Apple Has Started Paying Hackers for iPhone Exploits
In 2016, Apple’s head of security surprised the attendees of one of the biggest security conference in the world by announcing a bug bounty program for Apple’s mobile operating system iOS.
At the beginning, Apple struggled to woo researchers and convince them to report high-value bugs. For the researchers, the main issue was that the bugs they discovered were too valuable to report to Apple, despite rewards as high as $200,000. Companies like GrayShift and Azimuth made an entire business out of exploiting vulnerabilities in Apple products, while other researchers didn’t want to report bugs so they could keep doing research on iOS.
But two years later, some researchers are finally reporting vulnerabilities to Apple, and the company has begun to award some researchers with bounties, Motherboard has learned.
Almost all major tech companies have had bug bounties for years. These are programs that are designed to encourage independent security researchers and friendly hackers to alert the companies of flaws or vulnerabilities in their products in exchange for rewards, which are sometimes in the six figures. Contrary to other companies, however, Apple has not disclosed or discussed any details of the bounty program after announcing it in 2016.
Adam Donefeld, a researcher at mobile security firm Zimperium said that he has submitted several bugs to Apple and received payments for the company. Donefeld was not part of the first batch of security researchers who were personally invited by Apple to visit its Cupertino campus and asked to join the program. But after submitting a few bugs, Donefeld told me, an Apple employee asked him if he wanted to be part of the bounty program in a phone call.
“I know Apple pays people,” Donefeld said in an online chat. “I’m certainly not the only payout.”
Apple did not respond to a request for comment.
Source | motherboard
