Researchers have expressed frustration at the terms of an Apple bug bounty scheme in which special iPhones will be shipped out in the hope device and iOS vulnerabilities can be fixed more effectively.
Some voices in the security community have lamented restrictions in the Security Research Device Program (SRDP) which prevent them from publicly or privately disclosing any flaws until Apple sets its own disclosure date. This restriction, in addition to strict rules on how the iPhones can be used, has led some to describe the scheme as a "poison pill".
This SRDP was first announced in August last year at the Black Hat security conference, with no suggestion as to why it’s taken so long for the programme to be launched. Apple said at the time that it wanted to attract some of the most exceptional researchers that have been focusing their time on other platforms.
These devices are “dedicated exclusively to security research”, with unique code execution and containment policies. They also behave as closely to standard iPhones as possible, although shell access is available and researchers can run any tools on them.
They are not meant for personal use or daily carry, however, and must remain on the premises of participants at all times. All verified vulnerabilities, meanwhile, are legally required to be reported to Apple immediately, or the appropriate third party if the bug is found in third-party code.
Apple will then provide participants with a publication date, up to which point participants are restricted from discussing the vulnerability with anybody else, let alone in public.
This aspect of the scheme is proving to be a major sticking point for many, given Apple hasn’t committed to any particular disclosure window or timeline. Effectively, that means researchers can be ‘gagged’ for an indefinite period until Apple decides to set a publication date.
RELATED RESOURCE
Introducing VMDR: Vulnerability Management, Detection and Response
The all-in-one vulnerability management service
“Apple has no reason to give you a publication date until they decide they want to give you one,” one iOS jailbreaker told IT Pro, adding in a tweet that that participation was “a poison pill”.
“They could take as long as they want. You could be under NDA essentially forever. Disclosure deadlines are standard practice in the industry. They give vendors an incentive to address issues promptly.”
They also highlighted an explanation from Google as to why its Project Zero research programme has a 90-day disclosure window, chiefly, that it incentivises developers to fix vulnerabilities found in their code at a much faster pace.
Apple insists that it will work in good faith to resolve each vulnerability as soon as is practical, and that it will usually provide participating researchers with a publication date.
Researchers who are already a member of the Apple Developer Program can apply to participate in the programme, and will soon begin receiving special iPhones on a 12-month renewable loan should they qualify.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
-
A critical Ivanti flaw is being exploited in the wild – here’s what you need to knowNews Cyber criminals are actively exploiting a critical RCE flaw affecting Ivanti Connect Secure appliances
-
Researchers claim an AMD security flaw could let hackers access encrypted dataNews Using only a $10 test rig, researchers were able to pull off the badRAM attack
-
A journey to cyber resiliencewhitepaper DORA: Ushering in a new era of cyber security
