing a bank.
        mrtesthah 5y ago
        And what if that information gets weaponized against journalists in an authoritarian regime?
        ClumsyPilot 5y ago
        You know what gets weaponised? Actual weapons our government sold to Saudi and other's.
        true_religion 5y ago
        Also the software to subvert security on mobile devices, build firewalls on a national level, and inspect every internet packet for disloyal statements. All that is packaged and sold to our authoritarian allies with the full approval of the government the majority of people support. Selling a zero day would probably fall under a weapons clause.
        mrtesthah 5y ago
        One of these things doesn't negate or excuse the other; both can happen at the same time. You're engaging in "whataboutism".
        ClumsyPilot 5y ago
        If you sell a knife, and it's used for a stabbing, are you culpable? Thousands of people buy knives every day, and most of them don't stab anyone. So unless there was good reason to suspect something, we would say no. Most zerodays are probably not bought by china to spy on dissidents, they are more like knives. On the contrary, when we sell bombs to Saudis we can be 95% sure they will be used in Yemen.
    - Bud 5y ago
      Except that as this thread demonstrates, there is no realistic possibility of this researcher actually making more $$$ in real life by trying to find another bidder.
      - smoldesu 5y ago
        Zerodium pays more for the exploits, and unlike Apple, is willing to compensate you in non-traceable currency.
        dpkonofa 5y ago
        Not for this exploit. They pay more for code-execution exploits. No one is going to pay the sums you guys are thinking they will over a bug that gives you someone's GameCenter contacts. It's not a trivial bug but it's also not a very valuable one.
  - AustinDev 5y ago
    Trillion dollar companies don't care about merit for doing the right thing. Why should this guy in the future?
    - pcbro141 5y ago
      Maybe he doesn't want dissident journalists and activists to get spied on and chopped to pieces? That sounds like a good enough reason to report these bugs for someone with morals.
      - lern_too_spel 5y ago
        Dissident journalists and activists can use devices from vendors that care about security enough to run a working bug bounty program.
        rurp 5y ago
        Unfortunately exercising consumer choice works a lot better in a healthy free market than it does in one controlled by an oligopoly. I totally agree that people should try to avoid buying from companies that do immoral things, but it can be quite hard in a consolidated market.
  - aviraldg 5y ago
    Forcing Apple to do the right thing the next time.
  - celim307 5y ago
    I agree somewhat, the users which include me get caught in the crossfire if someone releases a zero day out in the wild, but I also think there needs to be a negative feedback to these tech giants that expect work for free. But in the grand scheme of things, does it even punish the tech giants? They have so many claws in a users life, and in the case of apple, your only other choice is google or a bunch of shady oems. At the end of the day the only people who pay for it are users themselves, their data is comprised and irreversibly out there
  - kbenson 5y ago
    You can rely on the vast majority of people to do the right thing when it's in their best interests. You can likely rely on a good majority of people to do the right thing when it isn't for or against their interests in any substantial way. I'm not sure the amount of people that will do the right thing when it's not in their best interests by some small but noticeable amount. I'm also not sure the amount of people that will do the right thing when it's vastly against their best interests, but it's bound to be far less that the prior group, and I suspect it's way below a majority. The point isn't that these people aren't doing the "right thing", it's that these programs are designed to align doing the right thing with the best interests of the researchers, so noting that we might get more results that are not in the best interests of society at large or the company in question if they don't hold up to what they agreed to is not only a valid observation, it's the likely outcome if we're to expect these programs exist for a reason. To put this in perspective, say you find a suitcase with a million dollars in it. You can turn it in, or you can keep it for yourself. If there's no real expectation you'll get anything if you turn it in, how does the reasoning go in your head? What if you know you'll get 10% for finding it and turning it in? What if you live in abject poverty? What if you have $60k worth of medical bills for a family member to pay off?
  - ClumsyPilot 5y ago
    "There is still merit, albeit not from a material wealth standpoint, for doing the right thing for the right reasons" There seems to be the strange wordview where ordinary joe must be morally impeccable but its corporate leadership can be as immoral as they come. Like the richer you are, the less rules you have to follow. Surelly it should be the other way round?
- afrcnc 5y ago
  No, he's not. Those are low-priority bugs and the only thing that made them stand out was the fact that he dropped them online without a patch. RCEs get priority in patching, and his priv esc issues were not as important.
  - r00fus 5y ago
    He dropped them online after a significant period of delay. Already discussed here on HN. [1] [1] https://news.ycombinator.com/item?id=28637276 https://news.ycombinator.com/item?id=28637276
- tptacek 5y ago
  Who's the next highest bidder after Apple for a bug in `gamed` that allows you to access GameCenter and download contacts? It's a significant vulnerability, but there's e.g. no price list entry on Zerodium (you can take Zerodium more or less seriously, this is just a data point) for anything but code execution, which this vulnerability isn't.
  - saagarjha 5y ago
    Shady advertising SDK? (Also, don't people use code execution to exfiltrate contacts and messages? This is basically what this bug does, albeit with "several clicks" involved.)
  - WesolyKubeczek 5y ago
    > Who's the next highest bidder after Apple for a bug in `gamed` that allows you to access GameCenter and download contacts? Anyone who actually pays money or golden bars within a reasonable timeframe? > It's a significant vulnerability, but there's e.g. no price list entry on Zerodium On this scale I think it's "Contact us and we negotiate" sort of price.
    - tptacek 5y ago
      Who? Speculate as to who they might be. The six figure numbers you're familiar with are for code execution bugs. This is obviously not that. So they're not anybody that quotes prices for bugs, or anyone directly comparable to them. Governments can already pay prices comparable to the supposed bounty valuation of this bug for code execution. They're probably not shelling out six figures in gold bars for a bug that exfiltrates contact lists from apps that have to be installed from the app store. The non-bounty market clearing price for a lot of scary sounding vulnerabilities is $0.
      - renewiltord 5y ago
        Your comments are the only ones here which aren’t divorced from reality. It’s weird. Who are these supposed guys paying six figures for this sort of thing? It’s just not a valuable thing.
- bawolff 5y ago
  Can't we hope they go for full-disclosure instead of selling to the highest bidder? Selling to the highest bidder just hurts apple users not apple.
  - akira2501 5y ago
    > just hurts apple users not apple. As a first-order effect, sure.. but Apple is not immune to the damage that this causes either. More importantly, their failure to pay or honor their commitments would be the root cause of this in the future. They opened this "bug bounty" door on their own, they are solely responsible for it's success or failure.
    - bawolff 5y ago
      Sure there are secondary affects. However they are mild comparatively The two options: - someone full discloses a 0-day. Apple is embarrased, users can take mitigating action until its patched. Apple is probably forced to patch. End result: really embarasing for apple. Small risk to users that's pretty ephemeral. - sell to highest bidder. Black market or at best grey hat. Exploit is used against users. Nobody really knows its happening. Maybe that eventually comes back to give apple a bad reputation, but not likely to happen in the short term. One of these courses of action disproportionately hurts users a lot and apple not very much. The other hurts basically only apple and users very little. Even if you argue that the black market might eventually hurt apple a little bit, its still a very small hurt. If your goal is to piss off apple, it seems clear that full-disclosure is the thing to do here. If your goal is just to clear your concious on the morality of selling exploits to bad people who intend to use them to do bad things - while i'm sure you'd find a way to justify that no matter what apple did. The human mind is good at self-justification. > More importantly, their failure to pay or honor their commitments What commitment? A bug bounty program isn't a commitment to do anything. Its not a contract or a work agreement. At best its sort of like a contest. But even disregarding that, i'm not sure this bug even is in any of the categories they list. What they say is: iOS user installed app can access sensitive data including Contacts, Mail, Messages, Notes, Photos, or real-time or historical precise location data. i'm not sure this fits. Is apple being a dick? Yes. Are they breaking commitments they made? Not super clear.
- azinman2 5y ago
  So you’re hoping for malware?
- 0xdeadb00f 5y ago
  Sell it to the highest bidder then release it on the darknet for free anyways :^)
IndySun 5y ago
Apple the corporation religiously and sometimes aggressively portray themselves as virtuous, safe, and honest, but this behaviour suggests those qualities are marketing tools.
artful-hacker 5y ago
This is just one more nail in the already air-tight coffin Apple has built for themselves. I seriously don't understand why people stick with Apple products, they are getting much harder to use, they lock you in to their gimped ecosystem, and their hardware is constantly failing to be reliable.
- sneak 5y ago
  Ignore the software for a moment: nobody makes smartphones or tablets anywhere near the hardware quality of the iPhone or iPad Pro. Nobody.
- watermelon0 5y ago
  There is no better alternative (at least for some people)? Just some examples: - Integration between their devices cannot be matched by others - Apple Watch has the largest app collection, great integration between iOS and Watch apps, smooth animations/UX, the most accurate GPS of smart watches - Handover of AirPods between Apple devices is a lot better than with other Bluetooth headphones - (subjective) iOS has a lot better UX/animations than Android
  - kayodelycaon 5y ago
    The killer feature for me beyond Mac-only apps: Time Machine. Nothing matches it. I had some minor issues setting up my newly purchased M1 from an Intel backup, but it was quickly fixed when I updated the OS. Always, always, always use a directly connected external hard dive. The networked version is terrible.
- radlad 5y ago
  I'm so happy Linux is an option on the computer. When it comes to phones I feel stuck behind a rock and a hard place - choose iPhone, with poor Linux integration and threats to passively scan files on my phone and forward them to LEO? Sure, they have a decent record with security but these bug bounty reports haven't been great. Or choose Android, with its poor privacy record, a result of being built by an ad company that's already scanning my phone and mining it for data? edited to add - While I'd love to see a true competitor in this space (i.e. not based on Android - those projects don't seem to work out well as a result of being half-in/half-out of the ecosystem) I don't see how it's possible without the support of the large tech players - Facebook, Instagram, Snapchat, WhatsApp, Twitter, and Spotify at minimum, to say nothing of the long tail.
aborsy 5y ago
The need for Linux phones, in a market dominated by two companies and one government, is more than ever! Hope we soon get a usable Linux phone.
- reginold 5y ago
  PinePhone is our only hope! Still a ways off from being consumer ready but it's heading in the right direction.
