Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Hackers Discover 55 Apple Vulnerabilities, Awarded Nearly $300,000 in Bounties [Updated]
- Thread starter MacRumors
- Start date
- Sort by reaction score
Took Apple a long time to establish a bug bounty program and they probably only did so as the bad press reports were mounting.
Well... they didn't exactly make very much money from Apple. There are many companies in existence whose entire business model is selling 0-day exploits to the highest bidder. In some jurisdictions that's called racketeering or organized crime as opposed to a business plan, but <shrug> relocate to a jurisdiction that's fine with it and doesn't care.
FWIW the #1 buyer of 0-days is of course the US government.
I'm pretty sure this is just the tip of the Swiss-cheese iceberg. Checkra1n is doing fun things to the T2 that Apple doesn't highlight much, 'cuz it can't fix them.
Just sayin' It's not like Apple is unique, that's every OS and the internet. If you want security, then don't toss it in someone else's cloud and don't connect it to tEh internet.
5 minutes after building a better mousetrap, inevitably, a better mouse emerges <-- infinite loop.
Only $50k for that eye watering list of holes? They should get $50k each and a xmas bonus.
Apple needs to raise their bounties. These guys pulled in $3k a month doing this? That's not a sufficient motivator, and relies too strongly on their ethics to sell what they know to what is surely the lower bidder.
The way I see it, this kind of security testing requires highly skilled people who can easily make better money doing other things. If that's not true, and these guys found these holes anyway, then there are way too many holes. Either way, Apple should be paying more to sort these out.
The goal should be to have a high enough bounty that your system is secure enough you don't have to pay the bounty.
The way I see it, this kind of security testing requires highly skilled people who can easily make better money doing other things. If that's not true, and these guys found these holes anyway, then there are way too many holes. Either way, Apple should be paying more to sort these out.
The goal should be to have a high enough bounty that your system is secure enough you don't have to pay the bounty.
1 - yes, they took longer than they should’ve
2 - conjecture
3 - my statement is still true
Bug bounties are not typically proportional to corporate net worth. They have going rates, with zero-day exploits being the most valuable.
Neither response is accurate.
Details at Ars: https://arstechnica.com/information...-of-internal-apple-network-get-288000-reward/
They aren't stingy. The situation was fluid and still updating. Apple has thus far paid over $288K and reportedly could end up paying more than $500K. Hardly stingy.
The $50K would have hardly been the going rate for 11 critical vulnerabilities. Had it been $50K total, that would have been stingy for 55 disclosures. Since that wasn't the case, it's moot. When it's all said and done, Apple will have paid an amount that shows appreciation for the work done and incentivizes others to disclose to them instead of vulnerability brokers and 3-letter agencies.
Details at Ars: https://arstechnica.com/information...-of-internal-apple-network-get-288000-reward/
If you read the post above yours and clicked on the link, you wouldn’t be so quick to criticize Apple. But carry on.
What are all the people that only trust Apple with their CC information going to do now that they know Apple isn’t perfectly secure? 🤣
$51,500 / 5 men / 3 months = $3,500 per month before taxes and expenses. If this was full time by seasoned professionals that perform above Apple IT skill levels then the bounty hunt can hardly be called "considerable payments"...
Imagine how bad it would be if one had to give their cc all over the net and vulnerabilities were never patched at these multiple third parties. 😂
Damn, if you didn’t clarify I would have thought you were saying they (apple) reported it to apple so they (hackers) could fix the vulnerabilities.
Competent whitehat hackers like them are paid a considerable amount by different companies. It was obviously worth it to them for their time to get the award. I very much doubt they were doing this for most of the 3 months.
imagine being scared to use your card outside the Apple App Store.
Yeah, imagine wanting to spend more time reconciling the charges than needed. But if it’s your desire to spread the wealth, charge around, give hour cc to multiple unknown third parties...I’m sure android can accommodate you.
ive been using CCs all over the place for decades. I’ve probably had ONE fraudulent charge In that entire Time. CC company took care of it swiftly.
It’s ok to come out into the real world. You’ll be ok lol
I always want to know when hackers try to find a vulnerability, where do they start?
either way, $50K is peanuts for 55 issues on a company the size of Apple. They should have gave them $500K, if someone found those vulnerabilities people will be suing Apple like crazy.
either way, $50K is peanuts for 55 issues on a company the size of Apple. They should have gave them $500K, if someone found those vulnerabilities people will be suing Apple like crazy.
Actually, I've had a spate of fraudulent charges over the years. Yeah, so it's nice not to worry about that with Apple. And if it does come to pass, I know it will be dealt with in a reasonable manner.
It's really ok, you're allowed to admit it's (the app store) a pretty good system.
MacRumors really should update this post. They've now received nearly $300k in payments. Apparently Apple does not pay in lump but in batches as they confirm and fix vulnerabilities.
Source: https://threatpost.com/3-month-apple-hack-vulnerabilities-critical/159988/
Source: https://threatpost.com/3-month-apple-hack-vulnerabilities-critical/159988/
This! Yes, I too, believe MR should update this article since new information has come out showing these researchers are getting way more money than originally stated. I applaud their work and I am happy Apple is compensating them appropriately.
EDIT: It appears MR has updated the article. Thank you!
Last edited: