Apple’s new security bug bounty program: What you need to know!
- aug
- 04
- Posted by Michael
- Posted in Okategoriserade
Everything you need to know about Apple's new security bounty program.
Today, as part of the company's presentation at the Black Hat security conference, Apple will be announcing its first security bounty program. It's pragmatic but optimistic, and continues Apple's tradition of looking at security as a multi-layer, multi-model challenge that requires constantly evolving technologies and practices. I had a chance to speak with several people at Apple involved with the program, and here's what you need to know.
Wait, Apple is presenting at Black Hat?
Yes! Ivan Krstić, head of security engineering and architecture at Apple, is giving a talk today. I get the surprise, though. Once upon a time, hearing that the head of Apple's software security efforts would be speaking at a public event would have been shocking. Today, it's just another step towards a better, stronger relationship between Apple and its community.
What's the talk about?
The talk is titled Behind the scenes of iOS security, and in it Krstić will be discussing how Apple handles the syncing of exceptionally sensitive customer data, like passwords, HomeKit data, and the new auto unlock feature in macOS Sierra and watchOS 3. He'll also discuss the secure element behind Apple's fingerprint identity sensor, Touch ID, and how WebKit, Apple's open source rendering engine, will be hardened against modern JavaScript exploits.
Back to the bounty program. When does it start and who's part of it?
The bounty program launches in September with a small group of researchers. Apple told me the company will be focusing on an exceptionally high level of service and putting quality very much ahead of quantity. The program will be expanded over time, but if anything urgent comes up, Apple is also open to working with other researchers on a case-by-case basis.
What are the bounties?
Apple will be considering critical issues in several key categories:
- Up to $200,000: Secure boot firmware components.
- Up to $100,000: Extraction of confidential material protected by the Secure Enclave Processor.
- Up to $50,000: Execution of arbitrary code with kernel privileges.
- Up to $50,000: Unauthorized access to iCloud account data on Apple servers.
- Up to $25,000: Access from a sandboxed process to user data outside of that sandbox.
What if someone finds something beyond those categories?
Apple, of course, reserves the right to reward any researcher who shares any exceptional, critical vulnerability with the company, even if not part of the categories listed above.
Will the researchers also get credit?
Absolutely.
OK, why is Apple doing this?
According to Apple, vulnerabilities are getting harder to find. That's true both internally, with Apple's security team, and externally, with researchers. As time passes and technology progresses, all the low hanging-vulnerabilities get patched and, unless some easy bug somehow makes it into the wild, finding an attack vector is incredibly complex and time-consuming work.
So, Apple wants some way to reward those who put in that time and work, disclose responsibly, and work with Apple to patch issues before they're exploited.
Does this have anything to do with the recent debate over iPhone security?
While Apple didn't mention anything on the topic, the company has made headlines this year by standing up for the privacy and security of their customers. As one of those customers, I've been thrilled by Apple's position. Not everyone shares that view, though. And there's a concern that, as Apple further locks down iOS, exploits will become more valuable to hackers and agencies alike.
Researchers want to do the right thing. Offering them help to fund their research makes it easier to do just that — especially since Apple is also offering a charitable option.
Stop. How is Apple bringing charity into the bounty?
At the researcher's discretion, Apple will pay out the bounty not to the researcher themselves, but to a charitable cause. Apple can also choose to match that donation, resulting in the charity getting up to twice the value of the bounty.
Good on Apple!
Yeah!
So this bounty will make my iPhone even more secure?
Ultimately, that's the plan. By incentivizing the best and brightest outside of Apple, the company is better more exploits will be found sooner, allowing them to be patched earlier and faster, which is better for you, me, and everyone.
But… what about secrecy?
Secrecy still has its place. But so does community. Apple is bigger than ever. The Apple community is bigger than ever. The threats against privacy and community are, in some cases, more serious than ever.
Apple knows it. The community knows it. And now everyone can work together to ensure a better, more private, and more secure future.
Total win/win.