  - Buttons840 5y ago
    "Only option"? What about Purism phones?
    - ben-schaaf 5y ago
      While they do seem to be shipping every so slowly they're still stuck on orders from the initial crowd funding campaign from 2018.
      - Buttons840 5y ago
        Ah. Good point. Still a name worth mentioning though; we need to each of the few companies in this space.
    - reginold 5y ago
      Yes! Another option -- however, Purism are pursuing two challenges at once, developing both the software and the hardware. Pinephone just focuses on hardware.
- beermonster 5y ago
  Such a market need grows daily. Hopefully only a matter of time.
- h0nd 5y ago
  Absolutely. I am fed up with so many dependencies due to or within my mobile phone
woliveirajr 5y ago
Seems that no credit, no bount, nothing, has become the way that Apple deals with the iBugs Hunters. And all it takes is one of those unsong heros giving up on reporting to Apple and, instead, reporting to some 0-day company, and some ransonware go brrrr
- dpkonofa 5y ago
  >Seems that no credit, no bount, nothing, has become the way that Apple deals with the iBugs Hunters. Based on what? You can't possibly know anything about this bug or what stage of the reporting process it's in and Apple regularly pays and credits people for reporting vulnerabilities and other exploits. This specific bug just isn't a high enough priority to elevate it to the level you're describing.
- croutonwagon 5y ago
  I'm surprised it hasnt happened yet. IT seems apple is possibly openly hostile and uses "red tape" as an excuse to obfuscate communication and frustrate those trying to do right by them instead of just posting it to github and calling them out on twitter. Its one of a few reasons I have made some in-roads into moving off the platform.
- _jal 5y ago
  I'm sure people are selling them, although I think it would only become public by accident. At least some are going the back to the Full Disclosure days... https://twitter.com/jonathandata1/status/1448037463419674625 https://twitter.com/jonathandata1/status/1448037463419674625
  - saagarjha 5y ago
    FYI: that person is at best very confused, and at worst willfully fraudulent.
    - _jal 5y ago
      Why is that?
kamilman0 5y ago
Could it be that maybe they try to uphold the reputation of Apple by doing so? But it doesn't make sens either way because they could have just paid those guys and then everyone is happy. That's just some ass-backwards logic. I am an Apple fan and I'm not going to defend this. It's just plain bad behavior on their side.
- kjaftaedi 5y ago
  It seems like the last person you would want to dick around would be someone who seems to be extremely good at finding extremely valuable vulnerabilities.
DemiGuru 5y ago
As an apple fan myself, I agree that this type of practice renders the platform less secure rather than more secure. Everyone ends up losing.
killingtime74 5y ago
For want of a nail the kingdom was lost. Just pay the stupid bounty
ballenf 5y ago
Here's a fun conspiracy theory proposed entirely in jest: Apple doesn't want to patch zero-days used by US authorities in order to alleviate pressure on its encryption practices. So they really only want to fix zero-days that are known broadly or get media attention. And they don't want to give too much incentive to researchers to report zero-days to Apple instead of selling them to the highest bidder (which may ultimately be the largest governments with the greatest ability to regulate Apple).
- threeseed 5y ago
  So then explain this page: https://support.apple.com/en-au/HT201222 https://support.apple.com/en-au/HT201222 Why would they bother fixing any of the bugs ?
- jjcon 5y ago
  > alleviate pressure on its encryption practices. Apple is not that different from the status quo on end to end encryption as to necessitate a conspiracy (probably even in jest ). They have no icloud encryption, no photos encryption, no device backup encryption etc etc.
  - dev_tty01 5y ago
    One small correction. They do have backup encryption. As a matter of fact, your various account passwords are only backed up if you keep the encrypt option turned on. https://support.apple.com/en-us/HT205220 https://support.apple.com/en-us/HT205220 As far as the original article, I agree completely that not paying and crediting these folks in a timely manner is just stupid and will reduce Apple security long term.
    - heavyset_go 5y ago
      Apple holds the keys to encrypted iCloud backups.
      - dev_tty01 5y ago
comeonseriously 5y ago
I wonder what would happen if everyone that knows about this just starts pounding Apple's online presence (twitter, fb, etc) in protest of their actions. Would they relent and pay up?
threeseed 5y ago
Apple definitely needs to improve its processes in order to ensure he and others gets credit. But he is over-reacting about the confidential line. When I worked at Apple years ago I added a similar line when dealing with external people. And in every email I have sent whilst working for telcos, banks etc over the last decade a similar line has been included automatically at the footer. It's more a boilerplate polite request not a demand.
- wilde 5y ago
  That’s not clear at all. I’d be twitchy too if I had $100k on the line and the other party had repeatedly messed up over months of interactions.
  - dpkonofa 5y ago
    He doesn't have $100k on the line. That's ridiculous.
- ziddoap 5y ago
  It is of note that this is not the standard footer attached to outgoing e-mails. It's the first line of the email after the greeting, manually written in.
  - threeseed 5y ago
    Not all emails will trigger the automated footer if they use it at all. They never did when I was there. And being a very serious security vulnerability (enough to warrant its own release) they are probably just being cautious. It really is a polite request not some legal demand.
    - ziddoap 5y ago
      I didn't mean for my comment to come across as disagreeing with your overall point - just highlight that there is (in my mind) a fairly big difference between auto-generated footers attached to outgoing emails that you referenced (re banks, teclos) and explicitly written instructions at the beginning of an email.
supernova87a 5y ago
