Hacker News Reader

Comment by aboringusername | Hacker News Reader

> I'm not interested in waiting years for a bounty. I can't speak for anyone else, but my personal experience is that the Apple Security Bounty Program has been a disappointment, and I don't plan to participate again in the future.

Yeah...Hint to Apple: When somebody discloses something, responsibly, you react to that with a proper process and understand you get 90 days in most cases as is industry standard (that's typically how Google Project Zero operates).

Otherwise don't be surprised when exploits end up sold for much more on a black market because nobody wants to cooperate with you.

Think we need a few more 0-days that cost Apple a few bad PR spins (as well as others like Valve) to make them wake up and actually have a proper process.

View on HN

It's such a tough culture to change. I sat next to one of a security team at a large networking equipment maker (who you would hope has a clue about security but not so much) for a while. Even after numerous meetings and agreements, dude still was on conference calls where various executives would first reach for the lawyer's phone number upon someone from the outside reporting a security problem. Talking these guys down from even the most absurd actions was a regular occurrence ... let alone just responding properly / graciously.

It was so bad at one point the legal team would contact the security team to get background anytime someone notified them of anything security related... just to avoid the obvious PR disaster that would be suing someone who was genuinely being helpful. (The key there was the legal council was a good guy and had an appreciation for the damage a poorly timed legal threat could do.)

So the bossman can’t make distinction between human society lawyers and computer logic lawyers?

The problem is they identify it as a criminal/legal issue not as a software/hardware issue.

That level of ignorance should disqualify someone from running a tech company.

We're stuck with this until we decide it's time to start regulating ourselves.

Yeah so let’s merge those categories to a same one within corporate, something like “internal externalized product business risks” so both the boss and classification isn’t wrong

(and ideally cut/reroute/raise the pay according to requisite nursing for idiot bossman)

I tried as well, not for the bounty (I didn’t get one) but because I thought I should responsibly disclosure for bugs I had found in sandbox enforcement. I have them a demo, they sat on it for a while (to be fair, if you emailed them they’d respond quickly saying they were still working on it, unlike things submitted through Feedback Assistant.) Then I got an email a month later saying that they had fixed my specific case for App Store apps and couldn’t see what the problem was, as they had apparently pushed a fix just after I first submitted my bug without telling me or posting the source code for dyld (a fix which happened to apparently break some apps, so they got their bundle IDs hardcoded in AMFI as an exception). They seemed to only be interested in the App Store, which I couldn’t test obviously, but I submitted a slight variation to work around the changes within a day, and a month later another variation that made exploiting the bug even easier. After the last one they asked for an extension to work on the last one, which I granted them; when that one started expiring I sent them an email asking what had become of the bug. This time they said they fixed it in the App Store and they wanted to credit me with a fix; there was no mention of sandbox enforcement outside of the App Store. Still, as they had run over the discretionary disclosure and said they fixed the things they cared about I went ahead and published a writeup…but it was a bit annoying because they didn’t even assign me a CVE or something to link to so people could get more information, so I’m not sure why they were asking for details about me…

Out of curiosity why would it matter if they "assign you" a CVE?

If your intentions were purely altruistic then the CVE matters not. Just make a blog post with the details and link there.

But if perhaps on some level you were after recognition then yes I can see the desire for a CVE...

Because I can give people a CVE and they can find it easily rather than "oh it's actually a blog post I wrote, oh you didn't find it by search, here is the link" and absolves me of coming up with a descriptive name, reduces confusion if I ever find another sandbox escape, and centralizes the bug so that future researchers can do things like look up all the bugs for the component or build on it by seeing what's been done in the past. Same reason you might want your book to have an ISBN and show up in a library catalogue, for example.

A late addition: in the absence of all that, I do fall back on blog posts. I have written one for that bug, of course, but surely you can find it ;)

Again, whats the point of "handing someone a CVE?" Literally just make a post somewhere on the internet and let people see it there. If a CVE shows up, add it to the top. If not, oh well. It should be 100% about getting the right information out there, isn't it?

I've spent a lot of time involved in responsible / coordinated disclosure and it's always like this. The person disclosing "just wants to help", but the reality is the vast majority want (or feel entitled to) something for their efforts, be it their name behind a CVE, a bounty, or recognition of some type. Perhaps even the admiration of the company (wow, thanks we are impressed you found that!). That's totally normal and fine, I just wish more people would admit it.

