Apple launches bug bounty program

Apple announced to a crowded auditorium at the Las Vegas-based Black Hat security conference that it is planning to launch a new bug bounty program, which will offer cash to security researchers who find and reveal undisclosed vulnerabilities in Apple's software and hardware products to the company.

LAS VEGAS – Apple announced at the 2016 Black Hat USA security conference Thursday that it is planning to launch a new bug bounty program, which will offer cash to security researchers who find and reveal undisclosed vulnerabilities in the company’s products. Payouts can reach as high as $200,000.

The bug bounty program will begin in September on an invite-only basis and will first focus on the latest version of iOS, Apple’s mobile operating system.

Though the company had previously provided an official channel to share flaws in Apple’s technology, Thursday’s announcement represents the first time Apple has created a publicly visible bug bounty program.

Uber, Twitter, Facebook and even the Department of Defense have all leveraged bug bounty programs in the past to find vulnerabilities and thereby patch security holes. Such bounty programs are typically structured to limit or control the digital environment where the actually hacking occurs — with certain, affected systems quarantined from other business operations.

Until Thursday, Apple was one of the last, remaining major commercial technology brands to have never experimented with a bug bounty program.

To begin, the newly announced vulnerability disclosure project will be focus on just five distinct categories of bugs, including secure boot firmware components and unauthorized access to iCloud account data on Apple servers.

The prizes for disclosed, never before discovered vulnerabilities range from $25,000 to $200,000.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure