The full $1 million will go to researchers who can find a hack of the kernel — the core of iOS — with zero clicks required by the iPhone owner. Another $500,000 will be given to those who can find a “network attack requiring no user interaction.” There’s also a 50% bonus for hackers who can find weaknesses in software before it’s released. Apple is increasing those rewards in the face of an increasingly profitable private market where hackers sell the same information to governments for vast sums.
Apple says it will offer up to $1 million for hackers who can find vulnerabilities in iPhones and Macs. “That’s up from $200,000, and in the fall the program will be open to all researchers,” reports Forbes. “Previously only those on the company’s invite-only bug bounty program were eligible to receive rewards.” From the report: As Forbes reported on Monday, Apple is also launching a Mac bug bounty, which was confirmed Thursday, but it’s also extending it to watchOS and its Apple TV operating system. The announcements came in Las Vegas at the Black Hat conference, where Apple’s head of security engineering Ivan Krstic gave a talk on iOS and macOS security. Forbes also revealed on Monday that Apple was to give bug bounty participants “developer devices” — iPhones that let hackers dive further into iOS. They can, for instance, pause the processor to look at what’s happening with data in memory. Krstic confirmed the iOS Security Research Device program would be by application only. It will arrive next year.