<story><title>iPhone Bugs Are Too Valuable to Report to Apple</title><url>https://motherboard.vice.com/en_us/article/gybppx/iphone-bugs-are-too-valuable-to-report-to-apple</url></story><parent_chain></parent_chain><comment><author>objclxt</author><text>But...this is true of every software vendor. Does anyone think Microsoft is paying market value for a remote code execution exploit in Edge? They&amp;#x27;re not, they&amp;#x27;ll give you $15k for it[1].&lt;p&gt;I find this particularly interesting:&lt;p&gt;&amp;gt; [the security researchers] asked Apple&amp;#x27;s security team for special iPhones that don&amp;#x27;t have certain restrictions so it&amp;#x27;s easier to hack them [...] these devices would have some security features, such as sandboxing, disabled in order to allow the researchers to continue doing their work.&lt;p&gt;If I go to Google or Facebook and ask them to, say, turn off some key security features on their site so I can find more bugs they&amp;#x27;re gong to tell me to go take a hike. It&amp;#x27;s unclear to me why a security researcher thinks Apple would give them access to a device with the sandbox bypassed. Why would they possibly trust them?&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;technet.microsoft.com&amp;#x2F;en-us&amp;#x2F;library&amp;#x2F;dn425036.aspx&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;technet.microsoft.com&amp;#x2F;en-us&amp;#x2F;library&amp;#x2F;dn425036.aspx&lt;/a&gt;</text></comment>
<story><title>iPhone Bugs Are Too Valuable to Report to Apple</title><url>https://motherboard.vice.com/en_us/article/gybppx/iphone-bugs-are-too-valuable-to-report-to-apple</url></story><parent_chain></parent_chain><comment><author>saurik</author><text>If you noticed your friend and neighbor left their car unlocked with the keys inside, would you steal their car, or would you tell them? I bet you would tell them.&lt;p&gt;Let&amp;#x27;s say instead that there were some shady people who liked to hang out outside of the local gas station, and you have heard that they will give you a cut of any heist they pull off based on &amp;quot;tips&amp;quot;. Do you call them over to come steal the car? I bet you don&amp;#x27;t do that either.&lt;p&gt;Let&amp;#x27;s say that it is some random person&amp;#x27;s car. I still doubt you steal the car, and I still doubt you tip off someone else to steal the car. However, I also doubt you go far out of your way to find and tell the owner of the car something is wrong.&lt;p&gt;What if, though, you knew that you could get a reward; something sizable enough to be at least worth your time, but nowhere near the value of either the car itself or what a band of thieves would be willing give you if you called them and tipped them off?&lt;p&gt;That&amp;#x27;s all this bug bounty program is: it is designed to provide a reason for people who come across bugs to even bother coming to Apple at all rather than just putting it in a &amp;quot;pile of fun bugs&amp;quot;.&lt;p&gt;Only, instead of the moral issue being &amp;quot;someone&amp;#x27;s car might get stolen&amp;quot;, it is more like &amp;quot;you found a bug in the Tesla&amp;#x27;s computer locks, which makes it trivial to walk up to any Tesla anywhere and just drive off (or even tell the Tesla to steal itself!)&amp;quot;.&lt;p&gt;The companies that offer large sums of cash for key bugs, such as Zerodium, tend to be pretty &amp;quot;black hat&amp;quot;... their clients are doing stuff like corporate and governmental espionage; they might even have mafia-like organizations as clients for all you know.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.wired.com&amp;#x2F;2016&amp;#x2F;09&amp;#x2F;top-shelf-iphone-hack-now-goes-1-5-million&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.wired.com&amp;#x2F;2016&amp;#x2F;09&amp;#x2F;top-shelf-iphone-hack-now-goes...&lt;/a&gt;&lt;p&gt;So that&amp;#x27;s the real ethical question involved here: do you go to Apple and get your $50-200,000, knowing that Apple will give you credit for the bug, let you talk about it at the next conference, and seems to care enough to try to fix these things quickly...&lt;p&gt;...or do you sell your bug to a group that resells it to some government which then uses it to try to spy on people like Ahmed Mansoor, &amp;quot;an internationally recognized human rights defender, based in the United Arab Emirates (UAE), and recipient of the Martin Ennals Award (sometimes referred to as a “Nobel Prize for human rights”)&amp;quot;.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;citizenlab.org&amp;#x2F;2016&amp;#x2F;08&amp;#x2F;million-dollar-dissident-iphone-zero-day-nso-group-uae&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;citizenlab.org&amp;#x2F;2016&amp;#x2F;08&amp;#x2F;million-dollar-dissident-ipho...&lt;/a&gt;&lt;p&gt;FWIW, I have severe moral issues with this bug bounty program: I am a strong advocate of simultaneous disclosure, and while Apple does tend to fix bugs quickly, they have made it clear that they are not prepared to commit to timelines even while keeping users in the dark about what they need to do to protect themselves.&lt;p&gt;However, this article makes it sound like the entire concept of the bug bounty program is incompetent or something, as it is failing to pay as much money as the black market... while I have met a few people in the field who are more than happy to sell a bug to literally anyone with cash, the vast majority of people (even the ones whom I have sometimes called &amp;quot;mercenaries&amp;quot; for being willing to &amp;quot;switch sides&amp;quot;), have a pretty serious distaste for the idea of selling a bug to the highest bidder.&lt;p&gt;The real reasons you don&amp;#x27;t hear much about people selling their bugs to Apple are that they are like Luca (who started doing this at the age of 17--he&amp;#x27;s now either 19 or 20?--which is context that I think is really important for this evaluation) and are sitting on bugs because they are &lt;i&gt;personally valuable to them&lt;/i&gt; (as without at least one bug, you don&amp;#x27;t even own your own phone enough to look for others; so there&amp;#x27;s a really big incentive to not disclose your last bug: this is the thing that Apple should really care to fix), that they are intending to release a public weaponized exploit in the form of a jailbreak (which, given the demand from legitimate users due to Apple&amp;#x27;s insistence on locking down their devices for reasons that are more about business models than security, can be a ticket to world-wide fame that money just can&amp;#x27;t buy, and which will also net you at least some donations on the side), or simply that they actually have been but they haven&amp;#x27;t told anyone (a situation that seems so likely that it seems weird that this article discounts it).</text></comment>