10 ms·

Why are people out to crucify Apple for a story that's still being resolved? The article clearly says: "...Due to a processing issue, your credit will be inc

Why are people out to crucify Apple for a story that's still being resolved? The article clearly says: "...Due to a processing issue, your credit will be included on the security advisories in an upcoming update. We apologize for the inconvenience," Apple told him when asked why the list of fixed iOS security bugs didn't include his zero-day..." "...We saw your blog post regarding this issue and your other reports. We apologize for the delay in responding to you," Apple told Tokarev 24 hours after publishing the zero-days and the exploit code on his blog... "...We want to let you know that we are still investigating these issues and how we can address them to protect customers. Thank you again for taking the time to report these issues to us, we appreciate your assistance..." The company hasn't denied the bounty, they're just incompetent / slow on this process. Feels like everyone is out to paint <x> company with just confirmatory bias using whatever half-baked story is available. Even I feel for company leaders in this kind of shitty journalism environment. And the rest of the comments here are just autopilot piling on the echo fest.

smoldesu 5y ago
>Why are people out to crucify Apple for a story that's still being resolved? >The company hasn't denied the bounty, they're just incompetent / slow on this process. People probably expect more from... checks notes The world's most valuable and successful modern corporation.
- ewagsjr 5y ago
  Ya, if I interpreted this right, also really convenient that they seem to be dragging their feet on a $100,000 bounty.
  - dpkonofa 5y ago
    Nobody's going to pay $100,000 for a bug that lets you download someone's contact list.
    - brokenmachine 5y ago
      How much would a bug like that be worth? I can imagine getting anyone's contact list being valuable.
      - dpkonofa 5y ago
        Why? What would be valuable about that? Specifically, what would be valuable about getting someone's GameCenter contacts? These aren't business or family contacts. These are people the person games with. It's a privacy violating bug but not a show-stopping bug. Important but not valuable.
        saagarjha 5y ago
        You're misunderstanding the vulnerability. The bug is in gamed, the Game Center daemon, but it allows access to the entire CoreDuet database, which does on-device intelligence stuff. Duet essentially logs everything you do on your phone, which means that if you look at the database it'll contain logs for all your interactions, not just those with Game Center contacts.
        dpkonofa 5y ago
        You are correct. I did misunderstand that portion of it but that doesn't change the fact that Apple is willing to pay $100k for a bounty like that but no one else does and Apple's actions don't suggest at all that they won't pay out the bounty. If you've ever been part of a program like this, on the developer side, it's possible that they discovered a larger bug that this was a part of or that someone else had already reported this bug. Tracking down the origin of this and the tickets involved takes time and fixing the bug is always the priority. They haven't acknowledged that he's the originator of the report so his insistence that he be credited immediately is a big immature and premature. There's nothing here that suggests Zerodium, or someone similar, would pay the same amount Apple is offering and there's nothing that suggests that Apple doesn't intend to pay this or credit him. That's all completely conjecture.
- efleurine 5y ago
  And iOS users should be grateful that they report those bugs to Apple to get paid. They could also sell it to some spying companies and may be those pay well and very fast
  - jsjohnst 5y ago
    > and may be those pay well and very fast Pay very well? Often, assuming they actually pay, sometimes you can get stiffed there too. Very fast? Nope. Easy to work with? Nope. Communicate with you any better than Apple through the process? Not usually.
    - smoldesu 5y ago
      Have you dealt with terrorist orgs in the past, or is this all conjecture?
      - jsjohnst 5y ago
        > They could also sell it to some spying companies The above type of organization is what I was referring to. So if you consider the grey market buyers[⋁] of exploits “terrorist orgs”, then yes. If you use the normal definition of “terrorist orgs”, then hell no. [⋀] three letter government agencies, defense contractors, and those who sell to them
  - tptacek 5y ago
    Or maybe they don't pay for these bugs at all.
mike_d 5y ago
Devil's advocate here: I've worked the other side of managing bug bounties. It is entirely possible the researcher found something but didn't realize how deep the problem went. Apple may have released an incremental patch and is working on fixing a larger issue they found when digging into it. When this has happened in the past, from the researchers perspective things seem quiet/delayed because we obviously can't share details of a larger vulnerability with them. All we can really do is ask for more time. In the end it all works out and they get paid out/credited for the original+follow on bug.
