Heartbleed was undetected because the source code was so bad, it made your eyes bleed looking at it.
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Zero-Day Acquisition Platform Triples iOS 10 Bug Bounty to $1.5 Million
- Thread starter MacRumors
- Start date
- Sort by reaction score
And you know full-well that this is an assumption without facts to back it up. Mac OS already scaled to an additional billion devices, overtook windows PCs and didn't see a corresponding explosion in malware.
People like to think of Microsoft as a nerdy tech company, and that Apple is full of hipster designers who don't understand computers. That's total horsecrap. Apple is probably more technical-minded than Microsoft; they've always built their own hardware and used that tight integration to develop software that wasn't otherwise possible, going to back to the classic Mac.
Apple get the technical decisions right. Whether it's the Mac's Intel transition, 64-bit transition or iOS's sandboxing and use of 64-bit ARM chips. Support for WebKit has done the world a huge favour, as has the investment in LLVM. Now they're open-sourcing swift and doing all development in the open on GitHub. They're developing a next-generation filesystem which we can test this year and which will be public and bootable in 2017.
Microsoft? They couldn't even figure out how to transition from 32-bit Intel to 64-bit Intel. They spent years harping on about this ".Net" crap, open-sourcing little bits and restructuring the platform every couple of years when they wondered why nobody cared about it. They tried to rewrite the entire OS using .Net (Windows Longhorn), it was an absolute performance pig and after several years they scrapped it and released Vista. They've been working on their new filesystem (ReFS) since 2012, but it's so far from done you still can't even boot from it yet. Since then they've been messing with the UI while their users groan and complain about it.
MS has changed and is a more interesting company these days. My point is that this assumption that Apple doesn't get security or "raw computing" in general because they don't bang on about it all the time is completely untrue. Look at the actual records. Apple has been making great, forward-thinking decisions for decades.
Last edited:
I'm not a legal expert, but I don't think so. A gun manufacturer sells a gun, and the user shoots somebody. The creator isn't responsible for anything (As long it was sold legally.)
My guess is buying the exploits is perfectly legal, selling them is where it becomes shady (especially when selling to foreign governments.) But the reality is they likely just sell to the US government which is what keeps them out of hot water.
Clearly, bugs happen, and they unfortunately happen in any software.
The fact that the price per bug is high doesn't necessarily show strong security, where closed source is concerned. Since it's much harder to detect them compared to open source, where the code base is at your disposal, security-through-obscurity can have long lived security issues that are unknown to the public at large, including the software provider. This makes them much more valuable, hence the higher price companies such as the one being discussed here are willing to pay.
Given that Android/Linux/*BSD variants are released together with their source code makes bugs more easily accessible and therefore more short-lived, thus less valuable, since they're more likely to be discovered by the public, and thus patched or circumvented.
Last edited:
Chill out. Jailbreaks need to be installed on your device on purpose. It's pretty hard to accidentally jailbreak your device, even for your average american. Jailbreaks are not like spyware in the sense that they just happen to get onto your device and do damage. This requires a root level change in iOS software, to break it - we're not talking about "allowing permission to contacts list".
With that said, I'm pro jailbreak because I still hate the way iOS looks - changing the look of it has been a requirement for me since iOS 7.
One reason I can think of is that if Apple gets into a bidding war, this might drive the price up and draw even more hackers to try and find bugs with iOS. Which would in turn expose even more flaws with the operating system, opening it up to even more vectors of attacks.
Second is worth. Just because some company out there is willing to pay 1.5 million for an iOS exploit doesn't necessarily mean that Apple thinks said exploit is worth that much to them.
If apple was capable of hacking their own software they would probably already be performing those internal techniques. I think it would actually be worthwhile for apple to develop a small hacking team internally that can do these type of extreme tests every once in a while to keep it from being public, but also potentially fix a rather large loophole. I'm sure companies like Oracle do this annually.
I know they have those bug programs where they'll pay up to $200k, but that seems like a bare minimum approach and "security bugs" doesn't seem like it would be nearly as in depth as something like a jailbreak root exploit.
I made no comment on whether security through obscurity works or doesn't work. I only shot down symphara's assertion that it is incorrect to use the term 'security through obscurity' to refer to a presumed advantage of a low market share.
[doublepost=1475246042][/doublepost]
You can. Remember Hacking Team? Though not with an axe.
[doublepost=1475246285][/doublepost]
Sometime towards the end of the British colonial rule over India the authorities wanted to fight a rat (or maybe another animal) 'epidemic' by offering a reward for every dead rat delivered to them. This resulted in people taking up profitable rat breeding operations. There are always unintended consequences, especially when money is involved.
OK.. so thats a possible case of OSX.. both.. Obscurity AND minority.
However, with iOS - definitely is a case of "Security through Obscurity". There's a fair amount of shared code between OSX and iOS10...
[doublepost=1475247439][/doublepost]When it comes to Longhorn - remember, Apple also took years to release Mac OS 10 with several failed attempts.
Eventually, the roots of OSX originated from Steve Job's Gig - NeXT. After Apple bought the company and based OSX upon technologies from NeXT.
Microsoft try the big bang approach, over engineer and promise too much. which is full of risk / red flags.
Last edited:
Again, you fail to understand what "security through obscurity" means, and you obstinately refuse to educate yourself on the topic. It has nothing to do whatsoever with market share, and I made no reference to such a thing. For example, take Microsoft, who followed this approach for its huge market share products - with disastrous results.
So the thing you should have shot down was the mumble-jumble in your head related to software security, but you're too deep into your misconceptions to actually understand the topic at hand.
Relax buddy. iOS devices have been hacked/jail broken for years now. I haven't heard of any major catastrophic issues because of it, have you?Just going to leave these here for future reference.
iPads to Replace Paper Reference Manuals in All AA Cockpits
Who are zerodium's customers? Are they vetted? How? What kinds of things would disqualify an extremely rich customer from purchasing an exploit?
This is why world leaders are increasingly talking about cyber security. These kinds of OS exploits and bugs can actually become weaponisable technologies. In some sense a company like Zerodium is a kind of PMC. PMCs are largely unregulated mercenaries who will defend abhorrent dictators in the third world with modern US weaponry for enough cash. A cyber version is much scarier, because they an easily target civilian populations anywhere in the world at any time.
[doublepost=1475250140][/doublepost]
You can't sue someone and win if they haven't broken any laws. So no.
The gist of Apple’s bounty programme is that they want to compensate people for their work, not pay them the black-market value of the exploits. Because usable exploits are becoming increasingly harder to find, only experienced hackers or programmers can find them, people who could easily use their talents elsewhere. The bounty programme is Apple’s acknowledgement that hackers have to spend real time to find these, hence why the rewards scale according to technical difficulty, as an encouragement to look for them.
Just going to leave these here for future reference.
iPads to Replace Paper Reference Manuals in All AA Cockpits
Good point. I remember when those forged paper reference manuals jumped up and smothered the 9/11 pilots. Think about how much easier that would be with a killer robot iPad.
In other words: huh?
Shouldn't they be in airplane mode?
I'd rather have paper manuals in the plane anyways though. Much quicker.
Apple should just keep offering more. The consequences would be devastating and cost astronomically much more to contain. After all, who's more cash rich? This isn't a battle zerodium can win, if were just talking ability to pay to play.
"Mac OS already scaled to an additional billion devices, overtook windows PCs and didn't see a corresponding explosion in malware." - THIS IS NOT TRUE!
This should be 100% illegal. It is obtaining private information without the users permission and then brokering that information to persons unknown.
When the government wants our information they have to have a valid legal reason. This circumvents that. So how can it be legal ?
It is a really messed up world we find ourselves in my friends
When the government wants our information they have to have a valid legal reason. This circumvents that. So how can it be legal ?
It is a really messed up world we find ourselves in my friends
As long as the company in question does not sell any part of the OS that belongs to Apple, I don't see any legal problems.
This company needs to be broken up by the government, the owners sent to jail.