20 ms·

What a slap in the face. This guy is owed a boatload of cash, and typical Apple just kicks the can down the road. Next time I hope he sells his next vuln to the

What a slap in the face. This guy is owed a boatload of cash, and typical Apple just kicks the can down the road. Next time I hope he sells his next vuln to the highest bidder.

gjs278 5y ago
there is no next highest bidder, you live in a cyberpunk fantasy land
ambientenv 5y ago
> Next time I hope he sells his next vuln to the highest bidder And thereby accomplishing what, exactly? There is still merit, albeit not from a material wealth standpoint, for doing the right thing for the right reasons.
- vadfa 5y ago
  >And thereby accomplishing what, exactly? ...$$$$?
  - basisword 5y ago
    I could accomplish the same thing by robbing a bank - doesn’t make it the right thing to do.
    - spicybright 5y ago
      Doesn't make free work for a for trillion dollar corporation something noble to do. By that logic, a grocery store giving away everything for free is the right thing to do. Doesn't lead to anything sustainable though.
      - dpkonofa 5y ago
        What suggests that any of this is "free work for a trillion dollar corporation"? Apple hasn't acknowledged that this person discovered this bug yet. They've only acknowledged that it existed and that they were going to patch it in the future. Crediting someone for a bug bounty isn't as easy as you all are making it out to be.
    - akomtu 5y ago
      Unless it's a mafia's bank.
      - justshowpost 5y ago
        You're also either a victim or an oppressor. No wrong can be done by anyone in the former group, and no good by the latter. Such ideas of victimization do nothing but justify the use of power and engender intergroup conflict.
    - young_unixer 5y ago
      Robbing a bank is immoral, selling information about how a piece of software works, in my humble opinion, is not. Or if it is, then it's not even close to the level of "wrong" that is robbing a bank.
      - mrtesthah 5y ago
        And what if that information gets weaponized against journalists in an authoritarian regime?
        ClumsyPilot 5y ago
        You know what gets weaponised? Actual weapons our government sold to Saudi and other's.
        true_religion 5y ago
        Also the software to subvert security on mobile devices, build firewalls on a national level, and inspect every internet packet for disloyal statements. All that is packaged and sold to our authoritarian allies with the full approval of the government the majority of people support. Selling a zero day would probably fall under a weapons clause.
        mrtesthah 5y ago
        One of these things doesn't negate or excuse the other; both can happen at the same time. You're engaging in "whataboutism".
        ClumsyPilot 5y ago
        If you sell a knife, and it's used for a stabbing, are you culpable? Thousands of people buy knives every day, and most of them don't stab anyone. So unless there was good reason to suspect something, we would say no. Most zerodays are probably not bought by china to spy on dissidents, they are more like knives. On the contrary, when we sell bombs to Saudis we can be 95% sure they will be used in Yemen.
  - Bud 5y ago
    Except that as this thread demonstrates, there is no realistic possibility of this researcher actually making more $$$ in real life by trying to find another bidder.
    - smoldesu 5y ago
      Zerodium pays more for the exploits, and unlike Apple, is willing to compensate you in non-traceable currency.
      - dpkonofa 5y ago
        Not for this exploit. They pay more for code-execution exploits. No one is going to pay the sums you guys are thinking they will over a bug that gives you someone's GameCenter contacts. It's not a trivial bug but it's also not a very valuable one.
- AustinDev 5y ago
  Trillion dollar companies don't care about merit for doing the right thing. Why should this guy in the future?