- maximilianroos 5y ago
  Why withhold payment though?
- thaumasiotes 5y ago
  > In the end it all works out and they get paid out/credited for the original+follow on bug. I've worked on the company end of bug bounties too, and it does happen that a report just falls through the cracks. Seemingly-inactive reports do need a certain amount of maintenance; you don't want to just trust that everything will work out in the end. (That said, as long as you get responses when you ping the company, things are working in the background.) (edit to followup: in about 18 months of this, I encountered one report that had fallen through the cracks. Obviously, there might have been others that never came to my attention at all, but the companies are tracking things much more carefully than researchers often assume.)
- vlovich123 5y ago
  Why wouldn't the company communicate to the researcher "we found a larger issue related to this. your bounty will be upgraded to X. Please restart the clock for public disclosure" or something along those lines. Seems like better communication would create a win-win situation.
  - csdreamer7 5y ago
    My first thought would be that the team within Apple may worry the researcher may resell the vulnerability to an exploits site. Not part of the security industry so not sure what is common or not, but I would understand Apple being worried about sharing too much with a researcher they may not be familiar with. I would also understand the researcher's point of view that this fell through the cracks or Apple is not willing to fix; and is likely what happened.
bellyfullofbac 5y ago
Because those emails are probably lies, they're just delaying and delaying and hoping it will just go away, and writing fake "We're sorry"'s when they're forced to.
stefan_ 5y ago
> they're just incompetent / slow on this process > I feel for company leaders in this kind of shitty journalism You're not making sense. Plus Apple has a history of being incompetent and slow on this.
- coldtea 5y ago
  >Plus Apple has a history of being incompetent and slow on this Have they, really? Just because you find this instance here and there of such a story where they were, doesn't mean they have a history of being incompetent and slow on this (the same way someone who hit 99% of their three-pointers doesn't have a history of being an awful shooter). That's how they fare long term: https://www.pandasecurity.com/en/mediacenter/mobile-security/android-more-infected-than-ios/ https://www.pandasecurity.com/en/mediacenter/mobile-security...
  - smoldesu 5y ago
    Apple's bug bounty is notoriously slow to respond, to the point that it has posed legitimate security concerns in the past: particularly their rhetoric around Thunderspy amused me. https://habr.com/en/post/579714/ https://habr.com/en/post/579714/ https://thunderspy.io https://thunderspy.io
    - QuizzicalCarbon 5y ago
      How can we reasonably say Apple is moving slowly to fix bugs when we don’t know how much work is going on behind the scenes? A slow response can just be a slow response.
      - smoldesu 5y ago
        I can reasonably say it because all of their competitors have less cash, yet many of them respond faster than Apple does.
    - simondotau 5y ago
      Is this not a potential Sharpshooter fallacy? Are you sure that we aren't mainly hearing about bounties when Apple doesn't handle them smoothly and not so much when they are handled smoothly? Or to put it another way, when you poll people who complain Apple is notoriously slow to respond, don't be surprised if your conclusion is that Apple is notoriously slow to respond.
throwaway37284 5y ago
I understand what you're saying and in most cases, most companies, most products, you are correct and I would absolutely agree. In this case it is an IOS zero-day. I'm not sure of the number of people on the planet using IOS but the chances of that zero-day being applicable to the phone in your pocket at one point aren't too bad. I do think Apple should be held responsible, their massive amount of sales has given them a massive amount of responsibility that they are not stepping up to.
polack 5y ago
"Since then, Apple published multiple security advisories (iOS 14.7.1, iOS 14.8, iOS 15.0, and iOS 15.0.1) addressing iOS vulnerabilities but, each time, they failed to credit his analyticsd bug report." "Two days ago, after iOS 15.0.2 was released, Tokarev emailed again about the lack of credit for the gamed and analyticsd flaws in the security advisories." They didn't give him credit in the last 5 advisories. Really no excuse for that imho. If Apple keeps this up then why would anyone report bugs to them when you can just post it online and get credit for it right away? Or sell it on some 0-day site.
- efleurine 5y ago
  Obviously credit is important for them as a proof of competence. If the company does not give them credits how can they build their business, portfolio. You can jus say I was the one who discovered this. Every field works in a certain way and when it comes to bounty you want to make a name for yourself. You can't just pull up and say you are the one But yeah may be they should just sell it to third-parties
- glenstein 5y ago
  Exactly, that's the issue. This is a RT*A scenario.
- tptacek 5y ago
  If credit is what you care about, it's straightforward to ensure you get credit without working with Apple's bounty program. You can do what P0 does and provide a fixed timeline after which you're publishing, and nobody credible is going to hold that against you (in part because P0 has established this norm).
xondono 5y ago
The “Apple Hater” market is as big as the “Apple fanboy” market, maybe even bigger!
calibas 5y ago
You're framing this as if it's all about the bounty and Apple just hasn't gotten around to it yet. That's only a small fraction of the story and could easily be forgiven. If I wanted to make Apple look good, I'd focus on that part, but that would be rather biased to ignore the whole picture... Tokarev discovered 4 iOS 0-days, then reported them all to Apple back in May. After months of Apple's continued refusal to fix or even publicly acknowledge all four of the issues, Tokarev made all of them public on GitHub. Weeks passed, and now it's today. Apple has yet to fix or publicly acknowledge two of the four security vulnerabilities. That should make Apple look bad because it's some fundamentally irresponsible security practices. Yes, I'm biased. I'm human, not a computer, and it's stuff like this that makes me biased towards Apple. They should receive negative publicity for this, then they should change how they do things. At the very least, app developers and users should be warned about the two issues that have yet to be fixed.
- tptacek 5y ago
  I don't know anything about Apple's bug bounty program except that there's a prevailing attitude that it is not the well-oiled machine that Google's bug bounty program is perceived to be, and I'm not super interested in making a case for Apple here. But because this is a recurring theme in every discussion about every bug bounty run by anyone: * There are valid reasons that bugs can take longer to fix than you'd expect; the most notable of them is when the bug you found is actually systemic, or has a deep root cause, and the real fix for the vulnerability is more complicated than the surface bug. Without a hard timeline, some shops will work to get the root cause fixed on some bugs even at the cost of an increased timeline, because the patch for the surface bug reveals the pattern and amplifies risk to customers. * As a reporter, you can take some measure of control over the process back by providing a fixed timeline (like the P0 90 days). There's no negotiation needed; you give the vendor time to fix and they either do or don't, but either way you're going public. That is a valid way to go about things, but may cost you the bounty. * These things are bug-dependent, and the process that runs for a zero-interaction RCE won't be the same as the process that runs for a bug that requires a malicious app store app and only gives access to the contact database. * Message boards tend to expect that big vendors can just shell out for the bounty as a show of good faith. It's easy to see why they believe that. It makes sense. But it also creates broken incentives. The limiting reagent on bugs isn't bounty dollars (these are indeed barely even rounding errors to major vendors), but rather programmer time. If you pay out for weak, stuck-in-process bugs, you create incentives that redirect programmer time to those weak bugs and away from more significant bugs; as angry as you can reasonably be about a malicious app being able to snarf your contacts, if you're rational, you're a lot more concerned about memory corruption flaws, which is what you really want people spending their time on.
amatecha 5y ago
Probably because the 0days have been fixed and the public have received the benefit of the security researcher's report to Apple, but he hasn't received any recognition or compensation through the bounty program via which he reported the vulnerabilities?
Spooky23 5y ago
Some security people love to hand-wave and issue prophecies of doom for attribution and attention. It’s great chum for writers — easier to run with some guys grievance than research a more substantive story.
- tptacek 5y ago
  There's a spectrum of quality to these stories, and one sign that you're tending towards an end of that spectrum is the use of the term "zero-day" without qualification. These are bug bounties; all of these bugs are zero days, no matter how severe (or not) they are. It's literally the least important detail in the story about how a bounty is being handled.
  - jessaustin 5y ago
    Are there lots of articles that describe zero-days but don't include the actual term "zero-day"? I may have been underestimating the state of journalism...
tgsovlerkhgsel 5y ago
Let me selectively quote you: > Why are people out to crucify Apple (...), they're just incompetent / slow on this process. That's exactly the problem when they're endangering the security of approximately one billion users.
sam0x17 5y ago
> The company hasn't denied the bounty, they're just incompetent / slow on this process. With 0-day security vulnerabilities, slowness equals incompetence. Companies with unbounded resources like Apple have absolutely no excuse for not being able to move as quickly as a small startup on issues like this, unless their message to shareholders is "yes invest in us so you can see our performance literally decrease with every dollar invested".