Senaste inläggen
- Rykte: Iphone 17-serien kommer att få en modell med helt ny design
- All the iPads Apple will still announce in 2024
- New M4 iPad Pro owners complain of grainy displays and there probably isn’t anything Apple can do about it
- Are you fed up with AI in your Google Search on iPhone, iPad, or Mac? Here’s how it works, what it does, and how you can avoid it entirely
- Apple Vision Pro is ’one of the biggest steps towards mainstream adoption’ of VR headsets, high-profile game developer says
Senaste kommentarer
Arkiv
- maj 2024
- april 2024
- mars 2024
- februari 2024
- januari 2024
- december 2023
- november 2023
- oktober 2023
- september 2023
- augusti 2023
- juli 2023
- juni 2023
- maj 2023
- april 2023
- mars 2023
- februari 2023
- januari 2023
- december 2022
- november 2022
- oktober 2022
- september 2022
- augusti 2022
- juli 2022
- juni 2022
- maj 2022
- april 2022
- mars 2022
- februari 2022
- april 2021
- mars 2021
- januari 2021
- december 2020
- november 2020
- oktober 2020
- september 2020
- augusti 2020
- juli 2020
- juni 2020
- maj 2020
- april 2020
- mars 2020
- februari 2020
- januari 2020
- december 2019
- november 2019
- oktober 2019
- september 2019
- augusti 2019
- juli 2019
- juni 2019
- maj 2019
- april 2019
- mars 2019
- februari 2019
- januari 2019
- december 2018
- november 2018
- oktober 2018
- september 2018
- augusti 2018
- juli 2018
- juni 2018
- maj 2018
- april 2018
- mars 2018
- februari 2018
- januari 2018
- december 2017
- november 2017
- oktober 2017
- september 2017
- augusti 2017
- juli 2017
- juni 2017
- maj 2017
- april 2017
- mars 2017
- februari 2017
- januari 2017
- december 2016
- november 2016
- oktober 2016
- september 2016
- augusti 2016
- juli 2016
- juni 2016
- maj 2016
- april 2016
- mars 2016
- februari 2016
- januari 2016
- december 2015
- november 2015
- oktober 2015
- september 2015
- augusti 2015
- juli 2015
- juni 2015
- maj 2015
- april 2015
- mars 2015
- februari 2015
- januari 2015
- december 2014
- november 2014
- oktober 2014
- september 2014
- augusti 2014
- juli 2014
- juni 2014
- maj 2014
- april 2014
- mars 2014
- februari 2014
- januari 2014
Kategorier
- –> Publicera på PFA löp
- (PRODUCT) RED
- 2015
- 25PP
- 2nd gen
- 32gb
- 3D Touch
- 3D-kamera
- 4k
- 64gb
- 9to5mac
- A10
- A9X
- Aaron Sorkin
- Accessories
- adapter
- AirPlay
- AirPods
- Aktiv
- Aktivitetsarmband
- Aktuellt
- Alfred
- AMOLED
- Android Wear
- Angela Ahrendts
- Ångerätt
- announcements
- Ansiktsigenkänning
- app
- App Store
- Appar
- Apple
- Apple Beta Software Program
- Apple Book
- Apple CarPlay
- Apple Event
- Apple iMac
- Apple Mac Mini
- Apple Macbook
- Apple MacBook Air
- Apple MacBook Pro
- Apple Macos
- Apple Maps
- Apple Music
- Apple Music Festival
- Apple Music Radio
- Apple Offer
- Apple Online Store
- Apple Park
- Apple Pay
- Apple Pencil
- Apple Podcast
- Apple Store
- Apple Store 3.3
- Apple TV
