Good Place. Good Things. Good Time.

Infosec researchers say Apple’s bug-bounty program needs work

Infosec researchers say Apple’s bug-bounty program needs work

Enlarge / If you don’t maintain good relationships with bug reporters, you may not get to control the disclosure timeline. (credit: mhatzapa via Getty Images / Jim Salter)

The Washington Post reported earlier today that Apple’s relationship with third-party security researchers could use some additional fine tuning. Specifically, Apple’s “bug bounty” program—a way companies encourage ethical security researchers to find and responsibly disclose security problems with its products—appears less researcher-friendly and slower to pay than the industry standard.

The Post says it interviewed more than two dozen security researchers who contrasted Apple’s bug bounty program with similar programs at competitors including Facebook, Microsoft, and Google. Those researchers allege serious communication issues and a general lack of trust between Apple and the infosec community its bounties are supposed to be enticing—”a bug bounty program where the house always wins,” according to Luta Security CEO Katie Moussouris.

Poor communication and unpaid bounties

Software engineer Tian Zhang appears to be a perfect example of Moussouris’ anecdote. In 2017, Zhang reported a major security flaw in HomeKit, Apple’s home automation platform. Essentially, the flaw allowed anyone with an Apple Watch to take over any HomeKit-managed accessories physically near them—including smart locks, as well as security cameras and lights.

Read 13 remaining paragraphs | Comments

Infosec researchers say Apple’s bug-bounty program needs work - Infosec researchers say Apple’s bug-bounty program needs work -

Search more articles here: Infosec researchers say Apple’s bug-bounty program needs work

Read original article here: Infosec researchers say Apple’s bug-bounty program needs work



Disclaimers and Denial of responsibility..!

Denial of responsibility! TheTopMag.com is an automatic aggregator of all media around the world. In each content, the hyperlink to the primary source is specified. All trademarks belong to their rightful owners, all materials to their authors. If you are the owner of the content and do not want us to publish your materials, please contact us by email – jamesonline999@gmail.com . The content will be deleted within 72 hours.
You might also like
Leave A Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.