Apple hands hackers secret iPhones in a bid to boost security; to offer Apple Mac bug bounty

Thomas Brewster for Forbes:

Later this week, at the Black Hat security conference in Las Vegas, Apple is to announce plans to give security researchers special iPhones that will make it easier for them to find weaknesses in the smartphone, Forbes has learned. It’ll also be announcing an Apple Mac bounty, so anyone who can find security issues in macOS will get rewarded, sources claimed.

The iPhones will be given to the rock star hackers that participate in the Cupertino company’s invitation-only bug bounty program, where participants disclose bugs in Apple products in return for monetary rewards. The payments can go as high as $200,000, as announced at the 2016 Black Hat conference.

What makes these iPhones special? One source with knowledge of the Apple announcement said they would essentially be “dev devices.” Think of them as iPhones that allow the user to do a lot more than they could on a traditionally locked-down iPhone. For instance, it should be possible to probe pieces of the Apple operating system that aren’t easily accessible on a commercial iPhone. In particular, the special devices could allow hackers to stop the processor and inspect memory for vulnerabilities. This would allow them to see what happens at the code level when they attempt an attack on iOS code.

But they won’t be the exact same as the iPhones Apple’s internal staff use. They’re going to be “lite” versions, without the same level of openness as enjoyed by Apple’s security team, one source said. For instance, it’s unlikely Apple will let the hackers decrypt the iPhone firmware, the software that underpins much of the device’s functionality. Outside of trying to boost iPhone security, the move could also be a reaction to leaks of dev devices, which have subsequently been sold on the black market.

MacDailyNews Take: This is good news, including the Mac bug bounty program:

Loosen the purse strings, Apple. Extend your bug bounty program to include macOS (and all other operating systems not currently covered). — MacDailyNews, February 6, 2019

In March, Lorenzo Franceschi-Bicchierai reported for Vice Motherboard:

Very few people have heard of them, but “dev-fused” iPhones sold on the grey market are one of the most important tools for the best iOS hackers in the world… Dev-fused devices are sometimes called prototypes in the security research industry. They are essentially phones that have not finished the production process, or have been reverted to a development state.

In other words, they are pre-jailbroken devices… These rare iPhones have many security features disabled, allowing researchers to probe them much more easily than the iPhones you can buy at a store…. Dev-fused iPhones have become a tool that security researchers around the world use to find previously unknown iPhone vulnerabilities (known as zero days), Motherboard has learned.

Dev-fused iPhones that were never intended to escape Apple’s production pipeline have made their way to the gray market, where smugglers and middlemen sell them for thousands of dollars to hackers and security researchers.