Become a MacRumors Supporter for $25/year with no ads, private forums, and more!

Apple to Give Security Researchers 'Special' iPhones for Bug Testing, macOS Bug Bounty Program Coming

MacRumors

macrumors bot
Original poster
Apr 12, 2001
51,005
12,545



Apple is planning to give security researchers access to special iPhones that will make it easier for them to find security vulnerabilities and weaknesses, reports Forbes, citing sources with knowledge of Apple's plans.

Apple is going to announce the new program at the Black Hat security conference in Las Vegas, which kicked off earlier this week and is continuing until Thursday.


The "special" iPhones will be similar to "dev devices," aka iPhones that are not as locked down and that will better allow security researchers to locate bugs.
What makes these iPhones special? One source with knowledge of the Apple announcement said they would essentially be "dev devices." Think of them as iPhones that allow the user to do a lot more than they could on a traditionally locked-down iPhone. For instance, it should be possible to probe pieces of the Apple operating system that aren't easily accessible on a commercial iPhone. In particular, the special devices could allow hackers to stop the processor and inspect memory for vulnerabilities. This would allow them to see what happens at the code level when they attempt an attack on iOS code.
The iPhones won't be identical to the developer iPhones that are provided to Apple's internal staff, as they won't be as open. They are described as "lite" versions of the developer devices by Forbes, with security researchers unlikely to be able to decrypt the iPhone's firmware.

iPhone prototypes created for Apple's internal staff are popular with security researchers and hackers and can fetch quite a lot of money, as noted in a report earlier this year from Motherboard. Described as "pre-jailbroken devices," the iPhones are valuable because they can be used to find vulnerabilities both by those who have good intentions and those who have bad intentions.

Releasing a similar device to security researchers who participate in the bug bounty program will perhaps allow Apple to better locate serious bugs, leading to faster fixes.

Apple is also planning to announce a new macOS bounty program, which will provide rewards to people who find and report security vulnerabilities in macOS.

Apple's announcements could perhaps come on Thursday, which is when Ivan Krsti?, Apple's head of security engineering, is set to offer a "Behind the Scenes" look at iOS and macOS.

Article Link: Apple to Give Security Researchers 'Special' iPhones for Bug Testing, macOS Bug Bounty Program Coming
 

Planetary

macrumors newbie
Jan 29, 2014
9
2
These would actually be very useful to general app developers, not just security folks. The proper term for these is "dev-fused" phones, and you can for instance ssh into the phone, which is very useful.
 
Comment

ROGmaster

Suspended
Apr 12, 2018
976
675
Yeah Apple is very lucky that initiatives like Google Project Zero exist.
All of the vulnerabilities discovered by the researchers are “interactionless,” meaning they can be run without any interaction from a user, and they exploit a vulnerability in the iMessage client. Four of them (including the as-yet-unpatched vulnerability) rely on an attacker sending a message containing malicious code to an unpatched phone and can execute as soon as a user opens the message. The remaining two rely on a memory exploit.
We’re lucky that these vulnerabilities were discovered by security researchers who had no interest in exploiting them for their own benefit. ZDNet notes that bugs like these are invaluable to manufacturers of intercept tools and surveillance software, and the right buyer would likely pay millions for access to them before Apple is able to patch its software in defense. By disclosing these bugs to Apple, these security researchers have done a service to iOS users worldwide.
 
Last edited:
Comment

huge_apple_fangirl

macrumors member
Aug 1, 2019
58
69
So they’re basically giving out jail broken iPhones? Wonder how much those will end up going for on the black market afterwards...
 
Comment

Shirasaki

macrumors G4
May 16, 2015
10,301
4,140
Producing vulnerable phones? Will they ever stop copying Android?
I am amazed that even in 2019, this “android copy iOS” “iOS copy android” narrative is still around. Are we still in 2012?
About damn time Apple offered a bug bounty program for macOS!

:apple:
Yeah, especially macOS is a such “unpatched” operating system, security wise.
So they’re basically giving out jail broken iPhones? Wonder how much those will end up going for on the black market afterwards...
Nope. This is less locked down but not “jailbroken iPhone”. I guess these iPhones are registered and can download special iOS version OTA or something.
Internal testing iPhone, however, will still be quite popular in black market.
 