- apple tv 4
- Apple TV 4K
- Apple Watch
- Apple Watch 2
- Apple Watch 8
- Apple Watch 9
- Apple Watch Apps
- Apple Watch SE
- Apple Watch Series 2
- Apple Watch Sport
- Apple Watch Ultra
- AppleCare
- AppleTV
- Application
- Applications
- Apps
- AppStore
- Apptillägg
- Apptips
- AppTV
- April
- Arbetsminne
- armband
- Art Apps
- Återköp
- återvinning
- Åtgärdsalternativ
- atvflash
- Audio Apps
- Augmented REality
- Back-to-school
- Bakgrundsbilder
- BankId
- Barn
- Batteri
- batteriskal
- batteritid
- Beats
- Beats 1
- Beats Solo 2 Wireless
- Beats Solo2
- Bebis
- Beginner Tips
- Belkin
- Bendgate
- beta
- Beta 3
- betaversion
- betaversioner
- bilddagboken.se
- bilder
- bilhållare
- billboard
- Bioteknik
- Blendtec
- Bloomberg
- Bloons TD 5
- Bluelounge
- Bluetooth
- Böj
- Booking.com
- Borderlinx
- bose
- bugg
- Buggar
- Buggfixar
- Butik
- C More
- Calc 2M
- Camera
- Campus 2
- Canal Digital
- Carpool Karaoke
- Caseual
- Catalyst
- CES 2015
- Chassit
- Chip
- Chrome Remote Desktop
- Chromecast
- citrix
- clic 360
- CNBC
- Connect
- Cydia
- Dagens app
- Dagens tips
- Damm
- Danny Boyle
- Data
- datamängd
- Datorer
- Datortillbehör
- Datum
- Defense
- Dekaler
- Designed by Apple in California
- Developer
- Development
- Digital Inn
- Digital Touch
- Digitalbox
- DigiTimes
- Direkt
- Discover
- display
- DisplayMate
- Dive
- Docka
- Dräger 3000
- Dropbox
- Droples
- DxOMark
- E-post
- earpod
- EarPods
- Earth Day
- Eddie Cue
- eddy cue
- Educational Apps
- Ekonomi
- Ekonomi/Bransch
- El Capitan
- Elements
- ElevationLab
- Elgato Eve
- Elgato Eve Energy
- EM 2016
- Emoji
- emojis
- emoticons
- Enligt
- EU
- event
- Eventrykten
- EverythingApplePro
- Faceshift
- facetime
- Fäste
- Featured
- Features
- Feng
- Film / Tv-serier
- Filmer
- Filstorlek
- Finance Apps
- Finder For AirPods
- Finland
- FireCore
- Fitbit
- Fitness Accessories
- Fjärrstyr
- Flurry
- Födelsedag
- fodral
- Förboka
- Force Touch
- förhandsboka
- Första intryck
- Forumtipset
- foto
- FoU (Forskning och Utveckling)
- Fource Touch
- Foxconn
- FPS Games
- Framtid
- Fre Power
- Frontpage
- Fullt
- Fuse Chicken
- Fyra
- Gadgets
- Gagatsvart
- Gamereactor
- Games
- Gaming
- Gaming Chairs
- Gästkrönika
- General
- Gigaset
- Gitarr
- Glas
- GM
- Google Maps
- Google Now
- gratis
- grattis
- Guide
- Guider
- Guider & listor
- Guld
- hack
- Halebop
- hållare
- Hälsa
- Hårdvara
- HBO
- HBO Nordic
- Health
- Health and Fitness
- Health and Fitness Apps
- Hej Siri
- Helvetica Neue
- Hemelektronik
- Hemknapp
- Hemlarm
- Hermes
- Hitta min iphone
- Hjärta
- högtalare
- HomeKit
- HomePod
- hörlurar
- htc
- Hue
- Humor
- i
- I Am A Witness
- IBM
- iBolt
- iBomber
- iBook
- icar
- iCloud
- iCloud Drive
- iCloud Voicemail
- iCloud.com
- iDevices
- IDG Play
- idownloadblog
- iFixit
- ikea
- iKörkort
- iLife
- Illusion Labs
- iMac
- IMAP
- iMessage
- iMessages
- iMore Show
- Incipio
- InFuse
- Inspelning
- Instagram-flöde
