<story><title>Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone</title><url>https://www.forbes.com/sites/thomasbrewster/2019/08/08/apple-confirms-1-million-reward-for-hackers-who-find-serious-iphone-vulnerabilities/#7b31cc2d3948</url></story><parent_chain><item><author>Despegar</author><text>&amp;gt;Forbes also revealed on Monday that Apple was to give bug bounty participants &amp;quot;developer devices&amp;quot; - iPhones that let hackers dive further into iOS. They can, for instance, pause the processor to look at what&amp;#x27;s happening with data in memory. Krstić confirmed the iOS Security Research Device program would be by application only. It will arrive next year.&lt;p&gt;I wonder how they&amp;#x27;re going to manage this. I could easily see some less than ethical researchers applying for this program and selling all the 0 days they find to the usual suspects rather than informing Apple.</text></item></parent_chain><comment><author>TheRealSteel</author><text>Isn&amp;#x27;t the idea of a bug bounty at this scale that the monetary reward (especially combined with the lowered legal risk, but also when considered in isolation) is higher from reporting it to the vendor than from selling it on the black market? I.E. presumably Apple has done their research and one million dollars is more than they believe you&amp;#x27;d getting selling a zero day to somebody else.&lt;p&gt;I don&amp;#x27;t work in the security field nor am I a business number cruncher, but that was the gist I had of what these programs achieved.&lt;p&gt;Edit: see Despegar&amp;#x27;s reply, I should have RTFA! However worth pointing out that there would be some incentive for researchers to go to Apple instead of a third party, which might tip the scales in their favour.</text></comment>
<story><title>Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone</title><url>https://www.forbes.com/sites/thomasbrewster/2019/08/08/apple-confirms-1-million-reward-for-hackers-who-find-serious-iphone-vulnerabilities/#7b31cc2d3948</url></story><parent_chain><item><author>Despegar</author><text>&amp;gt;Forbes also revealed on Monday that Apple was to give bug bounty participants &amp;quot;developer devices&amp;quot; - iPhones that let hackers dive further into iOS. They can, for instance, pause the processor to look at what&amp;#x27;s happening with data in memory. Krstić confirmed the iOS Security Research Device program would be by application only. It will arrive next year.&lt;p&gt;I wonder how they&amp;#x27;re going to manage this. I could easily see some less than ethical researchers applying for this program and selling all the 0 days they find to the usual suspects rather than informing Apple.</text></item></parent_chain><comment><author>diminoten</author><text>I forget who, but someone made a comment about this a long time ago that stuck with me.  We often say, &amp;quot;They&amp;#x27;ll just sell all these 0 days on the black market.&amp;quot; but honestly that&amp;#x27;s not like a literal market, and you have to make a lot of compromises to not only your own integrity, but also to your safety and ability to stay out of jail if you do something like that.&lt;p&gt;I wish I remembered the specifics of the comment, but selling a 0day on the black market is not something a casual person can easily do, and even if someone figures out how, there&amp;#x27;s a &lt;i&gt;lot&lt;/i&gt; that can go wrong, with many of those outcomes leading to jailtime.&lt;p&gt;It&amp;#x27;s &lt;i&gt;vastly&lt;/i&gt; superior to participate in a bug bounty program legitimately, from a risk standpoint, especially if you&amp;#x27;re standing to make $1M.  0days are (and I&amp;#x27;m not an expert on this) not generally going for enough more to justify all that extra risk.</text></comment>