  - pcbro141 5y ago
    Maybe he doesn't want dissident journalists and activists to get spied on and chopped to pieces? That sounds like a good enough reason to report these bugs for someone with morals.
    - lern_too_spel 5y ago
      Dissident journalists and activists can use devices from vendors that care about security enough to run a working bug bounty program.
      - rurp 5y ago
        Unfortunately exercising consumer choice works a lot better in a healthy free market than it does in one controlled by an oligopoly. I totally agree that people should try to avoid buying from companies that do immoral things, but it can be quite hard in a consolidated market.
- aviraldg 5y ago
  Forcing Apple to do the right thing the next time.
- celim307 5y ago
  I agree somewhat, the users which include me get caught in the crossfire if someone releases a zero day out in the wild, but I also think there needs to be a negative feedback to these tech giants that expect work for free. But in the grand scheme of things, does it even punish the tech giants? They have so many claws in a users life, and in the case of apple, your only other choice is google or a bunch of shady oems. At the end of the day the only people who pay for it are users themselves, their data is comprised and irreversibly out there
- kbenson 5y ago
  You can rely on the vast majority of people to do the right thing when it's in their best interests. You can likely rely on a good majority of people to do the right thing when it isn't for or against their interests in any substantial way. I'm not sure the amount of people that will do the right thing when it's not in their best interests by some small but noticeable amount. I'm also not sure the amount of people that will do the right thing when it's vastly against their best interests, but it's bound to be far less that the prior group, and I suspect it's way below a majority. The point isn't that these people aren't doing the "right thing", it's that these programs are designed to align doing the right thing with the best interests of the researchers, so noting that we might get more results that are not in the best interests of society at large or the company in question if they don't hold up to what they agreed to is not only a valid observation, it's the likely outcome if we're to expect these programs exist for a reason. To put this in perspective, say you find a suitcase with a million dollars in it. You can turn it in, or you can keep it for yourself. If there's no real expectation you'll get anything if you turn it in, how does the reasoning go in your head? What if you know you'll get 10% for finding it and turning it in? What if you live in abject poverty? What if you have $60k worth of medical bills for a family member to pay off?
- ClumsyPilot 5y ago
  "There is still merit, albeit not from a material wealth standpoint, for doing the right thing for the right reasons" There seems to be the strange wordview where ordinary joe must be morally impeccable but its corporate leadership can be as immoral as they come. Like the richer you are, the less rules you have to follow. Surelly it should be the other way round?
afrcnc 5y ago
No, he's not. Those are low-priority bugs and the only thing that made them stand out was the fact that he dropped them online without a patch. RCEs get priority in patching, and his priv esc issues were not as important.
- r00fus 5y ago
  He dropped them online after a significant period of delay. Already discussed here on HN. [1] [1] https://news.ycombinator.com/item?id=28637276 https://news.ycombinator.com/item?id=28637276
tptacek 5y ago
Who's the next highest bidder after Apple for a bug in `gamed` that allows you to access GameCenter and download contacts? It's a significant vulnerability, but there's e.g. no price list entry on Zerodium (you can take Zerodium more or less seriously, this is just a data point) for anything but code execution, which this vulnerability isn't.
