Hacker News Reader

Comment by _xnmw | Hacker News Reader

Ok, remind me never to approach Apple directly if I happen to find a vulnerability. Zerodium (or a 3-letter agency) it is!

View on HN

> 3-letter agency

From the wikipedia page for Meltdown: "On 8 May 1995, a paper called "The Intel 80x86 Processor Architecture: Pitfalls for Secure Systems" published at the 1995 IEEE Symposium on Security and Privacy warned against a covert timing channel in the CPU cache and translation lookaside buffer (TLB). This analysis was performed under the auspices of the National Security Agency's Trusted Products Evaluation Program (TPEP)."

i.e. did they know even in 1995?

My understanding is that people at the time were aware of potential problems but no vulnerability had been identified. I found some discussion here: https://security.stackexchange.com/a/177256

NSA used to have an active effort on information assurance, under the philosophy that it defended the country to have good civilian security (same reason for the NSA’s modification to the DES S-box). This unfortunately has fallen by the wayside.

(NSA shortened the key as well so it wasn’t all bunnies and chocolate)

Yes, the current meaning of “responsible disclosure” is bullshit

There should likely be a governing body that independently values an exploit and forces companies to pay

Like how the SEC’s whistleblower program works

Its completely broken to have corporations pinky promise not to sue you if you tell them and arbitrarily decide payouts if at all

Is this referencing the slow turnaround time, or the lack of a bounty paid so far? If it's the latter, I think it's already well known that bug bounties pay far less than the "market" value of such exploits.

> well known

Well I didn't know, until now. I saw the bug bounty page at Apple before, was dazzled by the numbers, and didn't think twice about approaching them if I found a bug. Now after this article I know better than to trust them to pay.

Zerodium is interesting. Apparently this bug would fetch "Up to $50k": https://zerodium.com/images/zerodium_prices.png

Is there a way to verify whether Zerodium might be advertising large payouts (for attention) and then offering much smaller payouts for the actual bugs?

It's pretty risky for Zerodium. There's nothing stopping a researcher from collecting a payout and then reporting the bug to the vendor.

> There's nothing stopping a researcher from collecting a payout and then reporting the bug to the vendor.

Wouldn't the payout contract prohibit reporting to anyone else?

What're they going to do if you break it? Sue?

They might pay out over a long period of time for some guarantee that you'll play by their rules, though.

There is a non-zero probability of not being alive any more. I don't think you understand the nature of that game.

I think so, but would Zerodium etc be able to prove it was the same person in each case? An independent researcher might have submitted the same issue to Apple coincidentally shortly after, presented in a slightly different way.

Contracts usually pay out on a schedule. If the bug gets patched then you don’t get paid.

Makes sense, thanks. Must be tense waiting.

$50k seems super low considering where Outlook is though. The exploit author hints at RCE being a possibility.

What's to stop someone from selling a vuln to Zerodium and then just reporting it to Apple shortly after? You get paid and Apple gets to fix it.

Probably a payout over a long period of time. Lots of people would prefer a free $50k over the course of one year.

(Just guessing though.)

I would guess it would have a Non Disclosure Agreement attached, along with the mercenary reputation damage one take on by breaking the contract. One would not be let back in the club. Do you think it wise to break a contract (eg: steal from) a weapons dealer?

Oh yeah, for Apple, just throw it up on Twitter.

and tbh, it's probably the same answer for most providers these days.

Reply on news.ycombinator.com