Hacker News Reader

Comment by rfd4sgmk8u | Hacker News Reader

For all those people who are complaining that Apple is taking its time paying out a bounty, and suggesting Zerodium:

The end result of selling 0-click RCE vectors like this to brokers is sliced up bodies in embassies. Do folks think where the money coming from, and who would pay? No, its an 'easy' pay day.

Some of us fix security bugs to keep people safe. Some of us try to earn an honest living doing so. Others try to earn a dishonest living with pain and death in their wake. Are you using your skills to improve life on this rock, or are you trying to make it worse for a pay day?

View on HN

I agree with and appreciate your position. I'm more annoyed with Apple than with the security researchers. Apple is preying on your desire to do good. They could easily afford to pay a reasonable amount and promptly.

I don't see how selling to zerodium is more morally bankrupt than working for defense contractors, which plenty of tech people do.

The output of the defense industry is used to hurt civilians less frequently. But I'm not here to excuse either.

> defense industry is used to hurt civilians less frequently

... based on?

Can you be a bit more clear on what you're implying? Genuinely curious. I thought Zerodium was selling to government agencies.. so I'm not sure what you mean by sliced up bodies in embassies. Perhaps I'm just not thinking creatively/pessimistically enough.

The sliced up bodies seems like a reference to Jamil Khashoggi. [1] I am not sure why GP links Khashoggi’s death to Zerodium.

1- https://en.m.wikipedia.org/wiki/Jamal_Khashoggi

Very confusing; A Saudi national was assassinated in the Saudi embassy by agents of the Saudi government. Linking this to Zerodium makes Zero sense. You don't need to do any digging to find out when someone is at your doorstep

Wrong. They used tools by the Israeli NSO group to track him.

https://edition.cnn.com/2019/01/12/middleeast/khashoggi-phon...

The Saudi's secret service is infamous for hacking dissidents' phones.

Not Zerodium, but there's some evidence a different hacking for hire group helped them track him

https://edition.cnn.com/2019/01/12/middleeast/khashoggi-phon...

I think the real alternative here is that fewer folks will spend time looking at Apple products or not fully investigating weird behavior encountered normally that could be a security issue.

The author specifically said that they were looking based on bug bounty guidelines. The next person in the same shoes will look at some other company's products instead.

is there any reason to not just sell to zerodium and then report to apple afterwards?

From Zerodium’s FAQ:

“By signing the agreement, you will accept an exclusive sale of your research to ZERODIUM and transfer all related intellectual property rights to us, meaning that the research becomes the exclusive property of ZERODIUM and you are not allowed to re-sell, share, publish, or report the research to any other person or entity.”

How would they enforce that? Even if Apple patches it Zerodium would have to sue Apple to find out.

Money in escrow, paid out in multiple installments if certain conditions are met e.g. the bug does not become public until a certain date.

Um, how does that gel with thousands of engineers who work for FB?

Nice morals. In reality, people often take their morals with a side of cash.

Let's turn it around. In Russia, the average salary is around $600 per year. Would you turn down a $50k payout? That's 83 years of an average salary.

Consider that you may be in a privileged position if you can say no to that kind of money.

The solution to this is for vendors to match what the market is paying. If an RCE is worth $50k on Zerodium, perhaps it's worth something similar to Apple not to have headlines about so-and-so exploit being used for cutting up bodies in an embassy.

EDIT: Oops. Divide 83 by 12. But you'll find it hard to locate someone willing to say no to 7 years of salary for ~zero additional work.

$600 / month is the average salary per month (according to probably the same Google search you did). Presumably someone reporting security vulnerabilities makes well more than the average.

Oof. It's what I get for groggily typing something.

7 years of salary is a lifechanging amount of money too, but I admit the thrust of the argument isn't quite as strong with a basic error. :)

A better comment is probably "We've tried the alternative, and it doesn't seem to work. It's better to pay market rate."

That said... if someone pays me one or multiple annual salaries for something perfectly legal that's slightly morally questionable and indirectly linked to nasty things... I wish I could confidently say I'd say no, but I'm making no guarantees.

Reply on news.ycombinator.com