Apple expands its bug bounty, increases maximum payout to $1M

ronjor · Aug 8, 2019

Zack Whittaker@zackwhittaker 08 Aug 2019

Apple is finally giving security researchers something they’ve wanted for years: a macOS bug bounty.
The technology giant said Thursday it will roll out the bug bounty program to include Macs and MacBooks, as well as Apple TV and Apple Watch, almost exactly three years after it debuted its bug bounty program for iOS.
Click to expand...

Minimalist · Aug 14, 2019

Apple’s New Bug Bounty Is a ‘Historical Moment’ For the iPhone’s Security

Apple expanded the scope of its bug bounty, increased payouts, and promised special devices to a select group of researchers. For jailbreakers and hackers, there’s never been a better time to pwn the iPhone.
Click to expand...

https://www.vice.com/en_us/article/j5yqpk/apple-new-bug-bounty-historical-moment-for-iphone-security

guest · Aug 21, 2019

Is Apple's Top $1 Million Bug Bounty Too Much?
Why One Bug-Hunting Expert Says Big Bounties May Actually Undermine Security Programs
August 21, 2019
https://www.inforisktoday.com/blogs/apples-top-1-million-bug-bounty-too-much-p-2783

Progressive companies seeking to improve their security are increasingly adopting bug bounty programs. The theory is that rewarding outside researchers improves security outcomes. But in practice, bug bounty programs can be messy and actually create perverse incentives, says bug-hunting expert Katie Moussouris.

She contends that such a large sum of cash can negatively influence the human dynamics behind bug bounties. If paying money for vulnerabilities seems straightforward, it's anything but. There is actually complicated human psychology behind bounties, and getting the balance right is difficult.

"If Apple's stated goal was to compete with the offense market, it failed," Moussouris tells me. "If the stated goal is to attract new security researchers - well, that might work in the short term, but why would they join you if they just got a million dollars?"
The downside of high bug bounties is the potential to demoralize employees. Moussouris says she asked Apple how it planned to deal with its internal security team in light of such a great reward offered to outsiders. "They didn't have a great answer," she tells me.
Click to expand...

Log in or Sign up

Apple expands its bug bounty, increases maximum payout to $1M

ronjor Global Moderator

Minimalist Registered Member

guest Guest

Log in or Sign up

Apple expands its bug bounty, increases maximum payout to $1M

ronjor Global Moderator

Minimalist Registered Member

guest Guest

Useful Searches