HACKINTOSH.ORG | Macintosh discussion forums

Security Researchers Don't Think Apple Pays Enough for Bug Bounties

Apple's bug bounty program has been available (https://www.macrumors.com/2016/08/04/apple-launches-bug-bounty-program/) to select security researchers for almost a year now, but according to a new report from Motherboard (https://motherboard.vice.com/en_us/article/gybppx/iphone-bugs-are-too-valuable-to-report-to-apple), most researchers prefer not to share bugs with Apple due to low payouts. More money can be obtained from third-party sources for bugs in Apple software.





<img src="(http://cdn.macrumors.com/article-new/2016/08/applebugbounty-800x600.jpg)" alt="" width="800" height="600" class="aligncenter size-large wp-image-514432" />

"People can get more cash if they sell their bugs to others," said Nikias Bassen, a security researcher for the company Zimperium, and who joined Apple's program last year. "If you're just doing it for the money, you're not going to give [

bugs] to Apple directly."Motherboard spoke to several members of Apple's bug bounty program with the condition of anonymity. Every single one said they had yet to report a bug to Apple and did not know anyone who had. iOS bugs are "too valuable to report to Apple," according to Patrick Wardle, a Synack researcher and former NSA hacker who was invited to the bug bounty program last year.





Apple first introduced its bug bounty program in August of 2016 at the Black Hat Conference, an annual global InfoSec event. Apple offers bounties of up to $200,000 depending on the vulnerability. Secure boot firmware components earn $200,000 at the high end, while smaller vulnerabilities, like access from a sandboxed process to user data outside of the sandbox, will earn $25,000.

<div class="linkback">Tags: Apple security (https://www.macrumors.com/roundup/apple-security/), bug bounty (https://www.macrumors.com/roundup/bug-bounty/) </div>
Discuss this article (https://forums.macrumors.com/threads/apple-bug-bounties-dont-pay-enough.2055352/) in our forums

<div class="feedflare">
<img src="http://feeds.feedburner.com/~ff/MacRumors-Front?d=yIl2AUoC8zA" border="0"></img> (http://feeds.macrumors.com/~ff/MacRumors-Front?a=Ck6S6q46APU:qIZr86lqxRc:yIl2AUoC8zA) <img src="http://feeds.feedburner.com/~ff/MacRumors-Front?d=6W8y8wAjSf4" border="0"></img> (http://feeds.macrumors.com/~ff/MacRumors-Front?a=Ck6S6q46APU:qIZr86lqxRc:6W8y8wAjSf4) <img src="http://feeds.feedburner.com/~ff/MacRumors-Front?d=qj6IDK7rITs" border="0"></img> (http://feeds.macrumors.com/~ff/MacRumors-Front?a=Ck6S6q46APU:qIZr86lqxRc:qj6IDK7rITs)
</div><img src="http://feeds.feedburner.com/~r/MacRumors-Front/~4/Ck6S6q46APU" height="1" width="1" alt=""/>

Source: Security Researchers Don't Think Apple Pays Enough for Bug Bounties (https://www.macrumors.com/2017/07/06/apple-bug-bounties-dont-pay-enough/)