Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone (forbes.com)

Article summary

Apple has announced a $1 million reward for anyone who can hack an iPhone by finding a kernel exploit with zero clicks required. The company is also offering $500,000 for network attacks requiring no user interaction. A security researcher has already found several vulnerabilities, but it is unclear if they meet the criteria for the reward. The researcher is employed by Google and may donate any reward to charity.

Main themes

• iPhone hacking
• bug bounty programs
• security research
• zero-day exploits
• black market sales

What commenters say

• The $1 million reward may not be claimable by the security researcher who found several iPhone vulnerabilities because they do not meet the specific criteria.
• Some researchers may not be motivated by the reward and could potentially sell their findings on the black market instead.
• The black market for zero-day exploits is not as lucrative or accessible as commonly perceived, and selling exploits to governments or brokers is a more realistic scenario.
• The bug bounty program is designed to incentivize researchers to report vulnerabilities to the vendor rather than selling them on the black market, by offering a higher monetary reward and lowered legal risk.
• The jailbreaking community may not be eligible for the special developer devices offered by Apple, as they could potentially use them to find and sell exploits.
• The sale of zero-day exploits is not necessarily illegal, and law enforcement and intelligence agencies are among the buyers on the black market.
• The idea of a bug bounty program is to make reporting vulnerabilities more profitable than selling them on the black market, but the effectiveness of this approach is debated.