Hacker News new | ask | show | jobs
Apple Security Bounty (developer.apple.com)
99 points by devhwrng 2369 days ago
6 comments
killjoywashere 2369 days ago
Facebook: https://www.facebook.com/whitehat

Amazon: https://aws.amazon.com/security/vulnerability-reporting/

Netflix: https://help.netflix.com/en/node/6657

Google: https://www.google.com/about/appsecurity/programs-home/

Microsoft: https://www.microsoft.com/en-us/msrc/bounty

More: https://www.ubuntupit.com/best-bug-bounty-programs-on-intern...

link
ghostpepper 2369 days ago
Facebook - No dollar amounts listed but "If we pay a bounty it will be a minimum $500"

Amazon and Netflix, no dollar amounts listed

Microsoft offers up to $250k for "Critical remote code execution, information disclosure and denial of services vulnerabilities in Hyper-V"

Ironically that google page dumped a bunch of html into my browser, including a "script nonce" and a function definition:

    (function(H){H.className=H.className.replace(/\bgoogle\b/,'google-js')})(document.documentElement)
I'll be waiting for a cheque from them, I suppose.
link
jc_811 2369 days ago
I see the biggest bounty is for &1,000,000USD and says:” Zero-click kernel code l execution with persistence and kernel PAC bypass”

As someone who doesn’t speak this language, what does thismean? And are there examples in history of this type of exploit affecting a large company?

link
nicwilson 2369 days ago
> Zero-click

No user interaction required.

> kernel code l execution with persistence

Persistent malware with root privilege.

> kernel PAC bypass

I think PAC is some protection measures.

link
djcapelis 2369 days ago
I think PAC is some protection measures.

Pointer Authentication Code

It’s a form of pointer integrity checking that you can read about in the Platform Security Guide (this used to be called the iOS Security Whitepaper) released today: https://support.apple.com/en-sg/guide/security/seca5759bf02/...

Google’s Project Zero also wrote a post about this mechanism, including a detailed case study of where they were able to bypass it: https://googleprojectzero.blogspot.com/2019/02/examining-poi...

link
saagarjha 2369 days ago
PAC generally protects against return-oriented and other control-flow hijacking attacks.
link
dsalzman 2369 days ago
An exploit that allows full control of the device that installs with no user interaction, zero-click, and is persistent even after rebooting or power cycling the device.
link
jc_811 2368 days ago
This is a great explanation, thanks!
link
dsalzman 2369 days ago
Real $ amounts! This is how you beat the black market.
link
_bxg1 2369 days ago
Is this new? Is that why it's being posted?
link
ogre_codes 2369 days ago
Prior to now this program was invite only. They are blowing it open to all security researchers as of today.

https://apple.news/A4h_BM9HqTjSpsWKsrVPGBw

Also, max payout has been bumped to $1.5m which is a pretty big change. Most of this was announced a few months ago, they are just making good on a previous announcement at this point.

link
_bxg1 2369 days ago
Thanks for the context. As a user of Apple devices, I'm excited about the increased attention to security!
link
brian_herman 2369 days ago
Yeah this is old? https://www.theverge.com/2016/8/4/12380036/apple-bug-bounty-... This is 4 years old? (2016 should be added to title.
link
saagarjha 2369 days ago
The bug bounty is no longer invite-only, and the maximum payouts have been increased.
link
pabs3 2368 days ago
I heard a rumor that Apple has never paid out any money in their invite-only bug bounty days. This 2018 article seems to suggest that is true. Does anyone have any data to the contrary?

https://www.vice.com/en_us/article/7xqdxe/google-project-zer...

link
zemnmez 2369 days ago
Critically, there's no information about whether reporters are allowed to disclose, which usually means that Apple is going to hide any seriously damaging vulnerabilities...
link
saagarjha 2369 days ago
There's this:

> Not disclose the issue publicly before Apple releases the security advisory for the report. (Generally, the advisory is released along with the associated update to resolve the issue). See terms and conditions.

No guarantees, then.

link