- saagarjha 5y ago
  Shady advertising SDK? (Also, don't people use code execution to exfiltrate contacts and messages? This is basically what this bug does, albeit with "several clicks" involved.)
- WesolyKubeczek 5y ago
  > Who's the next highest bidder after Apple for a bug in `gamed` that allows you to access GameCenter and download contacts? Anyone who actually pays money or golden bars within a reasonable timeframe? > It's a significant vulnerability, but there's e.g. no price list entry on Zerodium On this scale I think it's "Contact us and we negotiate" sort of price.
  - tptacek 5y ago
    Who? Speculate as to who they might be. The six figure numbers you're familiar with are for code execution bugs. This is obviously not that. So they're not anybody that quotes prices for bugs, or anyone directly comparable to them. Governments can already pay prices comparable to the supposed bounty valuation of this bug for code execution. They're probably not shelling out six figures in gold bars for a bug that exfiltrates contact lists from apps that have to be installed from the app store. The non-bounty market clearing price for a lot of scary sounding vulnerabilities is $0.
    - renewiltord 5y ago
      Your comments are the only ones here which aren’t divorced from reality. It’s weird. Who are these supposed guys paying six figures for this sort of thing? It’s just not a valuable thing.
bawolff 5y ago
Can't we hope they go for full-disclosure instead of selling to the highest bidder? Selling to the highest bidder just hurts apple users not apple.
- akira2501 5y ago
  > just hurts apple users not apple. As a first-order effect, sure.. but Apple is not immune to the damage that this causes either. More importantly, their failure to pay or honor their commitments would be the root cause of this in the future. They opened this "bug bounty" door on their own, they are solely responsible for it's success or failure.
  - bawolff 5y ago
    Sure there are secondary affects. However they are mild comparatively The two options: - someone full discloses a 0-day. Apple is embarrased, users can take mitigating action until its patched. Apple is probably forced to patch. End result: really embarasing for apple. Small risk to users that's pretty ephemeral. - sell to highest bidder. Black market or at best grey hat. Exploit is used against users. Nobody really knows its happening. Maybe that eventually comes back to give apple a bad reputation, but not likely to happen in the short term. One of these courses of action disproportionately hurts users a lot and apple not very much. The other hurts basically only apple and users very little. Even if you argue that the black market might eventually hurt apple a little bit, its still a very small hurt. If your goal is to piss off apple, it seems clear that full-disclosure is the thing to do here. If your goal is just to clear your concious on the morality of selling exploits to bad people who intend to use them to do bad things - while i'm sure you'd find a way to justify that no matter what apple did. The human mind is good at self-justification. > More importantly, their failure to pay or honor their commitments What commitment? A bug bounty program isn't a commitment to do anything. Its not a contract or a work agreement. At best its sort of like a contest. But even disregarding that, i'm not sure this bug even is in any of the categories they list. What they say is: iOS user installed app can access sensitive data including Contacts, Mail, Messages, Notes, Photos, or real-time or historical precise location data. i'm not sure this fits. Is apple being a dick? Yes. Are they breaking commitments they made? Not super clear.
azinman2 5y ago
So you’re hoping for malware?
0xdeadb00f 5y ago
Sell it to the highest bidder then release it on the darknet for free anyways :^)

What a slap in the face. This guy is owed a boatload of cash, and typical Apple just kicks the can down the road. Next time I hope he sells his next vuln to the highest bidder.

gjs278 5y ago

there is no next highest bidder, you live in a cyberpunk fantasy land

ambientenv 5y ago

> Next time I hope he sells his next vuln to the highest bidder And thereby accomplishing what, exactly? There is still merit, albeit not from a material wealth standpoint, for doing the right thing for the right reasons.

vadfa 5y ago
>And thereby accomplishing what, exactly? ...$$$$?
- basisword 5y ago
  I could accomplish the same thing by robbing a bank - doesn’t make it the right thing to do.
  - spicybright 5y ago
    Doesn't make free work for a for trillion dollar corporation something noble to do. By that logic, a grocery store giving away everything for free is the right thing to do. Doesn't lead to anything sustainable though.
    - dpkonofa 5y ago
      What suggests that any of this is "free work for a trillion dollar corporation"? Apple hasn't acknowledged that this person discovered this bug yet. They've only acknowledged that it existed and that they were going to patch it in the future. Crediting someone for a bug bounty isn't as easy as you all are making it out to be.
  - akomtu 5y ago
    Unless it's a mafia's bank.
    - justshowpost 5y ago
      You're also either a victim or an oppressor. No wrong can be done by anyone in the former group, and no good by the latter. Such ideas of victimization do nothing but justify the use of power and engender intergroup conflict.
  - young_unixer 5y ago
    Robbing a bank is immoral, selling information about how a piece of software works, in my humble opinion, is not. Or if it is, then it's not even close to the level of "wrong" that is robbing a bank.
    - mrtesthah 5y ago
      And what if that information gets weaponized against journalists in an authoritarian regime?
      - ClumsyPilot 5y ago
        You know what gets weaponised? Actual weapons our government sold to Saudi and other's.
        true_religion 5y ago
        Also the software to subvert security on mobile devices, build firewalls on a national level, and inspect every internet packet for disloyal statements. All that is packaged and sold to our authoritarian allies with the full approval of the government the majority of people support. Selling a zero day would probably fall under a weapons clause.
        mrtesthah 5y ago
        One of these things doesn't negate or excuse the other; both can happen at the same time. You're engaging in "whataboutism".
        ClumsyPilot 5y ago
        If you sell a knife, and it's used for a stabbing, are you culpable? Thousands of people buy knives every day, and most of them don't stab anyone. So unless there was good reason to suspect something, we would say no. Most zerodays are probably not bought by china to spy on dissidents, they are more like knives. On the contrary, when we sell bombs to Saudis we can be 95% sure they will be used in Yemen.
- Bud 5y ago
  Except that as this thread demonstrates, there is no realistic possibility of this researcher actually making more $$$ in real life by trying to find another bidder.
  - smoldesu 5y ago
    Zerodium pays more for the exploits, and unlike Apple, is willing to compensate you in non-traceable currency.
    - dpkonofa 5y ago
      Not for this exploit. They pay more for code-execution exploits. No one is going to pay the sums you guys are thinking they will over a bug that gives you someone's GameCenter contacts. It's not a trivial bug but it's also not a very valuable one.
AustinDev 5y ago
Trillion dollar companies don't care about merit for doing the right thing. Why should this guy in the future?
- pcbro141 5y ago
  Maybe he doesn't want dissident journalists and activists to get spied on and chopped to pieces? That sounds like a good enough reason to report these bugs for someone with morals.
  - lern_too_spel 5y ago
    Dissident journalists and activists can use devices from vendors that care about security enough to run a working bug bounty program.
    - rurp 5y ago
      Unfortunately exercising consumer choice works a lot better in a healthy free market than it does in one controlled by an oligopoly. I totally agree that people should try to avoid buying from companies that do immoral things, but it can be quite hard in a consolidated market.
aviraldg 5y ago
Forcing Apple to do the right thing the next time.
celim307 5y ago
I agree somewhat, the users which include me get caught in the crossfire if someone releases a zero day out in the wild, but I also think there needs to be a negative feedback to these tech giants that expect work for free. But in the grand scheme of things, does it even punish the tech giants? They have so many claws in a users life, and in the case of apple, your only other choice is google or a bunch of shady oems. At the end of the day the only people who pay for it are users themselves, their data is comprised and irreversibly out there
kbenson 5y ago
You can rely on the vast majority of people to do the right thing when it's in their best interests. You can likely rely on a good majority of people to do the right thing when it isn't for or against their interests in any substantial way. I'm not sure the amount of people that will do the right thing when it's not in their best interests by some small but noticeable amount. I'm also not sure the amount of people that will do the right thing when it's vastly against their best interests, but it's bound to be far less that the prior group, and I suspect it's way below a majority. The point isn't that these people aren't doing the "right thing", it's that these programs are designed to align doing the right thing with the best interests of the researchers, so noting that we might get more results that are not in the best interests of society at large or the company in question if they don't hold up to what they agreed to is not only a valid observation, it's the likely outcome if we're to expect these programs exist for a reason. To put this in perspective, say you find a suitcase with a million dollars in it. You can turn it in, or you can keep it for yourself. If there's no real expectation you'll get anything if you turn it in, how does the reasoning go in your head? What if you know you'll get 10% for finding it and turning it in? What if you live in abject poverty? What if you have $60k worth of medical bills for a family member to pay off?
ClumsyPilot 5y ago
"There is still merit, albeit not from a material wealth standpoint, for doing the right thing for the right reasons" There seems to be the strange wordview where ordinary joe must be morally impeccable but its corporate leadership can be as immoral as they come. Like the richer you are, the less rules you have to follow. Surelly it should be the other way round?