Why are people out to crucify Apple for a story that's still being resolved? The article clearly says: "...Due to a processing issue, your credit will be included on the security advisories in an upcoming update. We apologize for the inconvenience," Apple told him when asked why the list of fixed iOS security bugs didn't include his zero-day..." "...We saw your blog post regarding this issue and your other reports. We apologize for the delay in responding to you," Apple told Tokarev 24 hours after publishing the zero-days and the exploit code on his blog... "...We want to let you know that we are still investigating these issues and how we can address them to protect customers. Thank you again for taking the time to report these issues to us, we appreciate your assistance..." The company hasn't denied the bounty, they're just incompetent / slow on this process. Feels like everyone is out to paint <x> company with just confirmatory bias using whatever half-baked story is available. Even I feel for company leaders in this kind of shitty journalism environment. And the rest of the comments here are just autopilot piling on the echo fest.
- smoldesu 5y ago
  >Why are people out to crucify Apple for a story that's still being resolved? >The company hasn't denied the bounty, they're just incompetent / slow on this process. People probably expect more from... checks notes The world's most valuable and successful modern corporation.
  - ewagsjr 5y ago
    Ya, if I interpreted this right, also really convenient that they seem to be dragging their feet on a $100,000 bounty.
    - dpkonofa 5y ago
      Nobody's going to pay $100,000 for a bug that lets you download someone's contact list.
      - brokenmachine 5y ago
deleted 5y ago
[deleted]
jtsiskin 5y ago
Zerodium (https://zerodium.com/program.html https://zerodium.com/program.html) pays out $2 million dollars for an iOS “full chain with persistence” exploit. $500k for an iMessage RCE. Up to $100k for an iOS “information disclosure” exploit (likely what this would have fallen under). Paid for via bank wire or Bitcoin/Monero/Zcash in 1 week or less. And legal. Next time someone finds one of these, I wonder where they will report it to….
- DSingularity 5y ago
  Is it moral though? What do they do with these exploits? If it is to help advance the agendas of countries like Israel and Saudi Arabia how would you feel submitting exploits to them?
  - tptacek 5y ago
    They sell them to the IC.
  - miohtama 5y ago
    You can choose between a rich murderous dictator and an arrogant IT company that does not give you a proper credit. Either way you are screwed as a security researcher :(
    - deleted 5y ago
      [deleted]
    - ethanbond 5y ago
      Uh, if your consideration is purely what happens to you, sure. If you have any thought in your mind about what will happen to other people due to your work, then it's nowhere near the same.
      - AustinDev 5y ago
        Trillion dollar companies are people under the US constitution and they don't seem to care about that so why should everyday citizens?
coldtea 5y ago
>Apple silently fixes iOS zero-day, asks bug reporter to keep quiet Isn't that standard procedure for any company faced with a 0-day, prudent, and the right thing to do?
- saagarjha 5y ago
  Why would asking the reporter to keep quiet be prudent, especially after the bug has been fixed?
  - metafunctor 5y ago
    Because not everyone has updated yet, not everything related to the vulnerability is fixed yet, the vulnerability is kind of bullshit, people are still figuring out if there are lots of adjacent or similar vulnerabilities to handle, etc. Not sure which of these is the case here. You can, of course, disclose vulnerabilities whenever you like. But don't expect to get a bounty if you piss off the vendor in the process.
o_m 5y ago
I wish Apple would do a feature freeze for iOS and macOS for a couple of years, then focus on fixing bugs, improving security and optimizing performance instead.
- sbarre 5y ago
  But money!
- astrange 5y ago
  All of those things are actually more likely to cause new bugs than feature development, not less.
rgovostes 5y ago
The advisory credit and bug bounty fiasco aside, when I reported a security vulnerability to Apple in 2010, they wrote, "Because of the potentially sensitive nature of security vulnerabilities, we ask that this information remain between you and Apple while we investigate it further." It seems to just be a standard inclusion in their correspondence, and not unique to this exchange.
paul7986 5y ago
iOS 15 from release date has had the most bugs I've ever experienced with any former versions of iOS. Siri would revert back to Dragon style text to speech randomly is one thing I noticed frequently.
- sneak 5y ago
  A former Apple person reminded me that the new major version iOS must ship on the same day as the new hardware, as the new hardware (this year, the new iPad Mini, and iPhones 13) will not run iOS14. They are developed in lockstep with the next OS and will ship with it, and cannot ship without it. The software is going out the door alongside the latest version of their biggest money-making product. Note well how quickly 15.0.1 was released.
advael 5y ago
Big companies move slow and given the pervasiveness of these devices, it's fundamentally irresponsible to allow the google-apple duopoly in mobile OSes to keep their platforms closed, forming a bottleneck on all security fixes. Trust-busting in this space is long overdue
chubs 5y ago
There's an incentives problem here: If whitehat researchers are disincentivised from working on iOS, the only people researching iOS vulnerabilities will be the bad guys.
purplejacket 5y ago
Richest company in the world.
adminscoffee 5y ago
so silent that the internet now knows about it..
andy_ppp 5y ago
My friend has just looked on Find My Mac and he can remotely format and track the whereabouts of the Macbook Pro of a guy called “Jason”. He’s never sold or had this MacBook model on his account. The people in the Apple store provided no fixes but suggested formatting the machine which I guess would be illegal in most places. It makes me worry that I could be Jason and someone could remotely format my computer… it’s scary that something like this is possible.