smoldesu 5y ago

>Why are people out to crucify Apple for a story that's still being resolved? >The company hasn't denied the bounty, they're just incompetent / slow on this process. People probably expect more from... checks notes The world's most valuable and successful modern corporation.

ewagsjr 5y ago
Ya, if I interpreted this right, also really convenient that they seem to be dragging their feet on a $100,000 bounty.
- dpkonofa 5y ago
  Nobody's going to pay $100,000 for a bug that lets you download someone's contact list.
  - brokenmachine 5y ago
    How much would a bug like that be worth? I can imagine getting anyone's contact list being valuable.
    - dpkonofa 5y ago
      Why? What would be valuable about that? Specifically, what would be valuable about getting someone's GameCenter contacts? These aren't business or family contacts. These are people the person games with. It's a privacy violating bug but not a show-stopping bug. Important but not valuable.
      - saagarjha 5y ago
        You're misunderstanding the vulnerability. The bug is in gamed, the Game Center daemon, but it allows access to the entire CoreDuet database, which does on-device intelligence stuff. Duet essentially logs everything you do on your phone, which means that if you look at the database it'll contain logs for all your interactions, not just those with Game Center contacts.
        dpkonofa 5y ago
        You are correct. I did misunderstand that portion of it but that doesn't change the fact that Apple is willing to pay $100k for a bounty like that but no one else does and Apple's actions don't suggest at all that they won't pay out the bounty. If you've ever been part of a program like this, on the developer side, it's possible that they discovered a larger bug that this was a part of or that someone else had already reported this bug. Tracking down the origin of this and the tickets involved takes time and fixing the bug is always the priority. They haven't acknowledged that he's the originator of the report so his insistence that he be credited immediately is a big immature and premature. There's nothing here that suggests Zerodium, or someone similar, would pay the same amount Apple is offering and there's nothing that suggests that Apple doesn't intend to pay this or credit him. That's all completely conjecture.
efleurine 5y ago
And iOS users should be grateful that they report those bugs to Apple to get paid. They could also sell it to some spying companies and may be those pay well and very fast
- jsjohnst 5y ago
  > and may be those pay well and very fast Pay very well? Often, assuming they actually pay, sometimes you can get stiffed there too. Very fast? Nope. Easy to work with? Nope. Communicate with you any better than Apple through the process? Not usually.
  - smoldesu 5y ago
    Have you dealt with terrorist orgs in the past, or is this all conjecture?
    - jsjohnst 5y ago
      > They could also sell it to some spying companies The above type of organization is what I was referring to. So if you consider the grey market buyers[⋁] of exploits “terrorist orgs”, then yes. If you use the normal definition of “terrorist orgs”, then hell no. [⋀] three letter government agencies, defense contractors, and those who sell to them
- tptacek 5y ago
  Or maybe they don't pay for these bugs at all.

mike_d 5y ago

Devil's advocate here: I've worked the other side of managing bug bounties. It is entirely possible the researcher found something but didn't realize how deep the problem went. Apple may have released an incremental patch and is working on fixing a larger issue they found when digging into it. When this has happened in the past, from the researchers perspective things seem quiet/delayed because we obviously can't share details of a larger vulnerability with them. All we can really do is ask for more time. In the end it all works out and they get paid out/credited for the original+follow on bug.