- Instrument
- Intel
- Internet/Webbtjänster
- iOS
- iOS 10
- iOS 12
- iOS 17
- iOS 18
- iOS 5
- iOS 7
- iOS 8
- iOS 8 beta
- iOS 8.1.3
- iOS 8.2
- iOS 8.3
- iOS 8.4
- iOS 8.4.1
- iOS 9
- iOS 9 beta 4
- iOS 9.1
- iOS 9.1 beta 2
- iOS 9.2
- iOS 9.2.1
- iOS 9.3
- IOS Games
- ios uppdatering
- ios9
- iPad
- iPad Accessories
- iPad Air
- iPad Air 2
- iPad Air 3
- iPad Air 5
- iPad Apps
- iPad Mini
- iPad mini 4
- iPad Mini 6
- iPad mini retina
- iPad Pro
- iPados
- iphone
- iPhone 12
- iPhone 14
- iPhone 14 Pro
- iPhone 15
- iPhone 16
- iPhone 17
- iPhone 5
- iPhone 5S
- iPhone 5se
- iPhone 6
- iphone 6 plus
- iPhone 6c
- iPhone 6s
- iPhone 6S plus
- iPhone 7
- iPhone 7 display
- iPhone 7 Plus
- iPhone 7s
- iPhone Accessories
- iPhone Apps
- iPhone SE
- iphone x
- iPhone XS
- iPhone XS Max
- iPhone7
- iPhoneGuiden
- iPhoneguiden.se
- iPhones
- iPod
- iPod Nano
- iPod shuffle
- ipod touch
- iSight
- iTunes
- iWatch
- iWork
- iWork för iCloud beta
- Jailbreak
- James Corden
- Jämförande test
- Jämförelse
- Jet Black
- Jet White
- Jönssonligan
- Jony Ive
- Juice Pack
- Juridik
- Just mobile
- kalender
- kalkylator
- Kamera
- Kameratest
- Karriär/Utbildning
- Kartor
- Kevin Hart
- keynote
- Keynote 2016
- KGI
- KGI Security
- Kina
- Klassiskt läderspänne
- Kod
- Kollage
- koncept
- konceptbilder
- köpguide
- krasch
- Krascha iPhone
- Krönika
- Kvartalsrapport
- Laddhållare
- laddningsdocka
- Laddunderlägg
- läderloop
- lagar
- Lagring
- Lajka
- Länder
- lansering
- laserfokus
- Layout
- leather loop
- LG
- Liam
- Lifeproof
- Lightnigport
- lightning
- Linux
- LinX
- live
- Live GIF
- Live Photos
- Live-event
- Livsstil
- Ljud & Bild
- Logitech
- LOL
- Lösenkod
- Lösenkodlås
- Lovande spel
- LTE
- Luxe Edition
- M3
- M3TV
- Mac
- Mac App Store
- Mac Apps
- Mac Mini
- Mac OS
- Mac OS X
- Mac OS X (generellt)
- Mac OS X Snow Leopard
- Mac Pro
- Macbook
- Macbook Air
- Macbook Pro
- Macforum
- Macintosh
- macOS
- Macs
- MacWorld
- Made for Apple Watch
- magi
- Magic
- MagSafe
- Martin Hajek
- matematik
- Meddelanden
- Media Markt
- Medieproduktion
- Mediocre
- Messaging Apps
- Messenger
- MetaWatch
- Mfi
- Michael Fassbender
- microsoft
- Mikrofon
- Minecraft
- Ming-Chi Kuo
- miniräknare
- minne
- Mixer
- Mixning
- Mjukvara
- mobbning
- Mobile Content
- Mobilt
- Mobilt/Handdator/Laptop
- Mobiltelefon
- Mockup
- Mophie
- mors dag
- moto 360
- Motor
- MTV VMA
- multitasking
- Music
- Music Apps
- Music, Movies and TV
- Musik
- Musikmemon
- MW Expo 2008
- native union
- Nätverk
- Navigation Apps
- nedgradera
- Netatmo Welcome
- Netflix
- Netgear Arlo
- News
- Niantic
- Nike
- Nikkei
- Nintendo
- Nöje
- Norge
- Notis
- Notiscenter
- nya färger
- Nyfödd
- Nyheter
- Officeprogram
- Okategoriserade
- OLED
- omdöme
- Omsättning
- OS X
- OS X El Capitan
- OS X Mavericks
- OS X Yosemite
- Outlook
- Övrig mjukvara
- Övrigt
- PanGu
- papper
- patent
- PC
- pebble
- Pebble Smartwatch