600 points by DemiGuru 5y ago

What a slap in the face. This guy is owed a boatload of cash, and typical Apple just kicks the can down the road. Next time I hope he sells his next vuln to the highest bidder.

gjs278 5y ago
there is no next highest bidder, you live in a cyberpunk fantasy land
ambientenv 5y ago
> Next time I hope he sells his next vuln to the highest bidder And thereby accomplishing what, exactly? There is still merit, albeit not from a material wealth standpoint, for doing the right thing for the right reasons.
- vadfa 5y ago
  >And thereby accomplishing what, exactly? ...$$$$?
  - basisword 5y ago
    I could accomplish the same thing by robbing a bank - doesn’t make it the right thing to do.
    - spicybright 5y ago
      Doesn't make free work for a for trillion dollar corporation something noble to do. By that logic, a grocery store giving away everything for free is the right thing to do. Doesn't lead to anything sustainable though.
      - dpkonofa 5y ago
        What suggests that any of this is "free work for a trillion dollar corporation"? Apple hasn't acknowledged that this person discovered this bug yet. They've only acknowledged that it existed and that they were going to patch it in the future. Crediting someone for a bug bounty isn't as easy as you all are making it out to be.
    - akomtu 5y ago
      Unless it's a mafia's bank.
      - justshowpost 5y ago
        You're also either a victim or an oppressor. No wrong can be done by anyone in the former group, and no good by the latter. Such ideas of victimization do nothing but justify the use of power and engender intergroup conflict.
    - young_unixer 5y ago
      Robbing a bank is immoral, selling information about how a piece of software works, in my humble opinion, is not. Or if it is, then it's not even close to the level of "wrong" that is robbing a bank.
      - mrtesthah 5y ago
        And what if that information gets weaponized against journalists in an authoritarian regime?
        ClumsyPilot 5y ago
        You know what gets weaponised? Actual weapons our government sold to Saudi and other's.
        true_religion 5y ago
        Also the software to subvert security on mobile devices, build firewalls on a national level, and inspect every internet packet for disloyal statements. All that is packaged and sold to our authoritarian allies with the full approval of the government the majority of people support. Selling a zero day would probably fall under a weapons clause.
        mrtesthah 5y ago
        One of these things doesn't negate or excuse the other; both can happen at the same time. You're engaging in "whataboutism".
        ClumsyPilot 5y ago
        If you sell a knife, and it's used for a stabbing, are you culpable? Thousands of people buy knives every day, and most of them don't stab anyone. So unless there was good reason to suspect something, we would say no. Most zerodays are probably not bought by china to spy on dissidents, they are more like knives. On the contrary, when we sell bombs to Saudis we can be 95% sure they will be used in Yemen.
  - Bud 5y ago
    Except that as this thread demonstrates, there is no realistic possibility of this researcher actually making more $$$ in real life by trying to find another bidder.
    - smoldesu 5y ago
      Zerodium pays more for the exploits, and unlike Apple, is willing to compensate you in non-traceable currency.
      - dpkonofa 5y ago
        Not for this exploit. They pay more for code-execution exploits. No one is going to pay the sums you guys are thinking they will over a bug that gives you someone's GameCenter contacts. It's not a trivial bug but it's also not a very valuable one.
- AustinDev 5y ago
  Trillion dollar companies don't care about merit for doing the right thing. Why should this guy in the future?
  - pcbro141 5y ago
    Maybe he doesn't want dissident journalists and activists to get spied on and chopped to pieces? That sounds like a good enough reason to report these bugs for someone with morals.
    - lern_too_spel 5y ago
      Dissident journalists and activists can use devices from vendors that care about security enough to run a working bug bounty program.
      - rurp 5y ago
        Unfortunately exercising consumer choice works a lot better in a healthy free market than it does in one controlled by an oligopoly. I totally agree that people should try to avoid buying from companies that do immoral things, but it can be quite hard in a consolidated market.
- aviraldg 5y ago
  Forcing Apple to do the right thing the next time.
- celim307 5y ago
  I agree somewhat, the users which include me get caught in the crossfire if someone releases a zero day out in the wild, but I also think there needs to be a negative feedback to these tech giants that expect work for free. But in the grand scheme of things, does it even punish the tech giants? They have so many claws in a users life, and in the case of apple, your only other choice is google or a bunch of shady oems. At the end of the day the only people who pay for it are users themselves, their data is comprised and irreversibly out there
- kbenson 5y ago
  You can rely on the vast majority of people to do the right thing when it's in their best interests. You can likely rely on a good majority of people to do the right thing when it isn't for or against their interests in any substantial way. I'm not sure the amount of people that will do the right thing when it's not in their best interests by some small but noticeable amount. I'm also not sure the amount of people that will do the right thing when it's vastly against their best interests, but it's bound to be far less that the prior group, and I suspect it's way below a majority. The point isn't that these people aren't doing the "right thing", it's that these programs are designed to align doing the right thing with the best interests of the researchers, so noting that we might get more results that are not in the best interests of society at large or the company in question if they don't hold up to what they agreed to is not only a valid observation, it's the likely outcome if we're to expect these programs exist for a reason. To put this in perspective, say you find a suitcase with a million dollars in it. You can turn it in, or you can keep it for yourself. If there's no real expectation you'll get anything if you turn it in, how does the reasoning go in your head? What if you know you'll get 10% for finding it and turning it in? What if you live in abject poverty? What if you have $60k worth of medical bills for a family member to pay off?
- ClumsyPilot 5y ago
  "There is still merit, albeit not from a material wealth standpoint, for doing the right thing for the right reasons" There seems to be the strange wordview where ordinary joe must be morally impeccable but its corporate leadership can be as immoral as they come. Like the richer you are, the less rules you have to follow. Surelly it should be the other way round?
afrcnc 5y ago
No, he's not. Those are low-priority bugs and the only thing that made them stand out was the fact that he dropped them online without a patch. RCEs get priority in patching, and his priv esc issues were not as important.
- r00fus 5y ago
  He dropped them online after a significant period of delay. Already discussed here on HN. [1] [1] https://news.ycombinator.com/item?id=28637276 https://news.ycombinator.com/item?id=28637276
tptacek 5y ago
Who's the next highest bidder after Apple for a bug in `gamed` that allows you to access GameCenter and download contacts? It's a significant vulnerability, but there's e.g. no price list entry on Zerodium (you can take Zerodium more or less seriously, this is just a data point) for anything but code execution, which this vulnerability isn't.
- saagarjha 5y ago
  Shady advertising SDK? (Also, don't people use code execution to exfiltrate contacts and messages? This is basically what this bug does, albeit with "several clicks" involved.)
- WesolyKubeczek 5y ago
  > Who's the next highest bidder after Apple for a bug in `gamed` that allows you to access GameCenter and download contacts? Anyone who actually pays money or golden bars within a reasonable timeframe? > It's a significant vulnerability, but there's e.g. no price list entry on Zerodium On this scale I think it's "Contact us and we negotiate" sort of price.
  - tptacek 5y ago
    Who? Speculate as to who they might be. The six figure numbers you're familiar with are for code execution bugs. This is obviously not that. So they're not anybody that quotes prices for bugs, or anyone directly comparable to them. Governments can already pay prices comparable to the supposed bounty valuation of this bug for code execution. They're probably not shelling out six figures in gold bars for a bug that exfiltrates contact lists from apps that have to be installed from the app store. The non-bounty market clearing price for a lot of scary sounding vulnerabilities is $0.
    - renewiltord 5y ago
      Your comments are the only ones here which aren’t divorced from reality. It’s weird. Who are these supposed guys paying six figures for this sort of thing? It’s just not a valuable thing.
bawolff 5y ago
Can't we hope they go for full-disclosure instead of selling to the highest bidder? Selling to the highest bidder just hurts apple users not apple.
- akira2501 5y ago
  > just hurts apple users not apple. As a first-order effect, sure.. but Apple is not immune to the damage that this causes either. More importantly, their failure to pay or honor their commitments would be the root cause of this in the future. They opened this "bug bounty" door on their own, they are solely responsible for it's success or failure.
  - bawolff 5y ago
    Sure there are secondary affects. However they are mild comparatively The two options: - someone full discloses a 0-day. Apple is embarrased, users can take mitigating action until its patched. Apple is probably forced to patch. End result: really embarasing for apple. Small risk to users that's pretty ephemeral. - sell to highest bidder. Black market or at best grey hat. Exploit is used against users. Nobody really knows its happening. Maybe that eventually comes back to give apple a bad reputation, but not likely to happen in the short term. One of these courses of action disproportionately hurts users a lot and apple not very much. The other hurts basically only apple and users very little. Even if you argue that the black market might eventually hurt apple a little bit, its still a very small hurt. If your goal is to piss off apple, it seems clear that full-disclosure is the thing to do here. If your goal is just to clear your concious on the morality of selling exploits to bad people who intend to use them to do bad things - while i'm sure you'd find a way to justify that no matter what apple did. The human mind is good at self-justification. > More importantly, their failure to pay or honor their commitments What commitment? A bug bounty program isn't a commitment to do anything. Its not a contract or a work agreement. At best its sort of like a contest. But even disregarding that, i'm not sure this bug even is in any of the categories they list. What they say is: iOS user installed app can access sensitive data including Contacts, Mail, Messages, Notes, Photos, or real-time or historical precise location data. i'm not sure this fits. Is apple being a dick? Yes. Are they breaking commitments they made? Not super clear.
azinman2 5y ago
So you’re hoping for malware?
0xdeadb00f 5y ago
Sell it to the highest bidder then release it on the darknet for free anyways :^)

