Two members of Project Zero, Google’s elite bug-hunting team, have published details and demo proof-of-concept code for five of six “interactionless” security bugs that impact the iOS operating system and can be exploited via the iMessage client.
All six security flaws were patched last week, on July 22, with Apple’s iOS 12.4 release.
Details about one of the “interactionless” vulnerabilities have been kept private because Apple’s iOS 12.4 patch did not completely resolve the bug, according to Natalie Silvanovich, one of the two Google Project Zero researchers who found and reported the bugs.
The bugs were discovered by Silvanovich and fellow Google Project Zero security researcher Samuel Groß… When sold on the black market, vulnerabilities like these can bring a bug hunter well over $1 million, according to a price chart published by Zerodium. It wouldn’t be an exaggeration to say that Silvanovich just published details about exploits worth well over $5 million, and most likely valued at around $10 million.
MacDailyNews Take: Like it or not, Project Zero helps make all operating systems they investigate safer, including the world’s most advanced mobile operating systems, iOS and iPadOS.
If you haven’t updated your iOS devices to iOS 12.4, do so as soon as possible.
Well done. And this is how you publicize. Let the bug get fixed, then publish. Don’t run around like some little bitch saying how you warned Apple and they did nothing so you’re letting everyone know how the exploit works.
Wait. What? I think if someone “warned Apple and they did nothing” that is a good thing for everyone to know.
How do you think we got to a place where companies reward researchers for bugs and are very quick to fix them? You think that didn’t happen because of the potential of disclosure?
TheloniusMac, you and I don’t usually agree on politics, but I think you’d agree on human nature – people usually only deal with things if they have good incentive. In the past, most tech companies didn’t seem to feel enough incentive to fix security bugs. The notify, wait reasonable time, then publicly disclose regime is what helped to change that.
You should never make the exploit publicly known. The fact that you have an exploit and Apple is not interested, and you will offer it to show it to other security professionals is enough.
Then you are dangerously naive. Have you not been paying attention? Nothing, repeat…nothing, remains secret and dormant. The very act of suppressing ‘advantageous to someone with no qualms’ material, essentially ensures unregulated freedom to fleece the unwary.