How to unc0ver a 0-day in 4 hours or less

Re:How to unc0ver a 0-day in 4 hours or less by curiousgal on Thursday July 09, 2020 @02:35PM (#23783474)

TL;DR: reverse engineer a jailbreak exploit.

> By 7 PM, I had identified the vulnerability and informed Apple

I don't know why this rubbed me the wrong way. Like, it feels "lazy" (for lack of a better way) to disassemble an exploit and run off to tell the vendor. If anything, the exploit writer should get the credit. I don't know.

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by saagarjha on Thursday July 09, 2020 @02:57PM (#23783731)

> If anything, the exploit writer should get the credit.

They did: https://support.apple.com/en-us/HT211214

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by aarong11 on Thursday July 09, 2020 @02:49PM (#23783636)

But they didn't report it did they? Playing devil's advocate a bit here, but they could have reported it for a bug bounty but they instead chose to use it to create a jailbreak.

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by texasbigdata on Thursday July 09, 2020 @03:31PM (#23784093)

Maybe reworded, the value accrues to the explainer of the issue to the code writer. Therefore, this dude did something valuable. Ecosystem works. Perhaps.

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by CountHackulus on Thursday July 09, 2020 @03:08PM (#23783846)

They did, the article points out that this was caused by a regression. Fixing a memory leak made it such that it reenabled an old bug.

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by xuki on Thursday July 09, 2020 @10:49PM (#23787661)

The exploit was public, but obfuscated to make it harder for bad actors to make use of. Apple likely didn't need help to identify the vulnerability, but I'm sure they welcomed it.

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by forgotmypw17 on Thursday July 09, 2020 @02:45PM (#23783583)

To me, seems like informant territory.

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by umvi on Thursday July 09, 2020 @02:51PM (#23783666)

All this has taught me is that if I find an exploit to unlock <insert DRM'd device> I need to obfuscate the heck out of it to make it as onerous as possible for low-effort bug bounty do-gooders to scoop up a reward from it.

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by snazz on Thursday July 09, 2020 @03:06PM (#23783830)

Project Zero researchers don’t take bounties, to my knowledge.

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by saagarjha on Thursday July 09, 2020 @03:11PM (#23783883)

Nor have they been ever offered one, to my knowledge: https://twitter.com/i41nbeer/status/1027339893335154688. I'm actually not sure Apple has ever paid a bounty for anything that wasn't a web issue…

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by jlgaddis on Friday July 10, 2020 @02:49AM (#23788876)

If memory serves, they've been offered but the bounties are always been given to charity.

I'm guessing that's a policy/requirement of Project Zero as, presumably, the P0 folks are making "enough" already.

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by saagarjha on Thursday July 09, 2020 @02:58PM (#23783737)

I don't think anyone is getting a bug bounty, especially from this one.

[ Parent | on HN ]