maximilianroos 5y ago
Why withhold payment though?
thaumasiotes 5y ago
> In the end it all works out and they get paid out/credited for the original+follow on bug. I've worked on the company end of bug bounties too, and it does happen that a report just falls through the cracks. Seemingly-inactive reports do need a certain amount of maintenance; you don't want to just trust that everything will work out in the end. (That said, as long as you get responses when you ping the company, things are working in the background.) (edit to followup: in about 18 months of this, I encountered one report that had fallen through the cracks. Obviously, there might have been others that never came to my attention at all, but the companies are tracking things much more carefully than researchers often assume.)
vlovich123 5y ago
Why wouldn't the company communicate to the researcher "we found a larger issue related to this. your bounty will be upgraded to X. Please restart the clock for public disclosure" or something along those lines. Seems like better communication would create a win-win situation.
- csdreamer7 5y ago
  My first thought would be that the team within Apple may worry the researcher may resell the vulnerability to an exploits site. Not part of the security industry so not sure what is common or not, but I would understand Apple being worried about sharing too much with a researcher they may not be familiar with. I would also understand the researcher's point of view that this fell through the cracks or Apple is not willing to fix; and is likely what happened.

bellyfullofbac 5y ago

Because those emails are probably lies, they're just delaying and delaying and hoping it will just go away, and writing fake "We're sorry"'s when they're forced to.

stefan_ 5y ago

> they're just incompetent / slow on this process > I feel for company leaders in this kind of shitty journalism You're not making sense. Plus Apple has a history of being incompetent and slow on this.

coldtea 5y ago
>Plus Apple has a history of being incompetent and slow on this Have they, really? Just because you find this instance here and there of such a story where they were, doesn't mean they have a history of being incompetent and slow on this (the same way someone who hit 99% of their three-pointers doesn't have a history of being an awful shooter). That's how they fare long term: https://www.pandasecurity.com/en/mediacenter/mobile-security/android-more-infected-than-ios/ https://www.pandasecurity.com/en/mediacenter/mobile-security...
- smoldesu 5y ago
  Apple's bug bounty is notoriously slow to respond, to the point that it has posed legitimate security concerns in the past: particularly their rhetoric around Thunderspy amused me. https://habr.com/en/post/579714/ https://habr.com/en/post/579714/ https://thunderspy.io https://thunderspy.io
  - QuizzicalCarbon 5y ago
    How can we reasonably say Apple is moving slowly to fix bugs when we don’t know how much work is going on behind the scenes? A slow response can just be a slow response.
    - smoldesu 5y ago
      I can reasonably say it because all of their competitors have less cash, yet many of them respond faster than Apple does.
  - simondotau 5y ago
    Is this not a potential Sharpshooter fallacy? Are you sure that we aren't mainly hearing about bounties when Apple doesn't handle them smoothly and not so much when they are handled smoothly? Or to put it another way, when you poll people who complain Apple is notoriously slow to respond, don't be surprised if your conclusion is that Apple is notoriously slow to respond.

throwaway37284 5y ago

I understand what you're saying and in most cases, most companies, most products, you are correct and I would absolutely agree. In this case it is an IOS zero-day. I'm not sure of the number of people on the planet using IOS but the chances of that zero-day being applicable to the phone in your pocket at one point aren't too bad. I do think Apple should be held responsible, their massive amount of sales has given them a massive amount of responsibility that they are not stepping up to.

polack 5y ago

"Since then, Apple published multiple security advisories (iOS 14.7.1, iOS 14.8, iOS 15.0, and iOS 15.0.1) addressing iOS vulnerabilities but, each time, they failed to credit his analyticsd bug report." "Two days ago, after iOS 15.0.2 was released, Tokarev emailed again about the lack of credit for the gamed and analyticsd flaws in the security advisories." They didn't give him credit in the last 5 advisories. Really no excuse for that imho. If Apple keeps this up then why would anyone report bugs to them when you can just post it online and get credit for it right away? Or sell it on some 0-day site.

efleurine 5y ago
Obviously credit is important for them as a proof of competence. If the company does not give them credits how can they build their business, portfolio. You can jus say I was the one who discovered this. Every field works in a certain way and when it comes to bounty you want to make a name for yourself. You can't just pull up and say you are the one But yeah may be they should just sell it to third-parties
glenstein 5y ago
Exactly, that's the issue. This is a RT*A scenario.
tptacek 5y ago
If credit is what you care about, it's straightforward to ensure you get credit without working with Apple's bounty program. You can do what P0 does and provide a fixed timeline after which you're publishing, and nobody credible is going to hold that against you (in part because P0 has established this norm).

