Apple Offering Hackers $200,000 to Find Software Flaws in its Products
Apple has announced that it will be offering hackers, researchers and cryptographers up to $200,000 to find security loopholes in its products. The bug-bounty announcement, which is strictly on invitation-only, was made on Thursday, August, 4th 2016.
Bug bounty program is a deal offered by major technology firms by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to exploits and vulnerabilities.
It’s one of the biggest rewards in the industry though the amount researchers are paid are based on the severity of the flaw they find. Google’s maximum prize pot is $20,000, Uber offers up to $10,000, and now Apple is raising the lid to $200,000.
This is the first-ever bug bounty program to be attended by Apple, a company where security plays a crucial part of its corporate narrative. Apple has quietly refused to pay for bug reports, at times frustrating security researchers who found it difficult to report flaws to the company.
Bug bounty programs are often a way to deter hackers from finding vulnerabilities then selling them on the black market. But these so-called “zero day exploits” – a hack that has been found before a patch has been discovered – can sell for much more on the “dark web” than a company is paying on its bug bounty schemes.
During his presentation on “Behind the Scenes of iOS Security” at the Black Hat USA 2016 hacker in Las Vegas, Apple’s head of security engineering and architecture, Ivan Krstic, revealed technical details about the security related to AutoUnlock, HomeKit, and iCloud Keychain. For Apple, this is an unusual amount of openness around the security of its products.
READ ALSO: Security Patch iOS 9.3.4: Quick and Easy Method to UpdateAll Your Apple Devices
Rich Mogull, CEO of Securosis and a security analyst who keeps tabs on iOS security admitted that “Apple historically had a rough relationship with researchers,” and “Over the last 10 years, that has changed a lot and become more positive.” Apple’s bug bounty program, he says, is another step in the right direction.
The invitation-only bug bounty program is reportedly open to researchers only who have previously made valuable vulnerability disclosures to Apple. There has been wide consultation with other companies on their bug bounty programs and Apple decided that opening the bounty system to the public would bring a deluge of reports that might overshadow high-risk vulnerabilities.
New researchers, however, still have a chance if they provide useful disclosures, and plans to slowly expand the program.
The program launches in September with five categories of risk and reward:
- Vulnerabilities in secure boot firmware components: Up to $200,000
- Vulnerabilities that allow extraction of confidential material from Secure Enclave: Up to $100,000
- Executions of arbitrary or malicious code with kernel privileges: Up to $50,000
- Access to iCloud account data on Apple servers: Up to $50,000
- Access from a sandboxed process to user data outside the sandbox: Up to $25,000
From Goole’s Android, Blackberry, iPhone to major Tech companies like Facebook, they hold the keys to some of our most private information — payment details, health records, chat logs with our lovers and archives of family photos — and, as we hand over more and more private data, it becomes increasingly important that companies earn our trust by keeping it secure.
So Hackers, go make some money!
