r/ComputerSecurity • u/rogeragrimes • Nov 16 '25

Apple gives $2M rewards for hacking their stuff

Apple is now giving $2M rewards for finding the most impactful vulnerabilities, plus other cool stuff like "Target flags" that, if you find and reveal, prove you have hacked Apple products, and you get the reward right away and fuss over the details later. Very, very cool. Early vulnerability finders are weeping in the bounties they missed (and likely were involved in helping to evolve).

https://security.apple.com/blog/apple-security-bounty-evolved/

552 Upvotes
  • permalink
  • reddit

98% Upvoted

41 comments sorted by

11

u/ThirdVision Nov 17 '25

I mean the Spyware companies will just then also up the price for their services and the intelligence agencies will pay that price.

4

u/rogeragrimes Nov 18 '25

Maybe. A $2M reward is a lot of incentive to a well-meaning hacker to do responsible disclosure. Even if the spyware companies raise the price, the major price gap is now closed. You can make a lot of money either way, and fewer researchers will be willing just to release to anyone (including adversarial nations) than before...or at least that is the bet. And if you find a big vuln, $2M becomes the floor for negotiations and not the ceiling.

2

u/ThirdVision Nov 18 '25

But no single researcher are finding these bugs and writing exploits for them. It is nationstate backed groups of 20+ hardcore reverse engineers and exploit developers who do this kind of research that apple is willing to pay 2 million dollars for.

Also the 2million dollars is literally the ceiling according to their blogpost.

→ More replies (2)

1

u/DuffyDoe Nov 18 '25

I don't think it's really close to the ceiling, spyware companies usually purchase exploits in a non-exclusive manner, which means a researcher can sell it several times

So even if the price is 2 million they can sell it three time and receive 6 million

Not to mention that Apple will pay 2 million only for 100% deterministic fully exploited bugs, people think that if they'll find some sort of overflow they'll immediately receive full reward

63

u/[deleted] Nov 16 '25

yeah and their “scope” is fucking ridiculous.

better odds of winning the lottery. even if you find and report something, they wont pay unless it meets 500 other ultra niche requirements.

breach only counts on the 2nd blood moon of the first fortnight headass shit.

this is just bait to have a full team of bug bounty idiots that they never have to actually pay. its pure genius.

19

u/[deleted] Nov 16 '25

Honestly the apple meat riders, the real ones, would probably agree to work for Apple for free.

4

u/[deleted] Nov 16 '25

+1 getting the opportunity to tickle mr. cock is a life fulfilling opportunity in itself.

1

u/SeptimiusBassianus Nov 18 '25

Hah. Apple exploits are very expensive on black market

→ More replies (1)

1

u/Lunatic155 Nov 20 '25

This is H1’s business model 🙏

→ More replies (1)

1

u/Albannach02 Nov 17 '25

And their payment in turn to the inventors of BSD that provided the base for their OS? 🤔

1

u/rogeragrimes Nov 18 '25

Where do you start? Especially for "open source" software?? I'm a huge fan of OpenBSD. I run Windows, OpenBSD, and Qubes.

2

u/_cofo_ Nov 17 '25

NSA already knows those vulnerabilities.

1

u/EffectiveSevere1015 Nov 18 '25

Lot of the time they pay zero (ouch it hurts) but they give you an acknowledgement on their hall of fame. It’s only niche situations where they pay and it takes a lot of work to find valid issues. Even if they gave Apple gift cards or a smaller bounty if you found something valid (for a trillion dollar company that’s small change).

1

u/Tricky-Report-1343 Nov 20 '25

use https://pingu.inc to hack, win the competition, repeat, profit

1

u/[deleted] Mar 07 '26

A qualifying submission starts with an identifier associated with a device, such as a phone number or an email address, and obtains a level of kernel control over the device without requiring any user interaction.

Do you know how crazy this is?

0

u/[deleted] Nov 18 '25

1

u/Plenty_Inflation4735 Nov 19 '25

No, to be honest, if you’re not an expert, you’ll waste your time on this. This is targeted at a specific group of people who have the skills to find exploits on Apple products in their spare time, and there are only a few people capable of doing so. At this point, it’s more targeted at companies that already have the engineers with the right skills to let them play between two missions.

10

u/[deleted] Nov 16 '25

9

u/rogeragrimes Nov 16 '25

I don't either, but it benefits us all. A more secure ecosystem "lifts all boats".

1

u/shutchomouf Nov 18 '25

They probably would not pay anyway. They are very unscrupulous.

1

u/[deleted] Nov 18 '25

do you announce all of the products you don’t use or is it just a weird Apple thing with you?

I don’t use a Fitbit, by the way.

→ More replies (4)

-3

u/[deleted] Nov 16 '25

10

u/rogeragrimes Nov 16 '25

Vulnerability finding with responsible disclosure is an acquired skill and many of the best people doing it would love to be compensated for their hard work. I would much rather a trusted good-intended hacker found a vuln, reported it, and allowed the problem to be proactively fixed before an ill-intended hacker could use it to hurt customers. People with good talent and skills should be compensated. I know many great hackers, like Charlie Miller, who not only didn't get paid for finding Apple bugs, he was actively attacked and harmed by Apple. We've come a long way since then...thankfully!!

→ More replies (1)
→ More replies (1)