IndySun 5y ago

Apple the corporation religiously and sometimes aggressively portray themselves as virtuous, safe, and honest, but this behaviour suggests those qualities are marketing tools.

artful-hacker 5y ago

This is just one more nail in the already air-tight coffin Apple has built for themselves. I seriously don't understand why people stick with Apple products, they are getting much harder to use, they lock you in to their gimped ecosystem, and their hardware is constantly failing to be reliable.

sneak 5y ago
Ignore the software for a moment: nobody makes smartphones or tablets anywhere near the hardware quality of the iPhone or iPad Pro. Nobody.
watermelon0 5y ago
There is no better alternative (at least for some people)? Just some examples: - Integration between their devices cannot be matched by others - Apple Watch has the largest app collection, great integration between iOS and Watch apps, smooth animations/UX, the most accurate GPS of smart watches - Handover of AirPods between Apple devices is a lot better than with other Bluetooth headphones - (subjective) iOS has a lot better UX/animations than Android
- kayodelycaon 5y ago
  The killer feature for me beyond Mac-only apps: Time Machine. Nothing matches it. I had some minor issues setting up my newly purchased M1 from an Intel backup, but it was quickly fixed when I updated the OS. Always, always, always use a directly connected external hard dive. The networked version is terrible.
radlad 5y ago
I'm so happy Linux is an option on the computer. When it comes to phones I feel stuck behind a rock and a hard place - choose iPhone, with poor Linux integration and threats to passively scan files on my phone and forward them to LEO? Sure, they have a decent record with security but these bug bounty reports haven't been great. Or choose Android, with its poor privacy record, a result of being built by an ad company that's already scanning my phone and mining it for data? edited to add - While I'd love to see a true competitor in this space (i.e. not based on Android - those projects don't seem to work out well as a result of being half-in/half-out of the ecosystem) I don't see how it's possible without the support of the large tech players - Facebook, Instagram, Snapchat, WhatsApp, Twitter, and Spotify at minimum, to say nothing of the long tail.

