Hacker News Reader

Comment by Despegar | Hacker News Reader

>Forbes also revealed on Monday that Apple was to give bug bounty participants "developer devices" - iPhones that let hackers dive further into iOS. They can, for instance, pause the processor to look at what's happening with data in memory. Krstić confirmed the iOS Security Research Device program would be by application only. It will arrive next year.

I wonder how they're going to manage this. I could easily see some less than ethical researchers applying for this program and selling all the 0 days they find to the usual suspects rather than informing Apple.

View on HN

Isn't the idea of a bug bounty at this scale that the monetary reward (especially combined with the lowered legal risk, but also when considered in isolation) is higher from reporting it to the vendor than from selling it on the black market? I.E. presumably Apple has done their research and one million dollars is more than they believe you'd getting selling a zero day to somebody else.

I don't work in the security field nor am I a business number cruncher, but that was the gist I had of what these programs achieved.

Edit: see Despegar's reply, I should have RTFA! However worth pointing out that there would be some incentive for researchers to go to Apple instead of a third party, which might tip the scales in their favour.

Depends who’s buying I imagine. Not sure about everyone else but I always picture the entities buying on the black market as singular people for some reason

When you consider it could be the likes of the three digit shoe inspectors over there in the US it could be a fair chunk of change

Who are these individuals that will pay millions of dollars for an exploit? Cyber criminals rely almost exclusively on dead bugs, frequently using exploits from the metasploit framework. That gives then sufficient access to a broad range of victims so they can generate revenue through volume.

0days are used against hardened targets. Think “Iranian nuclear facilities” rather than “grandma’s PC”

They are made up, in my head, figments of my imagination. Hence “for some reason”.

Yeah. They don’t exist. People don’t think about things rationally, they see phrases like “black market” and assume it is some sort of criminal transaction with armed guards and meetings at midnight and shit.

It is nothing like that. It is the same as freelance development work, except there are very few customers and the developer writes something that may or may not have any value.

From the article:

>Previously, a company called Zerodium was vocal about how much it will pay researchers, before handing them to its unknown government customers. In January, the secretive company announced it was offering $2 million for a remote hack of an iPhone.

So that's already more than what Apple offers. I tend to think they'll always be outbid.

Governments are strong. Wow.

I forget the influence until I see things like this.

Apologies, I did fail to RTFA in this case. Thankyou!

I don't know many people here who believe Zerodium's price list, and while I can't speak to Zerodium's payment terms, the norm appears to be tranched payments, apparently ofter over a year; selling the same bug on the grey market for "more" money (whatever it is brokers actually pay) is a gamble that the bug you've sold isn't going to die.

With those terms, they can buy a bug, report it to Apple, collect the $1m, and be off the hook to pay out the remaining payments. It seems to me this makes it much riskier to go to the black market than people here realize.

Yes, because that is exactly the sort of behavior that a business would engage in. Screwing over their suppliers and demonstrating that they offer no value whatsoever.

How would that make any sense? It is ludicrous.

Would be a nice pivot for patent troll companies. In a world where profit is king the question is not why, but when?

A nice pivot for patent companies would be somehow generating the connections and reputation to participate as brokers in this super-insular and highly technical marketplace, and then burn all that work down to fuck over an individual researcher for pocket change?

A "remote hack" generally relies on a stack of exploits. From what I recall when the last jailbreaks came about, that stack was at least 5 or so exploits deep.

So $1M/exploit is priced significantly ahead of the $2M/hack.

Interesting this also means that an entire exploitable stack now becomes worth a lot more, while any given exploit is worth a lot less. And any stack of exploits becomes much more brittle, as a patch of a single one of N exploits can knock out the use of the stack.

I’d rather a legitimate 1 million I can declare and put in my bank than 2 million from the underworld delivered in instalments in bitcoin.

Worth adding that clean money is worth more than dirty money

If the money is directly from the government, is it really dirty money?

Yes.

Different definition of “dirty”.

Yeah. I'll give you that. It's the same sort of "dirty" as a paycheck from Palantir or Facebook...

So not dirty. “Dirty” money in the traditional sense has to be “laundered” because it comes from an illegal activity.

Depends which government, I would think.