Comment

Internet Enzyme

macrumors 6502a
Feb 21, 2016
935
1,500
Im curious about the technical details of this program and how a device like this could be obtained
 
Comment

hortod1

macrumors 6502
Jan 26, 2009
322
616
Wonder how much Apple pays when a vulnerability is found - would think selling it to 3rd parties would be pretty lucrative. A whole technical world out there I know nothing about
 
Comment

jzuena

macrumors 65816
Feb 21, 2007
1,075
113
I was planning on going to Ivan Krstic's "Behind The Scenes of iOS and Mac Security" Thursday at 12:10 anyway. We'll see if they make the announcement then.
 
Comment

citysnaps

macrumors 604
Oct 10, 2011
6,834
11,691
San Francisco
Wonder how much Apple pays when a vulnerability is found - would think selling it to 3rd parties would be pretty lucrative. A whole technical world out there I know nothing about

I suspect anyone who did that would quickly feel the weight of Apple's legal department on their back.
 
Comment

CarlJ

macrumors 603
Feb 23, 2004
5,257
9,029
San Diego, CA, USA
I am now a researcher. Where is my phone? lol
I expect they may take an interest in you, and provide you with a phone, after you show them your substantial body of security research work (no, having googled for things is not research).
[doublepost=1565106554][/doublepost]
They go for one security expert's job.
Very much this. They're going to be tightly controlled, and involve signing a bunch of legal documents. It's not going to be a matter of walking into a cellular carrier store and asking for the Insecure Edition.
 
Comment

gnasher729

macrumors P6
Nov 25, 2005
17,539
4,821
wow, those researchers must have to go through a crazy amount of vetting and sign some massive NDAs

Most importantly, they will be _known_ to Apple, and if they do anything to create harm to other users, there will be an army of lawyers descending on them. You can't create and distribute harmful hacks if Apple knows you. You can only sell them to Apple.
[doublepost=1565107644][/doublepost]
They go for one security expert's job.
Plus all his savings, his home, his future income, and his pension in many years time. For how long can you live in a nice style in Panama?
 
Comment

boccabella

Cancelled
Oct 26, 2010
171
288
Is everyone participating going to be paid something when someone discovers a bug? If not then this is effectively free labor for Apple.
 
Comment

WoodpeckerBaby

macrumors 6502a
Aug 17, 2016
827
668
Is everyone participating going to be paid something when someone discovers a bug? If not then this is effectively free labor for Apple.
Usually security researchers are paid by external corporations like Google, etc. Some are paid by the government and work as professors. They are rarely doing it for the whole purpose of getting a reward. It’s more like reporting a byproduct of their work.
 
Comment

veggiespam

macrumors newbie
Jan 12, 2012
19
18
As a security professional, this is awesome. Maintaining an iPhone with the latest version of iOS is a time consuming to impossible task. If you end up muffing an upgrade, you have rendered your JB iPhone into a normal iPhone. So, most security people don't upgrade and you lose the ability to test new apps that only work on the newest version of iOS.

I want an up-to-date iPhone with the ability to disable some of the security features on a few apps. Most of the research I do is at the network traffic level - so SSL Kill Switch equivalent, turning off cert pinning, and neutering ATS without a full JB would make my day. Full logs of file i/o and ability to catch and modify file read/writes "in the air" would be even better.

So, where do I sign up?
 
Comment

Scotty2Hotty

macrumors member
Sep 16, 2014
75
84
This is aimed right at Jailbreakers. I'm very much into the whole scene and enjoy it. I view this as serious undertaking by Apple.
 
Comment

CarlJ

macrumors 603
Feb 23, 2004
5,257
9,029
San Diego, CA, USA
This is aimed right at Jailbreakers. I'm very much into the whole scene and enjoy it. I view this as serious undertaking by Apple.
Huh. I would expect it's aimed right at legit security researchers, in an attempt to help them uncover vulnerabilities, which Apple can fix, to harden the OS against serious threats like governent-backed spying, and ransomware. I don't expect Apple considers the jailbreakers to be much more than a minor annoyance (though it seems to be primarily a way to steal from developers, for some contingent of the "jailbreak community").
 
Comment
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.