Apple expands bug bounty to macOS, raises bug rewards

Three years after it launched its bug bounty program on the Black Hat 2016 stage, Apple returned today to the same security conference to announce it is expanding the program.

While initially Apple's bug bounty program covered only iOS bugs, starting later this year, the company will also accept vulnerability reports for macOS, watchOS, and tvOS.

The expanded program will be open to all security researchers. Everyone will be able to report security bugs and receive a monetary reward from the Cupertino-based tech giant. Rewards will vary, depending on the vulnerability's impact and the damage it can do.

Speaking on stage at Black Hat today, Ivan Krstić, Apple's head of security, also announced a considerable increase in the rewards hackers are eligibe to make.

Currently, Apple is paying a maximum of $200,000 per vulnerabilities that can give attackers full control over an iOS device, with zero user clicks, from remote locations, and with code that executes in the iOS kernel.

Starting this fall, this maximum reward will be $1 million, and will also be available for macOS exploits, not just iOS.

But if researchers can't achieve this holy grail of exploitation scenarios, there are other types of vulnerabilities and scenarios that can bring up to $500,000 per bug report [see tweet embedded below].

In addition to these payouts, Apple is also offering a 50% bonus for bugs reported in pre-release builds. Through this unique offering, the company is hoping to prevent embarrassing or dangerous bugs from making it into final builds, where it may lead to attacks against its users, and where patching the vulnerable version may take weeks and months.

The iOS Security Research Device Program

Furthermore, as Forbes reported earlier this week, Apple is also launching a security research program through which it will provide a selected group of iOS researchers with special iPhones that are easier to hack.

These "pre-jailbroken" or "dev-fused" devices, as they're sometimes referred to, have existed for years at Apple, and have sometimes leaked out after being stolen/smuggled from Apple's China factories.

They have most security features disabled and are used by Apple employees to hunt bugs before prototypes are locked up and sent to mass-production.

Most of these devices end up on the black market, where they're sold for hefty prices, and sometimes end up in the hands of exploit brokers or zero-day sellers.

Now, Apple will be providing vetted white-hat security researchers with access to these devices, on purpose, to aid with hunting down bugs in its code.

Per a screenshot of Krstić's presentation, these special iPhones will provide access to a ssh daemon, a root shell, and advanced debug capabilities, not available in regular devices.

Unlike its bug bounty program, the iOS Security Research Device Program, as it is named, will be invite-only; however, applications are open to everyone.

HackerOne's top 20 public bug bounty programs

Related cybersecurity coverage:

• Facebook files lawsuit against two Android app developers for click fraud
• 3 ads generate 5.5 times more revenue than a web-based cryptojacking script
• AT&T employees took bribes to plant malware on the company's network
• US military purchased $32.8m worth of electronics with known security risks
• GitHub sued for aiding hacking in Capital One breach
• WordPress team working on daring plan to forcibly update old websites
• iOS developers still failing to build end-to-end encryption into apps TechRepublic
• The best identity theft monitoring services for 2019 CNET