afrcnc 5y ago

No, he's not. Those are low-priority bugs and the only thing that made them stand out was the fact that he dropped them online without a patch. RCEs get priority in patching, and his priv esc issues were not as important.

r00fus 5y ago
He dropped them online after a significant period of delay. Already discussed here on HN. [1] [1] https://news.ycombinator.com/item?id=28637276 https://news.ycombinator.com/item?id=28637276

tptacek 5y ago

Who's the next highest bidder after Apple for a bug in `gamed` that allows you to access GameCenter and download contacts? It's a significant vulnerability, but there's e.g. no price list entry on Zerodium (you can take Zerodium more or less seriously, this is just a data point) for anything but code execution, which this vulnerability isn't.

saagarjha 5y ago
Shady advertising SDK? (Also, don't people use code execution to exfiltrate contacts and messages? This is basically what this bug does, albeit with "several clicks" involved.)
WesolyKubeczek 5y ago
> Who's the next highest bidder after Apple for a bug in `gamed` that allows you to access GameCenter and download contacts? Anyone who actually pays money or golden bars within a reasonable timeframe? > It's a significant vulnerability, but there's e.g. no price list entry on Zerodium On this scale I think it's "Contact us and we negotiate" sort of price.
- tptacek 5y ago
  Who? Speculate as to who they might be. The six figure numbers you're familiar with are for code execution bugs. This is obviously not that. So they're not anybody that quotes prices for bugs, or anyone directly comparable to them. Governments can already pay prices comparable to the supposed bounty valuation of this bug for code execution. They're probably not shelling out six figures in gold bars for a bug that exfiltrates contact lists from apps that have to be installed from the app store. The non-bounty market clearing price for a lot of scary sounding vulnerabilities is $0.
  - renewiltord 5y ago
    Your comments are the only ones here which aren’t divorced from reality. It’s weird. Who are these supposed guys paying six figures for this sort of thing? It’s just not a valuable thing.

bawolff 5y ago

Can't we hope they go for full-disclosure instead of selling to the highest bidder? Selling to the highest bidder just hurts apple users not apple.

akira2501 5y ago
> just hurts apple users not apple. As a first-order effect, sure.. but Apple is not immune to the damage that this causes either. More importantly, their failure to pay or honor their commitments would be the root cause of this in the future. They opened this "bug bounty" door on their own, they are solely responsible for it's success or failure.
- bawolff 5y ago
  Sure there are secondary affects. However they are mild comparatively The two options: - someone full discloses a 0-day. Apple is embarrased, users can take mitigating action until its patched. Apple is probably forced to patch. End result: really embarasing for apple. Small risk to users that's pretty ephemeral. - sell to highest bidder. Black market or at best grey hat. Exploit is used against users. Nobody really knows its happening. Maybe that eventually comes back to give apple a bad reputation, but not likely to happen in the short term. One of these courses of action disproportionately hurts users a lot and apple not very much. The other hurts basically only apple and users very little. Even if you argue that the black market might eventually hurt apple a little bit, its still a very small hurt. If your goal is to piss off apple, it seems clear that full-disclosure is the thing to do here. If your goal is just to clear your concious on the morality of selling exploits to bad people who intend to use them to do bad things - while i'm sure you'd find a way to justify that no matter what apple did. The human mind is good at self-justification. > More importantly, their failure to pay or honor their commitments What commitment? A bug bounty program isn't a commitment to do anything. Its not a contract or a work agreement. At best its sort of like a contest. But even disregarding that, i'm not sure this bug even is in any of the categories they list. What they say is: iOS user installed app can access sensitive data including Contacts, Mail, Messages, Notes, Photos, or real-time or historical precise location data. i'm not sure this fits. Is apple being a dick? Yes. Are they breaking commitments they made? Not super clear.

azinman2 5y ago

So you’re hoping for malware?

0xdeadb00f 5y ago

Sell it to the highest bidder then release it on the darknet for free anyways :^)