Hacker News Reader

I assume you didn't tell Apple that you were negotiating with other buyers? I think most bug bounty programs will cut off communications at that point.

I've managed several programs for some very large companies and haggling over bounties with a researcher is a _really_ bad idea. You set your bounty amounts and stick to them. If people want to haggle over impact that's fine, but once you exceed your quoted bounty amount for one person then everyone expects it.

I looked for other buyers before Apple had a bug bounty program, not while talking with Apple. When I found an official way of submitting the vulnerability I cancelled my other negotiations (Apple is the correct channel and I wanted to see it fixed without exploitation). Regarding bounty amounts, I agree that they should clearly define the amounts for each factor of a complete exploit. That currently isn't done. The one thing everyone can give Zerodium credit for is being clear with their pricing, there's no ambiguity over whether you can keep your lights on by doing the research.

That's good. It's unfortunate that the best signal most companies can use for whether their bounty amounts are sufficient is report volume and quality rather than a pro-active "here's what others are paying" or impact to customers. If they set bounties too high initially they'll get swamped with low-quality reports and that will slow response times for the good ones.

The bean counters also play a big role. Most companies aren't ready for big bounty payouts when a program first starts. They set a fixed budget and are more likely to end a program completely if the bottom line cost is too high, regardless of the security impact. Security teams are aware of this and try to walk a fine line.

For researchers who are having problems with programs I'd suggest trying to form a better relationship with the triage teams and security teams. Be helpful, not confrontational. Companies get their best bang-for-buck when they can court good researchers. They love getting quality researchers who report multiple findings and they'll do quite a lot to make them happy, including paying bonus bounties for future reports and being far more transparent with triage status.

> Most companies aren't ready for big bounty payouts when a program first starts. They set a fixed budget and are more likely to end a program completely if the bottom line cost is too high, regardless of the security impact.

At the beginning of a high profile bug bounty program I'd expect higher expenditure than in the following fiscal year due to the backlog of researchers who really want to "sell" to an official channel, not a slow start.

Shhhh! If you demonstrate such clear thinking you’ll never get promoted to management…:)

Why companies project this idea that it is wrong that people ask to be compensated fairly for their hard work? The culture of exploitation of engineers is sickening.

Because it’s hard to distinguish between someone who’s trying to help you be more secure and someone who’s trying to extort hush money out of you for an error in your code.

It’s not hard to read it as “we don’t negotiate with terrorists”, and Apple (or Google or Amazon…) know people think they have deep pockets

Does the difference really matter provided that the bug bounties are paying market rates for the bugs that people submit?

What does it matter what the reporter's motivation is? The fact is, you have an unpatched vuln in your code, and you either pay up to discover more, or it blows up in your face an indeterminate amount of time later.

You mean they know people know they have deep pockets.

But they never contracted or asked you to do that hard work in the first place. You can’t mow my lawn without asking then demand that I pay you for your hard work.

> Apple has a strict stance of submitting all of the research up front with no expectations as far as payment

<Giant bold white letters fade in against a black background>

A R R O G A N C E

Serious question. If Apple won’t treat you in an ethical manner then why go the ethical route? Why not just sell the sploit to the highest bidder? Seems like there’s a misplaced and unreciprocated sense of integrity on the part of many researchers.

I think this is a great question - In my opinion, carving the ethical path from the start can and should fulfill any moral obligation you might have.

If they don't want to play ball, take it to someone that will appreciate your work. Should it be used nefariously, you are still helping because they might take you more seriously next time, as they should have in the first place.

carrot versus stick.

One, just because someone else is being unethical doesn't mean you can drop your ethics. Two: you don't really want to expose users to the exploit.

Considering the half hearted and sluggish response of certain huge companies I can see why some researchers chose the middle path and publicly disclose immediately.

Sometimes the ethical thing to do is adversarial. It forces better behavior for short term pain.

As far as exposing users, that makes assumptions about the actions of a number of people including the company in question which could, if it so desired, assemble the resources to push a fix within 48 hours.

Usually such poor community engagement correlats to lack of acceptance or slow fixing timings. The best recourse is to disclose publicly after set number of days (90).