Kind of what I meant by "Especially considering the lower legal risk" but I guess there's the specific cost of laundering it too. A good point!

Are there any laws you bump into selling 0-days? Honest question, I know their are laws about the actual hacking part but is it illegal to sell the payload? Obviously this is ethically dirty money I just was curious if it's actually dirty money in a criminal sense.

If you sell a bug to someone you know is going to break the law with it, you're getting close to the line for liability. People who sell bugs to the western IC are, as I understand it, virtually always selling to broker firms designated by governments which offer a veneer of plausible deniability; selling to a well-known broker is probably not legally all that risky.

As has happened disappointingly in the past - there aren't any actual laws offering safe harbor for ethical hacking, companies just tend not to prosecute responsible disclosure... if your disclosure required you to break interstate commerce laws, run afoul of the CFAA[1] or even just violate a TOS - or even if they can convincingly argue that discovering your disclosure might have - then you can be prosecuted.

Now, people who prosecute white hacks that practice responsible disclosure are technically known as "asshole"s but the end result is that there are a ton of laws even innocent computer usage breaks so your liability for any damage to end users usually doesn't need to be considered, there's enough book to throw at people already.

[1] Essentially if you touch a computer or computing device it's quite likely you've somehow violated the CFAA, it's _stuuupid_. https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

None of this seems particularly relevant to the scenario of selling to zerodium.

This has nothing to do with hacking, so none of that applies. You're conflating attacking someone else's computer or network.

You don't need safe harbor because analyzing your own property is not a crime. Neither is telling people what you found. Also, please stop using the term responsible disclosure!

> You don't need safe harbor because analyzing your own property is not a crime.

Do you own the OS you’re breaking into?

Effectively yes. You can conduct vulnerability research on your operating system.

What if you sell it to the repair industry? There are plenty of people who want to break open Apple's walled garden, and those are not necessarily what most would consider "malicious" or "unethical".

Unfortunately the intersection of "security researcher" and "right-to-repair advocate" is probably tiny, but that would be something I'd love to see: someone finds a crack that enables a lot of third-party-repair scenarios and sells it to that industry instead of to the black-hat criminals or even back to Apple itself.

The third-party repair/aftermarket industry is huge and would love to break through the proprietariness of the ecosystem. In that light, $1M seems rather small...

> Unfortunately the intersection of "security researcher" and "right-to-repair advocate" is probably tiny

Based on personal experience, the intersection isn’t all that small.

Bug bounties merely needed market pressure for the bounties to rise.

Corporations had been unilaterally deciding what the payment for a reported bug would be. They were constantly undervaluing and wasting everyone's time. People would say the same rationale "low liability and clean money is more valuable than dirty money and needing to launder it".

Yeah, but not that much more valuable.

So now the bounties are reaching their market price.

No it's not. Money is money.

There's going to be an equilibrium here dictated by how much Apple itself is willing to pay for bugs. If Apple pays more then presumably more bugs will get reported which makes the remaining unreported bugs much more valuable since they'll be relatively rare.

I would imagine the publicity a researcher would get from wining the 1 million is also very valuable.

I wonder how a company investigates black market to that levels.

Another thing to keep in mind is that these devices already exist (used by Apple internally), only on the black market. A lot of these development fused devices are stolen from the factory and sold to black hat/gray hat hackers (and companies) already.

I think one of the intentions here is to lessen the demand for black market dev-fused phones, which is already a huge problem for Apple. This is similar to the idea of officially allowing Linux on the PlayStation — give hackers no legitimate reason to pwn your console

I wonder how loose the "application" will be.

Doesn't really matter. It's a formality at this point. It's basically public once they do this and they're aware of that.

I thought that the Linux-on-PlayStation was actually a tax dodge? Something like it let them claim the devices were not just games consoles and so their import duties could be reduced in some regions.

