PDA

View Full Version : The $1 million iOS bug bounty is bad for security research



wraggster
September 22nd, 2015, 21:56
http://o.aolcdn.com/dims-shared/dims3/GLOB/crop/1200x675+0+0/resize/1200x675!/format/jpg/quality/85/http://o.aolcdn.com/hss/storage/midas/ccdba72feafce85d9bd56421979a19e9/202665285/0916_appstoremalware-1.jpg (http://www.engadget.com/2015/09/22/ios9-bug-bounty-hackers/)
The public perception of the black-hat hacker is of a lone person sitting in a dark room creating malware and unleashing it on the world and reaping the profits of their exploit. The reality is a bit more complicated and far more financially lucrative. Nothing shines a light on this more than the Zerodium publicity stunt (https://www.zerodium.com/ios9.html) of offering $1 million for iOS 9 zero-day exploits. Founder Chaouki Bekrar has a history of selling exploits (http://www.forbes.com/sites/andygreenberg/2012/03/21/meet-the-hackers-who-sell-spies-the-tools-to-crack-your-pc-and-get-paid-six-figure-fees/) to the highest bidder instead of disclosing the issue to the maker of the compromised product. It flies in the face of responsible disclosure (https://en.wikipedia.org/wiki/Responsible_disclosure) of exploits by security researchers and means that anyone with enough cash will have the ammunition to ruin the digital life of anyone with an iPhone.

http://www.engadget.com/2015/09/22/ios9-bug-bounty-hackers/