Disagree if Apple is willfully mistreating people who it knows have zero days on them and want to work with them on fair terms, and then those zero days end up in the wrong hands, I place the blame SQUARLEY on Apple. I'm not going to victim blame a security researcher trying to put food on the table or provide for their family for what Apple forced their hand to do.

simply put if Apple doesn't find a way to come to an agreement with this person in a timely manner, they are just saying they see the zero day and the consequences for their users as acceptable losses as preferable to the payment

Because you will harm not only Apple, but also their users, who Apple has misled into thinking they are the secure choice.

Apple is not behaving unethically here. There is no ethical imperative for apple to pay you or roll out the red carpet for you. Their ethical obligation is to not try to attack you legally or silence you. Beyond that, there is no obligations, just behaviours that are "nice".

Apple has an ethical obligation to write secure software and incentivize efforts that would do this.

Couldn't it be argued that they have a moral imperative to protect their customers and those whose livelihoods depend on the Mac ecosystem (internally and externally). I suppose obligations to shareholders are similar, but more transactional than moral.

> There have been attempts to hack me 2 days after requesting a quote from some buyers

How did you protect yourself against those?

Also, as a security researcher, are there alternatives you'd recommend more? Would Linux/Windows be more secure?

TOTP two factor authentication protected me. They attacked my recovery email to go for my primary, at the time my recovery provider didn't offer 2FA. I think they may have social engineered the recovery with my SSN (it was a randomly generated password). Then they used the recovery provider to buy time by adding 2FA options, I began recovering within a minute. It was impressive how quickly they worked, they tried to compromise 5 other accounts in 3 minutes. Unfortunately for them, all of the accounts they targeted from that point on had 2FA, and they lost access in 15 minutes.

If this happened to me, I'd send a tip to the FBI[1].

[1] https://tips.fbi.gov

Already done, with as much relevant information as I could compile. I hope they find who is attacking security researchers. If I had to guess, the motivation may be for the zerodays I have.

Wait a minute...

You tried to report to apple. You didn't like the way they "treated" you, so you decided to sell it on black market. The black market person tried to hack you. You then went to the fbi to complain about how your black market buyer treated you?

Am i missing something from this story? That seems like a really bad plan.

Yes, this is wrong, both in your timeline and description of the events. I said in my previous comments that the Apple bounty program didn't exist when I began (https://news.ycombinator.com/item?id=28471263) so I was forced to consider other buyers in order to get income as a researcher. I never claimed to entertain any black market buyers, nor would I. Zerodium isn't the black market, they sell to government buyers. Government buyers may be concerned with the manner of which their sources collect said zerodays. The black market is Crowdfense, Israeli/Chinese government, et al.

"Dear FBI, please tell your friends at the NSA to knock it off"

On a serious note, I'm glad researchers like you exist.

Maybe because their handelers are forbidding them to fix it until they are done with it... maybe I'm paranoid.

Just curious - do you have an ethical stance against selling to ZDI/Zerodium?

OP edited their post to answer your question

ZDI, like Apple, doesn't tell you the average price of the vulnerabilities you can sell to them when you email them (yes, Apple has example payout ranges, but they aren't clear on classification). At Pwn2Own, ZDI paid roughly half of what Apple should pay. When you consider Apple themselves are 1/4th the market price, thereby making ZDI 1/8th, it becomes impossible to work to them. I raised my concerns with ZDI, no reply.

I submitted some details (nothing technical, just the classification and affected platforms) of my vulnerability to Zerodium. Two days later someone tried to hack into all of my personal accounts and failed due to 2FA, and not many people have the email I used when I communicated with them. I've found other buyers outside the US, but I had ethical concerns and decided against them (at a 300K min loss).

This isn't a judgment, by the way. I'm naive about this area and genuinely curious.

I've found other buyers outside the US, but I had ethical concerns and decided against them (at a 300K min loss).

What type of buyers exist who are unable to fix the vulnerability (in this case, who are not Apple or the affected vendor or do not collaborate with Apple, etc.) but might be considered ethical to sell to?

Come on, we both know the score here.. There is no ethical purchaser.

That was my assumption, but my netsec knowledge could be written on a stamp, so who knows! ;-)

I imagine some people think being rewarded for finding vulnerabilities is unethical entirely, but there seems to be a huge dose of pragmatism around the space.

Answered here: https://news.ycombinator.com/item?id=27875883

Thanks - that was helpful.

In theory a large corp netsec team may buy zero days vulnerabilites and then either disable the affected systems or engage directly with the vendor.

Alternatively depending on how nationalistic someone feels NSA could be a eithical buyer for them as well.