You'd think someone would have dug up a citation for this, but Wikipedia says (for the PS2):

>Some incorrectly speculate it was used as an attempt to help classify the PS2 as a computer to achieve tax exempt status from certain EU taxes that apply to game consoles and not computers (It was the Yabasic included with EU units that was intended to do that).[citation needed]

and Linux on the PS3 was used as a marketing point.

https://en.wikipedia.org/wiki/OtherOS - both these pages are really bad :/

I forget who, but someone made a comment about this a long time ago that stuck with me. We often say, "They'll just sell all these 0 days on the black market." but honestly that's not like a literal market, and you have to make a lot of compromises to not only your own integrity, but also to your safety and ability to stay out of jail if you do something like that.

I wish I remembered the specifics of the comment, but selling a 0day on the black market is not something a casual person can easily do, and even if someone figures out how, there's a lot that can go wrong, with many of those outcomes leading to jailtime.

It's vastly superior to participate in a bug bounty program legitimately, from a risk standpoint, especially if you're standing to make $1M. 0days are (and I'm not an expert on this) not generally going for enough more to justify all that extra risk.

I don't see how there's any risk when it gets sold to a broker like Zerodium who then sells it to some government.

Selling bugs and exploits is not illegal just about everywhere, so there is really no risk. Plus, law enforcement and intelligence agencies, or their contractors, are the ones buying on the “black market”. Nobody has to worry about jail for knowing about a mistake that Apple made in their code and telling someone else.

https://news.ycombinator.com/item?id=17122161

Argue with 'tptacek, not me.

> I could easily see some less than ethical researchers applying for this program and selling all the 0 days they find to the usual suspects rather than informing Apple.

That's what has been happening so far. Here's a report from a couple of years ago about this: https://www.vice.com/en_us/article/gybppx/iphone-bugs-are-to...

The announcement today is actually raising the rewards 5x (from $200K to $1M) to make it more valuable to report this to Apple.

By vetting applications, presumably. I would imagine it's mostly professors in well known universities and corporations closely affiliated with Apple getting access.

No, it’s hackers. The same folks who have been releasing jailbreaks. Professors haven’t been finding ios 0days.

I’d say that the researchers have a pretty strong incentive not to screw around with Apple.

It doesn’t matter anyway, because Apple patches the bug, thus killing its black market value completely.

You really think Apple is just going to gives special dev devices to random hackers from the Internet?

I don’t think they will, I know they will.

But maybe it depends on how you define “hacker” and what you call “random”. I’m saying that folks in the jailbreaking scene are some of the primary targets for this. It wouldn’t be worth launching if the plan was to exclude them. Some are already part of Apple’s bounty program.

“Apple Calls In Rock Star iPhone And Mac Hackers For Secret Bug Bounty Bash”

https://www.forbes.com/sites/thomasbrewster/2016/09/28/apple...

That alone suggests that they are already acquainted with every one of the people they'll accept for the program? They might have a "loose" vetting process, but I doubt they have a lack of one.

Apple could use these devices to track the hackers...

Giving security researchers a “gift” that actually tracks them sounds like a really bad idea.

Note that random hackers from the internet already have access to these devices.

In the form of stolen red board or internal testing iPhones or something else?

Yeah, they're just buying dev-fused devices.

The point is apple is likely to only aim for researchers for this program as the hackers could just resell most 0days, letting apple know about a small fraction to maintain reputation. It would make sense for apple to not allow hackers access to the program for this reason.

I’m using researchers and hackers interchangeably here. It isn’t intended for academics or companies affiliated with Apple, that’s for sure.

In this context, "security researchers" is just the preferred job title that white-hat hackers put on their business cards. The ones who go for bug bounties are generally not paid by universities or large corporations to do that work.

Don't know about ios, but university researchers have found quite a bunch of Intel vulnerabilities.

If they get some special "developer" devices on their hands, they might find some funny things...

The jailbreak community will not be getting these. They make more money continuing to sell to China than they will make selling to Apple.

Some are already in the “vetted” bounty program. That doesn’t necessarily mean they will sell Apple the bugs though.

How much do they make selling to China?

Aside from the Chinese part of the jb scene, it’s kind of disheartening to know that the rest of them are selling that capability to a hostile adversary (if that’s true). I’m surprised the five eyes aren’t offering enough to keep them out of China’s hands.

My guess is that they're not going to let just any rando h4xx0r into the program. They'll take on well-known security researchers and academics who have something to lose by leaking zero days.

Reply on news.ycombinator.com