aborsy 5y ago

The need for Linux phones, in a market dominated by two companies and one government, is more than ever! Hope we soon get a usable Linux phone.

reginold 5y ago
PinePhone is our only hope! Still a ways off from being consumer ready but it's heading in the right direction.
- Buttons840 5y ago
  "Only option"? What about Purism phones?
  - ben-schaaf 5y ago
    While they do seem to be shipping every so slowly they're still stuck on orders from the initial crowd funding campaign from 2018.
    - Buttons840 5y ago
      Ah. Good point. Still a name worth mentioning though; we need to each of the few companies in this space.
  - reginold 5y ago
    Yes! Another option -- however, Purism are pursuing two challenges at once, developing both the software and the hardware. Pinephone just focuses on hardware.
beermonster 5y ago
Such a market need grows daily. Hopefully only a matter of time.
h0nd 5y ago
Absolutely. I am fed up with so many dependencies due to or within my mobile phone

woliveirajr 5y ago

Seems that no credit, no bount, nothing, has become the way that Apple deals with the iBugs Hunters. And all it takes is one of those unsong heros giving up on reporting to Apple and, instead, reporting to some 0-day company, and some ransonware go brrrr

dpkonofa 5y ago
>Seems that no credit, no bount, nothing, has become the way that Apple deals with the iBugs Hunters. Based on what? You can't possibly know anything about this bug or what stage of the reporting process it's in and Apple regularly pays and credits people for reporting vulnerabilities and other exploits. This specific bug just isn't a high enough priority to elevate it to the level you're describing.
croutonwagon 5y ago
I'm surprised it hasnt happened yet. IT seems apple is possibly openly hostile and uses "red tape" as an excuse to obfuscate communication and frustrate those trying to do right by them instead of just posting it to github and calling them out on twitter. Its one of a few reasons I have made some in-roads into moving off the platform.
_jal 5y ago
I'm sure people are selling them, although I think it would only become public by accident. At least some are going the back to the Full Disclosure days... https://twitter.com/jonathandata1/status/1448037463419674625 https://twitter.com/jonathandata1/status/1448037463419674625
- saagarjha 5y ago
  FYI: that person is at best very confused, and at worst willfully fraudulent.
  - _jal 5y ago
    Why is that?

kamilman0 5y ago

Could it be that maybe they try to uphold the reputation of Apple by doing so? But it doesn't make sens either way because they could have just paid those guys and then everyone is happy. That's just some ass-backwards logic. I am an Apple fan and I'm not going to defend this. It's just plain bad behavior on their side.

kjaftaedi 5y ago
It seems like the last person you would want to dick around would be someone who seems to be extremely good at finding extremely valuable vulnerabilities.

DemiGuru 5y ago

As an apple fan myself, I agree that this type of practice renders the platform less secure rather than more secure. Everyone ends up losing.

killingtime74 5y ago

For want of a nail the kingdom was lost. Just pay the stupid bounty

ballenf 5y ago

Here's a fun conspiracy theory proposed entirely in jest: Apple doesn't want to patch zero-days used by US authorities in order to alleviate pressure on its encryption practices. So they really only want to fix zero-days that are known broadly or get media attention. And they don't want to give too much incentive to researchers to report zero-days to Apple instead of selling them to the highest bidder (which may ultimately be the largest governments with the greatest ability to regulate Apple).

threeseed 5y ago
So then explain this page: https://support.apple.com/en-au/HT201222 https://support.apple.com/en-au/HT201222 Why would they bother fixing any of the bugs ?
jjcon 5y ago
> alleviate pressure on its encryption practices. Apple is not that different from the status quo on end to end encryption as to necessitate a conspiracy (probably even in jest ). They have no icloud encryption, no photos encryption, no device backup encryption etc etc.
- dev_tty01 5y ago
  One small correction. They do have backup encryption. As a matter of fact, your various account passwords are only backed up if you keep the encrypt option turned on. https://support.apple.com/en-us/HT205220 https://support.apple.com/en-us/HT205220 As far as the original article, I agree completely that not paying and crediting these folks in a timely manner is just stupid and will reduce Apple security long term.
  - heavyset_go 5y ago
    Apple holds the keys to encrypted iCloud backups.
    - dev_tty01 5y ago

comeonseriously 5y ago

I wonder what would happen if everyone that knows about this just starts pounding Apple's online presence (twitter, fb, etc) in protest of their actions. Would they relent and pay up?

threeseed 5y ago

Apple definitely needs to improve its processes in order to ensure he and others gets credit. But he is over-reacting about the confidential line. When I worked at Apple years ago I added a similar line when dealing with external people. And in every email I have sent whilst working for telcos, banks etc over the last decade a similar line has been included automatically at the footer. It's more a boilerplate polite request not a demand.

wilde 5y ago
That’s not clear at all. I’d be twitchy too if I had $100k on the line and the other party had repeatedly messed up over months of interactions.
- dpkonofa 5y ago
  He doesn't have $100k on the line. That's ridiculous.
ziddoap 5y ago
It is of note that this is not the standard footer attached to outgoing e-mails. It's the first line of the email after the greeting, manually written in.
- threeseed 5y ago
  Not all emails will trigger the automated footer if they use it at all. They never did when I was there. And being a very serious security vulnerability (enough to warrant its own release) they are probably just being cautious. It really is a polite request not some legal demand.
  - ziddoap 5y ago
    I didn't mean for my comment to come across as disagreeing with your overall point - just highlight that there is (in my mind) a fairly big difference between auto-generated footers attached to outgoing emails that you referenced (re banks, teclos) and explicitly written instructions at the beginning of an email.

