Apple is drastically overhauling its bug bounty program, eliminating its invitation-only status, increasing its rewards, expanding it to include MacOS and other operating systems, and even agreeing to supply qualified researchers with special iPhones that are easier to probe for vulnerabilities.
Apple's head of security engineering Ivan Krstic announced these changes last week at the Black Hat cybersecurity conference in Las Vegas, according to multiple news reports.
The decision to provide hacker-friendly iPhones is a significant one, as Apple's protections make it notoriously painstaking for white-hats to dig deeply into iOS devices. According to a report from Forbes, this move could be a reaction to the spread of iOS "developer devices" to the black market. These dev devices are designed specifically for developer testing, and therefore lack the normal layers of protection found on a typical iPhone.
But once Apple launches its official iOS Security Research Device Program next year, ethical researchers will have access to specially coded phones that offer similar advantages to the dev devices that malicious actors can acquire on the black market.
Only a limited number of trusted researchers will be eligible to receive one of these phones. On the other hand, Apple this fall will be opening up its once invitation-only traditional bug bounty program to all researchers. Additionally, the Cupertino, California-based company is bolstering its financial rewards. Indeed, a persistent, kernel-level remote execution bug that requires no user interaction will now fetch as much as $1 million. Meanwhile a network attack that requires no user interaction will earn researchers $500,000.
Additionally, Apple is extending its bug bounty program to macOS, watchOS and Apple TV, Krstic reportedly announced.
