Apple Officially Launches Public Bug Bounty Program Covering All Apple Software

[MacRumors]

Apple today officially opened its bug bounty program to all security researchers, after the company announced the expansion plan at the Black Hat conference in Las Vegas earlier this year.

Prior to now, Apple's bug bounty program was invitation-based and non-iOS devices were not included. As reported by ZDNet, from today any security researcher who locates bugs in iOS, macOS, tvOS, watchOS, or iCloud will be eligible to receive a cash payout for disclosing the vulnerability to Apple.

Apple has also increased the maximum size of the bounty from $200,000 per exploit to $1 million depending on the nature of the security flaw. A zero-click kernel code execution with persistence will earn the maximum amount.

Apple says it will add a 50 percent bonus on top of the standard payout for bugs found in beta software, which allows the company to nix the issue before the OS version goes public. It is also offering the same bonus for so-called "regression bugs" - these are bugs that Apple has patched in the past but which have been accidentally reintroduced in a later version of the software.

Apple has published more information on its website detailing the bug bounty program's rules, as well as a full breakdown of the rewards being offered to researchers based on the exploits they uncover.

When submitting reports, researchers must include a detailed description of the issue, an explanation of the state of the system when the exploit works, and enough information for Apple to reliably reproduce the issue.

Next year, Apple plans to provide vetted and trusted security researchers and hackers with "dev" iPhones, or special iPhones that provide deeper access to the underlying software and operating system that will make it easier for vulnerabilities to be discovered.

These iPhones are being provided as part of Apple's forthcoming iOS Security Research Device Program, which aims to encourage additional security researchers to disclose vulnerabilities, ultimately leading to more secure devices for consumers.

Article Link: Apple Officially Launches Public Bug Bounty Program Covering All Apple Software

 

[Justin Cymbal]

Definitely incentivizes people to find vulnerabilities the legit way while also getting compensated

Huge increase of the maximum payout too! $200,000 to $1 million

I'm glad that Apple is finally doing this program...

 

[urtules]

This is great news, sure it will cost a lot of money to run, but it will pay off in security and loyalty. It was always a mystery why only iOS devises were open for bounty. I suppose Apple wanted to finish Catalina first and prevent more exploits with stronger Catalina security features.

 

[andycarver]

I got want all ready: Computer is buggy.
Reproductive steps: Install macOS Catalina.

 

[loby]

I am sure we are going to hear on the forum over and over how someone here sent in something and never received a response and apple then patched the issue without anyone knowing...

This is good for everyone and hope some of the bugs that the apple team does not know how to solve will get solved by others outside of their "payroll". Apple saves a lot of money when others not on their payroll, retirement, health insurance etc. finds something and apple just has to pay a flat fee for the fix. Good thinking apple.

 

[Janschi]

I am sure we are going to hear on the forum over and over how someone here sent in something and never received a response and apple then patched the issue without anyone knowing...

i think that has happened before already.

 

[SteveJUAE]

Surely this will cost next to nothing given that so many tell us that Apple OS's are so good

 

[GalileoSeven]

Sure took em long enough. Better late than never though I guess

 

[Steve121178]

Should have happened years ago. I expect a lot of people are going to earn very well from this.

 

[recoil80]

It's about time, good news!

 

[ruka.snow]

Sounds like with this and the new pro machines that there is a big change in the management thought process.

 

[AngerDanger]

I got want all ready: Computer is buggy.
Reproductive steps: Install macOS Catalina.

The bug you've discovered is that the computer is buggy?
No worries; to solve this problem, simply find a solution.

 

[adrianlondon]

Dear Apple,
MAIL!

*retires*

 

[az431]

I got want all ready: Computer is buggy.
Reproductive steps: Install macOS Catalina.

Next time try reading the entire article before posting.

 

[maflynn]

It's overdue but yet I'm happy to see them embrace this as it can only help strengthen and improve their software.

 

[chrixxa]

this is long overdue.

 

[dogslobber]

Those finding bugs should simply publish the exploit to the world. Let Apple find out at the same time. This is the proper way to deal with lazy companies who don’t have proper test procedures in place.

 

[soanis]

So do I get any money if I report that Siri on iOS 13.3 requires to unlock the phone when I ask for a weather update?

edit: seems /s was necessary in the first place

 

[az431]

Those finding bugs should simply publish the exploit to the world. Let Apple find out at the same time. This is the proper way to deal with lazy companies who don’t have proper test procedures in place.

Yeah great idea. Let’s put a billion Mac and iOS users at risk to satisfy your ridiculous and uninformed notion that security risks only occur due to laziness and lack of testing.
[automerge]1576852013[/automerge]

So do I get any money if I report that Siri on iOS 13.3 requires to unlock the phone when I ask for a weather update?

The article answers your question. Read past the headline.

 

[dogslobber]

Yeah great idea. Let’s put a billion Mac and iOS users at risk to satisfy your ridiculous and uninformed notion that security risks only occur due to laziness and lack of testing.

This is a pretty uneducated response.

 

[Mascots]

Yeah great idea. Let’s put a billion Mac and iOS users at risk to satisfy your ridiculous and uninformed notion that security risks only occur due to laziness and lack of testing.

The unfortunate part is that where these bugs exist, you must assume they are being exploited by bad actors out there. Previously Apple has been unresponsive to some major exploits that people have reported on their good will.

It was just this summer we learned of several bugs being used to exploit iPhone targets after funneling them to a website and that had been going on for at least 2 years.

 

[WingsAndBeer]

Glad the BootROM exploit was released before this!

 

[Konigi]

This will likely avoid Apple a few controversies such as the one that has plagued the latest OSs. Better release quality overall, hopefully!

 

[twolf2919]

I am sure we are going to hear on the forum over and over how someone here sent in something and never received a response and apple then patched the issue without anyone knowing...

This is good for everyone and hope some of the bugs that the apple team does not know how to solve will get solved by others outside of their "payroll". Apple saves a lot of money when others not on their payroll, retirement, health insurance etc. finds something and apple just has to pay a flat fee for the fix. Good thinking apple.

This is an official program with specific rules - unlike the current bug feedback program you might be thinking of. Presumably, every submission gets some sort of ticket and an eventual resolution notification.

This program is not for others to fix bugs - it's to identify them (and only security related ones at that). So I don't see how your second paragraph is relevant.

 

[timstevens]

As much as I appreciate exploits being vanquished, I am still scratching my head waiting for GUI and interaction bugs like the Mail.app opening all the time to be a part of the past.