3 ms·

>Who? Cellebrite and all the surveillance-as-a-service shops might be interested in information disclosure bugs. You maybe will not get the $100K Apple promise

>Who? Cellebrite and all the surveillance-as-a-service shops might be interested in information disclosure bugs. You maybe will not get the $100K Apple promised, but maybe you can sell it four times for $30K or something like that if the bug is still "good enough" for certain uses. RCEs in Windows or iOS go for a lot more than a measly $100K if you can manage to get in contact with the right people. Think 10-20 times that.

saagarjha 5y ago
Cellebrite is more in the business of data extraction.
tptacek 5y ago
Full chain RCEs in iOS go for 1MM from the Apple bounty program, so you'd imagine they'd have to go for more than that from a tranched grey market contract. This is a bug that allows you to read contacts from a malicious app installed from the app store. It's not drive-by contract exfiltration; it's intensively interactive. I'm surprised the Apple bounty terms are so generous-sounding about bugs like these, but I read them, and I'm not contesting the $100k the article claims this is worth. Apple can't really outbid the grey market on RCEs, but they have clearly outbid it on this bug.
- rndgermandude 5y ago
  Yes, I agree with this assessment of this particular bug. As far as this bug goes, from the description, this particular one probably not very valuable to anybody. You have to get an app into the app store and then trick people to install it for not that much information you can exfiltrate. If it was a bug that allowed attackers to exfiltrate contacts and email addresses and such just by having the victim visit a website or open an email, that would be another matter, and still quite valuable even tho it wouldn't be RCE. But who knows, it still might worth a few bucks to you because you already figure out the delivery. And your relationship to somebody with the skills to find interesting bugs and willingness to sell to you might be even worth more, so you might pay money not just for the bug but for the relationship.

saagarjha 5y ago

Cellebrite is more in the business of data extraction.

tptacek 5y ago

Full chain RCEs in iOS go for 1MM from the Apple bounty program, so you'd imagine they'd have to go for more than that from a tranched grey market contract. This is a bug that allows you to read contacts from a malicious app installed from the app store. It's not drive-by contract exfiltration; it's intensively interactive. I'm surprised the Apple bounty terms are so generous-sounding about bugs like these, but I read them, and I'm not contesting the $100k the article claims this is worth. Apple can't really outbid the grey market on RCEs, but they have clearly outbid it on this bug.

rndgermandude 5y ago
Yes, I agree with this assessment of this particular bug. As far as this bug goes, from the description, this particular one probably not very valuable to anybody. You have to get an app into the app store and then trick people to install it for not that much information you can exfiltrate. If it was a bug that allowed attackers to exfiltrate contacts and email addresses and such just by having the victim visit a website or open an email, that would be another matter, and still quite valuable even tho it wouldn't be RCE. But who knows, it still might worth a few bucks to you because you already figure out the delivery. And your relationship to somebody with the skills to find interesting bugs and willingness to sell to you might be even worth more, so you might pay money not just for the bug but for the relationship.