[Omniscient]

https://www.wired.com/story/apple-hacker...nty-macos/

https://www.forbes.com/sites/thomasbrews...fc7ace3948

Anyone read about Apple doubling up their Bug Bounty payouts for iOS exploits? Now it's $1m USD for a 0-click exploit that roots the system.

Official reporting page: https://developer.apple.com/bug-reporting/

Anyone here ever get a bounty from Apple?

[123]

That's a huge amount. Any Bounty Hunter should spend a time on this. I wish I knew mkre about hacking. 1m USD would make my life all sought out.

[Bear]

Arent Apple known to be stingy with their bug bounties?

[Omniscient]

Arent Apple known to be stingy with their bug bounties?

Yes, which is why them upping the money is important. Forbes reports that hackers selling to governments get $1m+ for these type of exploits. I suppose Apple decided it has to pay equally as much. Which is crazy if you think about that. There is now a bidding war for high-end valuable exploits by Apple, Government Agencies, and criminals.

[int]

Arent Apple known to be stingy with their bug bounties?

yeah this is what I heard, I think someone on HF was saying how apple just claimed they already had their eye on the vulnerability he reported, even though they didn't know about it or something

[lesstech]

That's a huge amount. Any Bounty Hunter should spend a time on this. I wish I knew mkre about hacking. 1m USD would make my life all sought out.

1 million is some serious bounty isn't it?

[Stephanie Ferguson]

1 million is some serious bounty isn't it?

Peanuts to a company that massive tbh

[Sigma]

Every time someone reports a bug to them, they state they have already found them. Honestly, Apple probably put that payout number so they can keep claiming and more people will test.

[RUS7Y]

Every time someone reports a bug to them, they state they have already found them. Honestly, Apple probably put that payout number so they can keep claiming and more people will test.

This is not true at all.

[Sigma]

This is not true at all.

I'm basing my opinion from what I have seen in the past and from what my big bounty friends have stated.

[Blazin]

I think its better now. Before people who had exploits would rather keep them to themselves or sell them private now are more inclined to sell them to Apple.


Apple finally realizing if they pay so little not worth even reporting.

[Elitas]

This is not true at all.

Unfortunately it's not far from the truth.

[LEGION12]

yeah this is what I heard, I think someone on HF was saying how apple just claimed they already had their eye on the vulnerability he reported, even though they didn't know about it or something

quick question is c sharp good for brute force scripts or hacking in genral im looking into it 😝

[M L T]

Zerodium and ZDI are paying higher than Apple for the same exploits -- I saw you mentioned the bidding war. This has been going on for the last few years now, and the exploit brokers just keep offering double of whatever apple offers...
Also, most hackers who have iOS 0days are holding onto them. They simply are not worth parting with for $1m. They're worth considerably more than that if actively used in targeted exploitation campaigns.

As for ever getting bounties from apple, I've never actually attempted to audit iOS or OSx (I believe they only pay out for bugs in their operating sysmtes).
I've reported plenty web-based bugs to them, but it's hall of fame only:




Still kinda cool to add that stuff to your resumé though -- but yeah, most people with 0-click RCE's affecting apple are not going to be willing to sell them for $1m USD. It simply isn't worth it... exploit brokers are fully aware of this, and that's why the likes of Zerodium are offering double the bounty that apple is offering:

quick question is c sharp good for brute force scripts or hacking in genral im looking into it 😝

C# has very few practical applications in terms of hacking... I guess it's good to know if you want to whitebox audit particular mobile-based apps though.

[compalabee]

https://www.vice.com/en_us/article/qvgp77/hacker-releases-first-public-iphone-jailbreak-in-years

I saw this link from one of my security newsletters. Just released Aug 19. Haven't read it though lol. Just posting.

So did Apple just give away 1m? That's serious GG.