{"id":358175,"date":"2017-07-07T04:53:00","date_gmt":"2017-07-06T20:53:00","guid":{"rendered":"https:\/\/www.macrumors.com\/2017\/07\/06\/apple-bug-bounties-dont-pay-enough\/"},"modified":"2017-07-07T04:53:00","modified_gmt":"2017-07-06T20:53:00","slug":"security-researchers-dont-think-apple-pays-enough-for-bug-bounties","status":"publish","type":"post","link":"https:\/\/people.utm.my\/asmawisham\/security-researchers-dont-think-apple-pays-enough-for-bug-bounties\/","title":{"rendered":"Security Researchers Don’t Think Apple Pays Enough for Bug Bounties"},"content":{"rendered":"

Apple’s bug bounty program has been available<\/a> to select security researchers for almost a year now, but according to a new report from Motherboard<\/a><\/em>, most researchers prefer not to share bugs with Apple due to low payouts. More money can be obtained from third-party sources for bugs in Apple software.<\/p>\n

\"\"<\/p>\n

\n

“People can get more cash if they sell their bugs to others,” said Nikias Bassen, a security researcher for the company Zimperium, and who joined Apple’s program last year. “If you’re just doing it for the money, you’re not going to give [bugs] to Apple directly.”<\/p>\n<\/blockquote>\n

Motherboard<\/em> spoke to several members of Apple’s bug bounty program with the condition of anonymity. Every single one said they had yet to report a bug to Apple and did not know anyone who had. iOS bugs are “too valuable to report to Apple,” according to Patrick Wardle, a Synack researcher and former NSA hacker who was invited to the bug bounty program last year.<\/p>\n

Apple first introduced its bug bounty program in August of 2016 at the Black Hat Conference, an annual global InfoSec event. Apple offers bounties of up to $200,000 depending on the vulnerability. Secure boot firmware components earn $200,000 at the high end, while smaller vulnerabilities, like access from a sandboxed process to user data outside of the sandbox, will earn $25,000.<\/p>\n","protected":false},"excerpt":{"rendered":"

Apple’s bug bounty program has been available to select security researchers for almost a year now, but according to a new report from Motherboard, most researchers prefer not to share bugs with Apple due to low payouts. More money can be obtained from third-party sources for bugs in Apple software. “People can get more cash […]<\/p>\n","protected":false},"author":5817,"featured_media":358176,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[68,69,59,26],"class_list":["post-358175","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-apple","tag-macrumors","tag-media","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/358175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=358175"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/358175\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media\/358176"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=358175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=358175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=358175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}