Apple to Give Security Researchers 'Special' iPhones for Bug Testing, macOS Bug Bounty Program Coming

Apple is planning to give security researchers access to special iPhones that will make it easier for them to find security vulnerabilities and weaknesses, reports Forbes, citing sources with knowledge of Apple's plans.

Apple is going to announce the new program at the Black Hat security conference in Las Vegas, which kicked off earlier this week and is continuing until Thursday.


The "special" iPhones will be similar to "dev devices," aka iPhones that are not as locked down and that will better allow security researchers to locate bugs.
What makes these iPhones special? One source with knowledge of the Apple announcement said they would essentially be "dev devices." Think of them as iPhones that allow the user to do a lot more than they could on a traditionally locked-down iPhone. For instance, it should be possible to probe pieces of the Apple operating system that aren't easily accessible on a commercial iPhone. In particular, the special devices could allow hackers to stop the processor and inspect memory for vulnerabilities. This would allow them to see what happens at the code level when they attempt an attack on iOS code.
The iPhones won't be identical to the developer iPhones that are provided to Apple's internal staff, as they won't be as open. They are described as "lite" versions of the developer devices by Forbes, with security researchers unlikely to be able to decrypt the iPhone's firmware.

iPhone prototypes created for Apple's internal staff are popular with security researchers and hackers and can fetch quite a lot of money, as noted in a report earlier this year from Motherboard. Described as "pre-jailbroken devices," the iPhones are valuable because they can be used to find vulnerabilities both by those who have good intentions and those who have bad intentions.

Releasing a similar device to security researchers who participate in the bug bounty program will perhaps allow Apple to better locate serious bugs, leading to faster fixes.

Apple is also planning to announce a new macOS bounty program, which will provide rewards to people who find and report security vulnerabilities in macOS.

Apple's announcements could perhaps come on Thursday, which is when Ivan Krstić, Apple's head of security engineering, is set to offer a "Behind the Scenes" look at iOS and macOS.

Top Rated Comments

(View all)

15 weeks ago
About damn time Apple offered a bug bounty program for macOS!

:apple:
Rating: 13 Votes
15 weeks ago
This is really great news. They are serious about our security and it shows.
Rating: 6 Votes
15 weeks ago

I am now a researcher. Where is my phone? lol


If you're the kind of researcher Apple would send a phone to, the cost of an iPhone would be peanuts to you :p
Rating: 3 Votes
15 weeks ago
I was planning on going to Ivan Krstic's "Behind The Scenes of iOS and Mac Security" Thursday at 12:10 anyway. We'll see if they make the announcement then.
Rating: 2 Votes
15 weeks ago
Producing vulnerable phones? Will they ever stop copying Android?
Rating: 2 Votes
15 weeks ago

Producing vulnerable phones? Will they ever stop copying Android?

I am amazed that even in 2019, this “android copy iOS” “iOS copy android” narrative is still around. Are we still in 2012?

About damn time Apple offered a bug bounty program for macOS!

:apple:

Yeah, especially macOS is a such “unpatched” operating system, security wise.

So they’re basically giving out jail broken iPhones? Wonder how much those will end up going for on the black market afterwards...

Nope. This is less locked down but not “jailbroken iPhone”. I guess these iPhones are registered and can download special iOS version OTA or something.
Internal testing iPhone, however, will still be quite popular in black market.
Rating: 2 Votes
15 weeks ago

So they’re basically giving out jail broken iPhones? Wonder how much those will end up going for on the black market afterwards...

They go for one security expert's job.
Rating: 2 Votes
15 weeks ago

wow, those researchers must have to go through a crazy amount of vetting and sign some massive NDAs


Most importantly, they will be _known_ to Apple, and if they do anything to create harm to other users, there will be an army of lawyers descending on them. You can't create and distribute harmful hacks if Apple knows you. You can only sell them to Apple.
[doublepost=1565107644][/doublepost]

They go for one security expert's job.

Plus all his savings, his home, his future income, and his pension in many years time. For how long can you live in a nice style in Panama?
Rating: 2 Votes
15 weeks ago
wow, those researchers must have to go through a crazy amount of vetting and sign some massive NDAs
Rating: 1 Votes
15 weeks ago
I am now a researcher. Where is my phone? lol
Rating: 1 Votes

[ Read All Comments ]