As I mentioned, there is a huge amount of value in having a centralized, consistent database of bugs that you can refer to. It's the same thing as naming a new species: ok, sure, it's cool that found it, but by naming it everyone can now call it that and use that name to find it rather than using some ad-hoc non-descriptive name for it. And this is really important for systems like macOS that see multiple bugs in the same component every update: it's important to be able to distinguish them. Getting a CVE number isn't really that difficult, anyways, you can basically get one for anything, like "denial of service" (you found a way to crash an app, congrats).

FWIW, Apple should not be impressed I found that, they should be impressed it took someone so long to show them that their sandboxing strategy on macOS is totally broken. It's nice that they wanted to credit me and all, but they fixed the issue in a way that didn't fully resolve the problems that I brought up, which I consider worse than not crediting me or not paying me a bounty.

There is probably no market at all for the privacy bypass where you make an illicit copy of Safari and arrange for it to be run so you can access files in ~/Library/Safari. This is simply not a high-severity bug. A good find, and an interesting writeup, but it's no RCE.

Perhaps, but for Apple it’s (or should be) a major headache when apps from the App Store steal and upload people’s browsing histories, as they were doing for a while until this change came in. Clearly they care enough about it that they were willing to piss off developers when it rolled out, so it might as work right…

Also do note that Apple does claim to offer a bounty for such access, regardless of what the market is willing to pay. So clearly it is valuable to them.

> Perhaps, but for Apple it’s (or should be) a major headache when apps from the App Store steal and upload people’s browsing histories, as they were doing for a while until this change came in.

Isn't this what Apple's approval process is supposed to be for? Or is that only good for preventing Apple-Tax Evasion nowadays?

App Store Review is a joke on macOS.

It's different than on iOS?

I’d say it’s worse, which is saying something considering a jailbreak once shipped in the App Store on iOS.

I can confirm this! Back in 2017, I was 17 and found a flaw that affected the privacy of all browsers and required a web standards change. Google/Chromium (Andrew R. Whalley) paid me a good bounty for that, but Apple (mac, ios, iphone, watch) didn't pay. I didn't expect Mozilla to pay obviously since they were non profit.

> I didn't expect Mozilla to pay obviously since they were non profit.

Despite being a nonprofit organization, Mozilla's annual revenue is around half a billion dollars[1] and they do offer a client bug bounty of up to $10,000[2].

[1] https://en.wikipedia.org/wiki/Mozilla_Corporation

[2] https://www.mozilla.org/en-US/security/client-bug-bounty/

When the December 2014 git vulnerability was disclosed to git maintainers (I can't find the CVE number now, but this was the github blog about it: https://github.blog/2014-12-18-vulnerability-announced-updat..., and this was the hn discuss then: https://news.ycombinator.com/item?id=8769667, tl;dr is git only checked and protected all lower-case .git directory from overwritten by clone/checkouts, which will becomes tricky when it's used on case-insensitive fs), they contacted both Microsoft and Apple to make sure that they fixed all the corner cases of their case-insensitive file systems. Microsoft was very cooperative at the time, pulled in someone from NT kernel team to make sure that the fix covered all the corner cases; Apple, on the other hand, didn't response. Even after the patched version of git is released, Apple didn't do a hot release of Xcode tool (which is how they distribute git officially on Apple's systems). They only included the fix on their next scheduled beta release of Xcode.

What was the exploit? I've been sitting on one that's essentially as old as the web but I figured it was pointless to try to alert browers about it because too much functionality rests on it.

Don't tease us - what was your exploit? Just from the description, I'm happy taking a guess that this is going to involve somehow exploiting the browser cache (e.g. via timing how long it takes to request an image from another domain that may or may not have previously been cached) to determine whether the user has visited a page. That was first written up by academics decades ago, and has since been independently invented by several people (me included), but wasn't fixed as of whenever I last checked a couple of years ago.

Is my wild guess right? :)

No, though that is a good one.

> What was the exploit?

Just file a security issue on bugs.chromium.org with demo/instructions. If it's a good one, they'll pay good.

I don't wanna give it out since it's publicly linked to my twitter and I've bad mouthed Apple here... (I don't publicly speak against them for obvious reasons)

>Think we need a few more 0-days that cost Apple a few bad PR spins

I doubt it, "The exploit was used only against oppressed ethnic people"[1] was good enough to give Apple clean chit last time.

[1]https://arstechnica.com/information-technology/2019/09/apple...

Says who? The link you posted is one of many calling out Apple for their poor response.

He's referring to Apple's official response. Which was basically along the lines of "Nothing to worry about everyone! Exploit was only used on the 12 most popular websites for Ughygur related content. Therefore you have nothing to worry about."

Well, it was nowhere "good enough"; it was just the best they could come up with.

Reply on news.ycombinator.com