- Pebble Steel
- Pebble Time
- Pebble Time Steel
- Persondatorer
- Petter Hegevall
- PewDiePie
- Philips
- Philips Hue
- Phones
- Photoshop
- Planet of the apps
- Plex
- Pluggar
- Plus
- Plusbox
- Podcast
- Podcast Apps
- Pokemon
- Pokemon Go
- Policy
- Porträttläge
- PP
- Pris
- priser
- problem
- Problems
- Productivity Apps
- Program
- Prylar & tillbehör
- Publik
- publik beta
- QuickTime
- räkenskapsår
- räkna
- ram
- RAM-minne
- Rapport/Undersökning/Trend
- Rea
- Reading Apps
- recension
- Red
- reklaamfilm
- reklam
- reklamfilm
- reklamfilmer
- rekord
- Rendering
- reparation
- Reportage
- Reptest
- ResearchKit
- Retro
- Review
- Ring
- Ringa
- Rocket Cars
- Rosa
- Rumors
- Rumours
- RunKeeper
- rykte
- Rykten
- Safir
- Säkerhet
- Säkerhetsbrist
- Samhälle/Politik
- samsung
- Samtal
- San Francisco
- SAP
- security
- Series 2
- Servrar
- Shigeru Miyamoto
- Sia
- Siri
- SJ Min resa
- skal
- Skal iPhone 6
- skal iPhone 6s
- skärm
- SKärmdump
- Skärmglas
- Skribent
- skribenter medarbetare
- Skriva ut
- skruvmejsel
- skydd
- Skyddsfilm
- Skype
- slice intelligence
- Smart
- smart hem
- Smart Home
- Smart Keyboard
- Smart klocka
- Smart Lights
- smartphone
- Smartwatch
- Snabbt
- Snapchat
- Social Apps
- Software
- Solo2
- sommar
- Sonos
- Sony
- soundtouch
- Space Marshals
- spår
- Speakers
- Special Event
- Spel
- Spelkonsol
- Spellistor
- Split Screen
- Split View
- Sport
- Sportband
- Sports Apps
- spotify
- Spring forward
- Statistik
- Steve Jobs
- Stickers
- Stockholm
- Stor iPhone
- Storlek
- Story Mode
- Strategy Games
- streama
- Streaming
- stresstest
- Ström
- Studentrabatt
- stylus
- Super Mario Run
- support
- Surf
- Surfplatta
- svenska
- sverige
- Sverigelansering
- Switch
- Systemstatus
- Systemutveckling
- tåg
- Taig
- Tangentbord
- Taptic Engine
- Tårta
- tät
- Tävling
- Taylor Swift
- Teknik
- tele 2
- Telefoner
- Telekom
- Telia
- Test
- Tid
- TikTok
- Tile
- tillbehör
- Tim Cook
- TIME
- TimeStand
- Tiny Umbrella
- Tips
- Toppnyhet IDG.se
- Touch ID
- TouchID
- tower defence
- trådlös laddning
- Trådlösa hörlurar
- trådlöst
- trailer
- Travel Apps
- Tre
- TrendForce
- TripAdvisor
- Trolleri
- trump
- TSMC
- Tum
- tv
- tvätta
- tvOS
- tvOS 9.2
- tvOS beta 2
- Tweak
- Typsnitt
- Ubytesprogram
- UE MegaBoom
- Unboxing
- Underhållning/Spel
- unidays
- United Daily News
- Unix
- Updates
- Uppdatera
- uppdatering
- Upplösning
- upptäckt
- USA
- Ut på Twitter
- utbyte
- utbytesprogram
- Utilities Apps
- Utlottning
- utrymme
- utvecklare
- varumärke
- Vatten
- Vattentålig
- vattentät
- vävt nylon
- Verktyg
- Viaplay
- Vibrator
- video
- Videoartiklar och webb-tv (M3/TW/CS)
- Villkor
- viloknapp
- Virtual Reality
- Virus
- visa
- Vision Pro
- VLC
- Volvo on call
- W1
- Waitrose
- Watch OS
- WatchOS
- WatchOS 2
- watchOS 2.0.1
- watchOS 2.2
- Webbtv (AppTV)
- wi-fi
- Wifi-samtal
- Windows
- Windows 8
- WWDC
- WWDC2015
- yalu
- Youtube
- Zlatan