supernova87a 5y ago

Why are people out to crucify Apple for a story that's still being resolved? The article clearly says: "...Due to a processing issue, your credit will be included on the security advisories in an upcoming update. We apologize for the inconvenience," Apple told him when asked why the list of fixed iOS security bugs didn't include his zero-day..." "...We saw your blog post regarding this issue and your other reports. We apologize for the delay in responding to you," Apple told Tokarev 24 hours after publishing the zero-days and the exploit code on his blog... "...We want to let you know that we are still investigating these issues and how we can address them to protect customers. Thank you again for taking the time to report these issues to us, we appreciate your assistance..." The company hasn't denied the bounty, they're just incompetent / slow on this process. Feels like everyone is out to paint <x> company with just confirmatory bias using whatever half-baked story is available. Even I feel for company leaders in this kind of shitty journalism environment. And the rest of the comments here are just autopilot piling on the echo fest.

smoldesu 5y ago
>Why are people out to crucify Apple for a story that's still being resolved? >The company hasn't denied the bounty, they're just incompetent / slow on this process. People probably expect more from... checks notes The world's most valuable and successful modern corporation.
- ewagsjr 5y ago
  Ya, if I interpreted this right, also really convenient that they seem to be dragging their feet on a $100,000 bounty.
  - dpkonofa 5y ago
    Nobody's going to pay $100,000 for a bug that lets you download someone's contact list.
    - brokenmachine 5y ago

deleted 5y ago

[deleted]

jtsiskin 5y ago

Zerodium (https://zerodium.com/program.html https://zerodium.com/program.html) pays out $2 million dollars for an iOS “full chain with persistence” exploit. $500k for an iMessage RCE. Up to $100k for an iOS “information disclosure” exploit (likely what this would have fallen under). Paid for via bank wire or Bitcoin/Monero/Zcash in 1 week or less. And legal. Next time someone finds one of these, I wonder where they will report it to….

DSingularity 5y ago
Is it moral though? What do they do with these exploits? If it is to help advance the agendas of countries like Israel and Saudi Arabia how would you feel submitting exploits to them?
- tptacek 5y ago
  They sell them to the IC.
- miohtama 5y ago
  You can choose between a rich murderous dictator and an arrogant IT company that does not give you a proper credit. Either way you are screwed as a security researcher :(
  - deleted 5y ago
    [deleted]
  - ethanbond 5y ago
    Uh, if your consideration is purely what happens to you, sure. If you have any thought in your mind about what will happen to other people due to your work, then it's nowhere near the same.
    - AustinDev 5y ago
      Trillion dollar companies are people under the US constitution and they don't seem to care about that so why should everyday citizens?

coldtea 5y ago

>Apple silently fixes iOS zero-day, asks bug reporter to keep quiet Isn't that standard procedure for any company faced with a 0-day, prudent, and the right thing to do?

saagarjha 5y ago
Why would asking the reporter to keep quiet be prudent, especially after the bug has been fixed?
- metafunctor 5y ago
  Because not everyone has updated yet, not everything related to the vulnerability is fixed yet, the vulnerability is kind of bullshit, people are still figuring out if there are lots of adjacent or similar vulnerabilities to handle, etc. Not sure which of these is the case here. You can, of course, disclose vulnerabilities whenever you like. But don't expect to get a bounty if you piss off the vendor in the process.

o_m 5y ago

I wish Apple would do a feature freeze for iOS and macOS for a couple of years, then focus on fixing bugs, improving security and optimizing performance instead.

sbarre 5y ago
But money!
astrange 5y ago
All of those things are actually more likely to cause new bugs than feature development, not less.

rgovostes 5y ago

The advisory credit and bug bounty fiasco aside, when I reported a security vulnerability to Apple in 2010, they wrote, "Because of the potentially sensitive nature of security vulnerabilities, we ask that this information remain between you and Apple while we investigate it further." It seems to just be a standard inclusion in their correspondence, and not unique to this exchange.

paul7986 5y ago

iOS 15 from release date has had the most bugs I've ever experienced with any former versions of iOS. Siri would revert back to Dragon style text to speech randomly is one thing I noticed frequently.

sneak 5y ago
A former Apple person reminded me that the new major version iOS must ship on the same day as the new hardware, as the new hardware (this year, the new iPad Mini, and iPhones 13) will not run iOS14. They are developed in lockstep with the next OS and will ship with it, and cannot ship without it. The software is going out the door alongside the latest version of their biggest money-making product. Note well how quickly 15.0.1 was released.

advael 5y ago

Big companies move slow and given the pervasiveness of these devices, it's fundamentally irresponsible to allow the google-apple duopoly in mobile OSes to keep their platforms closed, forming a bottleneck on all security fixes. Trust-busting in this space is long overdue

chubs 5y ago

There's an incentives problem here: If whitehat researchers are disincentivised from working on iOS, the only people researching iOS vulnerabilities will be the bad guys.

purplejacket 5y ago

Richest company in the world.

adminscoffee 5y ago

so silent that the internet now knows about it..

andy_ppp 5y ago

My friend has just looked on Find My Mac and he can remotely format and track the whereabouts of the Macbook Pro of a guy called “Jason”. He’s never sold or had this MacBook model on his account. The people in the Apple store provided no fixes but suggested formatting the machine which I guess would be illegal in most places. It makes me worry that I could be Jason and someone could remotely format my computer… it’s scary that something like this is possible.