4 ms·

Seems that no credit, no bount, nothing, has become the way that Apple deals with the iBugs Hunters. And all it takes is one of those unsong heros giving up on

Seems that no credit, no bount, nothing, has become the way that Apple deals with the iBugs Hunters. And all it takes is one of those unsong heros giving up on reporting to Apple and, instead, reporting to some 0-day company, and some ransonware go brrrr

dpkonofa 5y ago
>Seems that no credit, no bount, nothing, has become the way that Apple deals with the iBugs Hunters. Based on what? You can't possibly know anything about this bug or what stage of the reporting process it's in and Apple regularly pays and credits people for reporting vulnerabilities and other exploits. This specific bug just isn't a high enough priority to elevate it to the level you're describing.
croutonwagon 5y ago
I'm surprised it hasnt happened yet. IT seems apple is possibly openly hostile and uses "red tape" as an excuse to obfuscate communication and frustrate those trying to do right by them instead of just posting it to github and calling them out on twitter. Its one of a few reasons I have made some in-roads into moving off the platform.
_jal 5y ago
I'm sure people are selling them, although I think it would only become public by accident. At least some are going the back to the Full Disclosure days... https://twitter.com/jonathandata1/status/1448037463419674625 https://twitter.com/jonathandata1/status/1448037463419674625
- saagarjha 5y ago
  FYI: that person is at best very confused, and at worst willfully fraudulent.
  - _jal 5y ago
    Why is that?
    - saagarjha 5y ago
      They demonstrate a clear lack of knowledge of actual security–like unzipping a firmware update and calling it "decompiling" or connecting a device to a computer and using the file transfer functionality as proof of "RCE".
threeseed 5y ago
This comment is just nonsense. They regularly credit security researchers: https://support.apple.com/en-au/HT201222 https://support.apple.com/en-au/HT201222 Seems like this in case it's just a mistake that was made.
tptacek 5y ago
These vulnerabilities do not enable ransomware.

dpkonofa 5y ago

>Seems that no credit, no bount, nothing, has become the way that Apple deals with the iBugs Hunters. Based on what? You can't possibly know anything about this bug or what stage of the reporting process it's in and Apple regularly pays and credits people for reporting vulnerabilities and other exploits. This specific bug just isn't a high enough priority to elevate it to the level you're describing.

croutonwagon 5y ago

I'm surprised it hasnt happened yet. IT seems apple is possibly openly hostile and uses "red tape" as an excuse to obfuscate communication and frustrate those trying to do right by them instead of just posting it to github and calling them out on twitter. Its one of a few reasons I have made some in-roads into moving off the platform.

_jal 5y ago

I'm sure people are selling them, although I think it would only become public by accident. At least some are going the back to the Full Disclosure days... https://twitter.com/jonathandata1/status/1448037463419674625 https://twitter.com/jonathandata1/status/1448037463419674625

saagarjha 5y ago
FYI: that person is at best very confused, and at worst willfully fraudulent.
- _jal 5y ago
  Why is that?
  - saagarjha 5y ago
    They demonstrate a clear lack of knowledge of actual security–like unzipping a firmware update and calling it "decompiling" or connecting a device to a computer and using the file transfer functionality as proof of "RCE".

threeseed 5y ago

This comment is just nonsense. They regularly credit security researchers: https://support.apple.com/en-au/HT201222 https://support.apple.com/en-au/HT201222 Seems like this in case it's just a mistake that was made.

tptacek 5y ago

These vulnerabilities do not enable ransomware.