A group of hackers has received 32 payments from Apple totaling $288,500 for discovering 55 vulnerabilities (11 critical) in the core systems as they hacked the tech giant for three months.
The critical bugs allowed the group to take control of core Apple infrastructure and âfrom there steal private emails, iCloud data, and other private informationâ.
Apple promptly fixed the vulnerabilities. There were a total of 55 vulnerabilities discovered with 11 critical severity, 29 high severity, 13 medium severity and 2 low severity reports.
According to the web application security researcher Sam Curry who was part of the group, once Apple processes the remainder, the total payout might surpass $500,000.
As of 6 October, the vast majority of these findings have been fixed and credited. They were typically remediated within 1-2 business days (with some being fixed in as little as four-six hours).
The hackers targeted Appleâs web assets after reading about 27-year-old Indian security researcher Bhavuk Jain who recently won $100,000 (over Rs 75.5 lakh) from Apple for discovering a now-patched Zero Day vulnerability in the Sign in with Apple account authentication.
âThis was surprising to me as I previously understood that Appleâs bug bounty programme only awarded security vulnerabilities affecting their physical products and did not payout for issues affecting their web assets,â Curry said.
Between 6 July- 6 October, Curry, Brett Buerhaus, Ben Sadeghipour, Samuel Erb and Tanner Barnes worked together and hacked the company.
âIf the issues were used by an attacker, Apple wouldâve faced massive information disclosure and integrity loss,â Curry said.
âFor instance, attackers would have access to the internal tools used for managing user information and additionally be able to change the systems around to work as the hackers intendâ.
Apple has been actively investing in its bug bounty programme and security researchers can receive up to one million dollars per vulnerability depending on the nature and severity of the security flaw.
âAs of now, 8 October, we have received 32 payments totaling $288,500 for various vulnerabilities,â Curry said.
âHowever, it appears that Apple does payments in batches and will likely pay for more of the issues in the following monthsâ.
Curry said that Apple has had an interesting history working with security researchers, but it appears that their vulnerability disclosure programme is âa massive step in the right direction to working with hackers in securing assets and allowing those interested to find and report vulnerabilitiesâ.
Apple, Vulnerability, Computer security
World news – US – Apple awards $288,500 to hackers who spot 55 bugs in its systems