On: We Hacked Apple for 3 Months

[vessenes]

I sorted exploits by date, it made a fun short headline summary of how productive they were. Short answer: very.

I know it’s hard for senior management to want to really commit to bug bounty programs like this because it feels embarrassing and vulnerable, but posts like this should be sent around the boardroom when discussing — apple rented an AMAZING security team here.

Sam, can you disclose what you got paid for all this?

[CGamesPlay → vessenes]

End of the post it says 51k so far. I'd expect the price to go up a LOT more, because otherwise the sane (monetary) advice becomes "report some vulnerabilities to apple, and then keep finding them and sell them to third parties".

[JoblessWonder → CGamesPlay]

Yeah, that is only for 4 vulnerabilities out of 55. And 3 of them were only "High." They still have 10 (!!) more critical vulnerabilities they may receive payment on.

Also, they state in the article: "However, it appears that Apple does payments in batches and will likely pay for more of the issues in the following months."

[JoblessWonder → JoblessWonder]

Update: They just paid for 28 more issues, running total is now $288,500.

https://twitter.com/samwcyo/status/1314310787243167744

[anonymousisme → CGamesPlay]

There are defense contractors that do exactly this. Governments pay more than Apple will ever pay, so if you are in it for the money (and don't care about the ethical repercussions), selling the discovered exploits to governments is the way to go.

[stjohnswarts → CGamesPlay]

Yeah I imagine you can make a lot more money selling them to state actors than to apple.

[oarsinsync → CGamesPlay]

That's only true if you have no way to be put in (financial) risk by the vulnerability you're not disclosing to Apple.

[bogwog → oarsinsync]

If you're a security researcher, you probably know how to cover your tracks.

[XMPPwocky → bogwog]

Do you? The skills involved in VR and exploit dev don't necessarily mean you're good at opsec.

[nbk_2000 → XMPPwocky]

True, plus "opsec life sucks" so most of us don't do it.

[hawkoy → bogwog]

Where do security researchers sell their investigation on the black market? Links?

[nbk_2000 → hawkoy]

The following companies buy 0-days. Each has a slightly different business model:

Zerodium - http://zerodium.com/ Azimuth Security - https://www.azimuthsecurity.com/ NSO Group - https://www.nsogroup.com/ ZDI - https://www.zerodayinitiative.com/ SSD - https://ssd-disclosure.com/

[nixgeek → hawkoy]

Zerodium is probably the closest thing to a “legitimate” acquirer of exploits, those which aren’t being disclosed to the vendor and then fixed.

[shmatt → hawkoy]

any company that builds software for government tracking like NSO Group will happily pay, and have very deep pockets

[saagarjha → bogwog]

Yes, but the risk if you’re caught is huge.

[stjohnswarts → saagarjha]

not if you're selling them to -your- government. Then you're a patriot but also a rich patriot.

[ehsankia → vessenes]

It seems like this cooperative approach was very effective. I assume rubber duck debugging and having multiple minds attacking the problem from from multiple directions greatly improves the efficiency.