News for hackers. Stuff that matters.

A comment on macOS High Sierra: Anyone can login as “root” with empty password. Parent comment

Re:macOS High Sierra: Anyone can login as “root” with empty ... by alexwebb2 on Tuesday November 28, 2017 @03:45PM (#15801372)
Does anybody have any info on how much Apple would've been likely to pay for a responsible disclosure in this case, given the scope and severity of the issue?

I'm just curious how much of a payday this guy missed out on by not disclosing responsibly.

[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by ken on Tuesday November 28, 2017 @05:13PM (#15802363)
AFAICT, Apple's security bounty program is officially only for their preselected group of security researchers.

In the course of developing my current application, I've discovered a couple security bugs in macOS, which I reported to Apple product security in PGP-encrypted emails. The only thing offered to me was to have my name/company listed in the release notes (which they are, for the latest 10.13 update, along with a CVE#).

[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by pault on Tuesday November 28, 2017 @04:03PM (#15801600)
That was my first thought. Based on some bounty reports I've seen recently I would assume at least high five figures.
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by alexwebb2 on Tuesday November 28, 2017 @04:11PM (#15801700)
Ouch. This guy's going to kick himself pretty hard. The 15 minutes of infamy seems like a pretty bad tradeoff.
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by sounds on Tuesday November 28, 2017 @04:20PM (#15801825)
Do you honestly believe Apple will pay out the same to someone located in Turkey?
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by alexwebb2 on Tuesday November 28, 2017 @04:27PM (#15801923)
I wouldn't think they'd care about the geography of it - a good tip is a good tip, and they want to encourage responsible disclosure.
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by thanatropism on Tuesday November 28, 2017 @04:43PM (#15802100)
Do they release statistics on bug bounty payouts?
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by FireBeyond on Tuesday November 28, 2017 @05:13PM (#15802360)
They barely acknowledge bugs being submitted to Radar...
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by lawnchair_larry on Tuesday November 28, 2017 @04:40PM (#15802067)
For a local root with physical access? Not a chance. Maybe low 4 figures.
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by rcruzeiro on Tuesday November 28, 2017 @05:10PM (#15802331)
If the mac has screen sharing enabled, physical access is not required
[ Parent | on HN ]