+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Bug Bounties (https://hackforums.net/forumdisplay.php?fid=434)
+---- Thread: Apple iOS Bug Bounty now $1m USD (/showthread.php?tid=5997700)
Pages: Pages
1
2
Apple iOS Bug Bounty now $1m USD - Omniscient - Aug 9, 2019
https://www.wired.com/story/apple-hacker-iphone-bug-bounty-macos/
https://www.forbes.com/sites/thomasbrewster/2019/08/08/apple-confirms-1-million-reward-for-hackers-who-find-serious-iphone-vulnerabilities/#34fc7ace3948
Anyone read about Apple doubling up their Bug Bounty payouts for iOS exploits? Now it's $1m USD for a 0-click exploit that roots the system.
Official reporting page: https://developer.apple.com/bug-reporting/
Anyone here ever get a bounty from Apple?
RE: Apple iOS Bug Bounty now $1m USD - 123 - Aug 9, 2019
That's a huge amount. Any Bounty Hunter should spend a time on this. I wish I knew mkre about hacking. 1m USD would make my life all sought out.
RE: Apple iOS Bug Bounty now $1m USD - Bear - Aug 9, 2019
Arent Apple known to be stingy with their bug bounties?
RE: Apple iOS Bug Bounty now $1m USD - Omniscient - Aug 9, 2019
(Aug 9, 2019 11:49 AM)Bear Wrote: Arent Apple known to be stingy with their bug bounties?
Yes, which is why them upping the money is important. Forbes reports that hackers selling to governments get $1m+ for these type of exploits. I suppose Apple decided it has to pay equally as much. Which is crazy if you think about that. There is now a bidding war for high-end valuable exploits by Apple, Government Agencies, and criminals.
RE: Apple iOS Bug Bounty now $1m USD - int - Aug 9, 2019
(Aug 9, 2019 11:49 AM)Bear Wrote: Arent Apple known to be stingy with their bug bounties?
yeah this is what I heard, I think someone on HF was saying how apple just claimed they already had their eye on the vulnerability he reported, even though they didn't know about it or something
RE: Apple iOS Bug Bounty now $1m USD - lesstech - Aug 9, 2019
(Aug 9, 2019 11:49 AM)123 Wrote: That's a huge amount. Any Bounty Hunter should spend a time on this. I wish I knew mkre about hacking. 1m USD would make my life all sought out.
1 million is some serious bounty isn't it?
RE: Apple iOS Bug Bounty now $1m USD - Stephanie Ferguson - Aug 10, 2019
(Aug 9, 2019 04:20 PM)lesstech Wrote: 1 million is some serious bounty isn't it?
Peanuts to a company that massive tbh
RE: Apple iOS Bug Bounty now $1m USD - Sigma - Aug 10, 2019
Every time someone reports a bug to them, they state they have already found them. Honestly, Apple probably put that payout number so they can keep claiming and more people will test.
RE: Apple iOS Bug Bounty now $1m USD - RUS7Y - Aug 10, 2019
(Aug 10, 2019 04:20 AM)Sigma Wrote: Every time someone reports a bug to them, they state they have already found them. Honestly, Apple probably put that payout number so they can keep claiming and more people will test.
This is not true at all.
RE: Apple iOS Bug Bounty now $1m USD - Sigma - Aug 10, 2019
(Aug 10, 2019 05:01 AM)Rusty_v Wrote: This is not true at all.
I'm basing my opinion from what I have seen in the past and from what my big bounty friends have stated.
RE: Apple iOS Bug Bounty now $1m USD - Blazin - Aug 10, 2019
I think its better now. Before people who had exploits would rather keep them to themselves or sell them private now are more inclined to sell them to Apple.
Apple finally realizing if they pay so little not worth even reporting.
RE: Apple iOS Bug Bounty now $1m USD - Elitas - Aug 13, 2019
(Aug 10, 2019 05:01 AM)Rusty_v Wrote: This is not true at all.
Unfortunately it's not far from the truth.
RE: Apple iOS Bug Bounty now $1m USD - LEGION12 - Aug 16, 2019
(Aug 9, 2019 04:16 PM)int Wrote: yeah this is what I heard, I think someone on HF was saying how apple just claimed they already had their eye on the vulnerability he reported, even though they didn't know about it or something
quick question is c sharp good for brute force scripts or hacking in genral im looking into it 😝
RE: Apple iOS Bug Bounty now $1m USD - M L T - Aug 18, 2019
Zerodium and ZDI are paying higher than Apple for the same exploits -- I saw you mentioned the bidding war. This has been going on for the last few years now, and the exploit brokers just keep offering double of whatever apple offers...
Also, most hackers who have iOS 0days are holding onto them. They simply are not worth parting with for $1m. They're worth considerably more than that if actively used in targeted exploitation campaigns.
As for ever getting bounties from apple, I've never actually attempted to audit iOS or OSx (I believe they only pay out for bugs in their operating sysmtes).
I've reported plenty web-based bugs to them, but it's hall of fame only:
![[Image: bT5WiKb.png]](https://i.imgur.com/bT5WiKb.png)
Still kinda cool to add that stuff to your resumé though -- but yeah, most people with 0-click RCE's affecting apple are not going to be willing to sell them for $1m USD. It simply isn't worth it... exploit brokers are fully aware of this, and that's why the likes of Zerodium are offering double the bounty that apple is offering:
![[Image: w1Me2Oh.png]](https://i.imgur.com/w1Me2Oh.png)
(Aug 16, 2019 09:37 PM)LEGION12 Wrote: quick question is c sharp good for brute force scripts or hacking in genral im looking into it 😝
C# has very few practical applications in terms of hacking... I guess it's good to know if you want to whitebox audit particular mobile-based apps though.
RE: Apple iOS Bug Bounty now $1m USD - compalabee - Aug 23, 2019
https://www.vice.com/en_us/article/qvgp77/hacker-releases-first-public-iphone-jailbreak-in-years
I saw this link from one of my security newsletters. Just released Aug 19. Haven't read it though lol. Just posting.
So did Apple just give away 1m? That's serious GG.