News for hackers. Stuff that matters.
Re:Apple Security Bounty by ghostpepper on Thursday December 19, 2019 @11:29PM (#21841716)
Facebook - No dollar amounts listed but "If we pay a bounty it will be a minimum $500"

Amazon and Netflix, no dollar amounts listed

Microsoft offers up to $250k for "Critical remote code execution, information disclosure and denial of services vulnerabilities in Hyper-V"

Ironically that google page dumped a bunch of html into my browser, including a "script nonce" and a function definition:

    (function(H){H.className=H.className.replace(/\bgoogle\b/,'google-js')})(document.documentElement)
I'll be waiting for a cheque from them, I suppose.
[ Parent | on HN ]
Re:Apple Security Bounty by jc_811 on Thursday December 19, 2019 @11:57PM (#21841797)
I see the biggest bounty is for &1,000,000USD and says:” Zero-click kernel code l execution with persistence and kernel PAC bypass”

As someone who doesn’t speak this language, what does thismean? And are there examples in history of this type of exploit affecting a large company?

[ Parent | on HN ]
Re:Apple Security Bounty by nicwilson on Friday December 20, 2019 @12:02AM (#21841816)
> Zero-click

No user interaction required.

> kernel code l execution with persistence

Persistent malware with root privilege.

> kernel PAC bypass

I think PAC is some protection measures.

[ Parent | on HN ]
Re:Apple Security Bounty by djcapelis on Friday December 20, 2019 @12:11AM (#21841853)
I think PAC is some protection measures.

Pointer Authentication Code

It’s a form of pointer integrity checking that you can read about in the Platform Security Guide (this used to be called the iOS Security Whitepaper) released today: https://support.apple.com/en-sg/guide/security/seca5759bf02/...

Google’s Project Zero also wrote a post about this mechanism, including a detailed case study of where they were able to bypass it: https://googleprojectzero.blogspot.com/2019/02/examining-poi...

[ Parent | on HN ]
Re:Apple Security Bounty by saagarjha on Friday December 20, 2019 @12:12AM (#21841856)
PAC generally protects against return-oriented and other control-flow hijacking attacks.
[ Parent | on HN ]
Re:Apple Security Bounty by dsalzman on Friday December 20, 2019 @12:00AM (#21841810)
An exploit that allows full control of the device that installs with no user interaction, zero-click, and is persistent even after rebooting or power cycling the device.
[ Parent | on HN ]
Re:Apple Security Bounty by jc_811 on Friday December 20, 2019 @12:51PM (#21845954)
This is a great explanation, thanks!
[ Parent | on HN ]
Re:Apple Security Bounty by dsalzman on Thursday December 19, 2019 @11:41PM (#21841755)
Real $ amounts! This is how you beat the black market.
[ Parent | on HN ]
Re:Apple Security Bounty by _bxg1 on Thursday December 19, 2019 @11:15PM (#21841675)
Is this new? Is that why it's being posted?
[ Parent | on HN ]
Re:Apple Security Bounty by ogre_codes on Thursday December 19, 2019 @11:33PM (#21841728)
Prior to now this program was invite only. They are blowing it open to all security researchers as of today.

https://apple.news/A4h_BM9HqTjSpsWKsrVPGBw

Also, max payout has been bumped to $1.5m which is a pretty big change. Most of this was announced a few months ago, they are just making good on a previous announcement at this point.

[ Parent | on HN ]
Re:Apple Security Bounty by _bxg1 on Thursday December 19, 2019 @11:42PM (#21841757)
Thanks for the context. As a user of Apple devices, I'm excited about the increased attention to security!
[ Parent | on HN ]
Re:Apple Security Bounty by brian_herman on Thursday December 19, 2019 @11:22PM (#21841698)
Yeah this is old? https://www.theverge.com/2016/8/4/12380036/apple-bug-bounty-... This is 4 years old? (2016 should be added to title.
[ Parent | on HN ]
Re:Apple Security Bounty by saagarjha on Thursday December 19, 2019 @11:35PM (#21841735)
The bug bounty is no longer invite-only, and the maximum payouts have been increased.
[ Parent | on HN ]
Re:Apple Security Bounty by pabs3 on Friday December 20, 2019 @09:12PM (#21849121)
I heard a rumor that Apple has never paid out any money in their invite-only bug bounty days. This 2018 article seems to suggest that is true. Does anyone have any data to the contrary?

https://www.vice.com/en_us/article/7xqdxe/google-project-zer...

[ Parent | on HN ]
Re:Apple Security Bounty by zemnmez on Thursday December 19, 2019 @11:43PM (#21841764)
Critically, there's no information about whether reporters are allowed to disclose, which usually means that Apple is going to hide any seriously damaging vulnerabilities...
[ Parent | on HN ]
Re:Apple Security Bounty by saagarjha on Thursday December 19, 2019 @11:45PM (#21841774)
There's this:

> Not disclose the issue publicly before Apple releases the security advisory for the report. (Generally, the advisory is released along with the associated update to resolve the issue). See terms and conditions.

No guarantees, then.

[ Parent | on HN ]