xondono 5y ago

The “Apple Hater” market is as big as the “Apple fanboy” market, maybe even bigger!

calibas 5y ago

You're framing this as if it's all about the bounty and Apple just hasn't gotten around to it yet. That's only a small fraction of the story and could easily be forgiven. If I wanted to make Apple look good, I'd focus on that part, but that would be rather biased to ignore the whole picture... Tokarev discovered 4 iOS 0-days, then reported them all to Apple back in May. After months of Apple's continued refusal to fix or even publicly acknowledge all four of the issues, Tokarev made all of them public on GitHub. Weeks passed, and now it's today. Apple has yet to fix or publicly acknowledge two of the four security vulnerabilities. That should make Apple look bad because it's some fundamentally irresponsible security practices. Yes, I'm biased. I'm human, not a computer, and it's stuff like this that makes me biased towards Apple. They should receive negative publicity for this, then they should change how they do things. At the very least, app developers and users should be warned about the two issues that have yet to be fixed.

tptacek 5y ago
I don't know anything about Apple's bug bounty program except that there's a prevailing attitude that it is not the well-oiled machine that Google's bug bounty program is perceived to be, and I'm not super interested in making a case for Apple here. But because this is a recurring theme in every discussion about every bug bounty run by anyone: * There are valid reasons that bugs can take longer to fix than you'd expect; the most notable of them is when the bug you found is actually systemic, or has a deep root cause, and the real fix for the vulnerability is more complicated than the surface bug. Without a hard timeline, some shops will work to get the root cause fixed on some bugs even at the cost of an increased timeline, because the patch for the surface bug reveals the pattern and amplifies risk to customers. * As a reporter, you can take some measure of control over the process back by providing a fixed timeline (like the P0 90 days). There's no negotiation needed; you give the vendor time to fix and they either do or don't, but either way you're going public. That is a valid way to go about things, but may cost you the bounty. * These things are bug-dependent, and the process that runs for a zero-interaction RCE won't be the same as the process that runs for a bug that requires a malicious app store app and only gives access to the contact database. * Message boards tend to expect that big vendors can just shell out for the bounty as a show of good faith. It's easy to see why they believe that. It makes sense. But it also creates broken incentives. The limiting reagent on bugs isn't bounty dollars (these are indeed barely even rounding errors to major vendors), but rather programmer time. If you pay out for weak, stuck-in-process bugs, you create incentives that redirect programmer time to those weak bugs and away from more significant bugs; as angry as you can reasonably be about a malicious app being able to snarf your contacts, if you're rational, you're a lot more concerned about memory corruption flaws, which is what you really want people spending their time on.

amatecha 5y ago

Probably because the 0days have been fixed and the public have received the benefit of the security researcher's report to Apple, but he hasn't received any recognition or compensation through the bounty program via which he reported the vulnerabilities?

Spooky23 5y ago

Some security people love to hand-wave and issue prophecies of doom for attribution and attention. It’s great chum for writers — easier to run with some guys grievance than research a more substantive story.

tptacek 5y ago
There's a spectrum of quality to these stories, and one sign that you're tending towards an end of that spectrum is the use of the term "zero-day" without qualification. These are bug bounties; all of these bugs are zero days, no matter how severe (or not) they are. It's literally the least important detail in the story about how a bounty is being handled.
- jessaustin 5y ago
  Are there lots of articles that describe zero-days but don't include the actual term "zero-day"? I may have been underestimating the state of journalism...

tgsovlerkhgsel 5y ago

Let me selectively quote you: > Why are people out to crucify Apple (...), they're just incompetent / slow on this process. That's exactly the problem when they're endangering the security of approximately one billion users.

sam0x17 5y ago

> The company hasn't denied the bounty, they're just incompetent / slow on this process. With 0-day security vulnerabilities, slowness equals incompetence. Companies with unbounded resources like Apple have absolutely no excuse for not being able to move as quickly as a small startup on issues like this, unless their message to shareholders is "yes invest in us so you can see our performance literally decrease with every dollar invested".