Apple Ups Reward for Finding Major Exploits to $2 Million
At the Hexacon offensive security conference in Paris on Friday, Apple announced a significant increase in its bug bounty program's maximum payout. The company is now offering up to $2 million for discovering chain software exploits that could be used for spyware.
According to Ivan Krstić, Apple's vice president of security engineering and architecture, the move reflects the value of exploitable vulnerabilities within Apple's highly protected mobile environment. "We're committed to ensuring the security of our users' data and devices," Krstić said in a statement. "This increased reward is a testament to that commitment."
The new maximum payout is part of a revised bug bounty program that includes a bonus structure for exploits that can bypass Apple's extra secure Lockdown Mode as well as those discovered while Apple software is still in its beta testing phase. The total award for what would otherwise be a potentially catastrophic exploit chain could now reach up to $5 million.
Since launching its bug bounty program nearly a decade ago, Apple has consistently increased the maximum payouts. In 2016, the company offered up to $200,000, and in 2019, it raised the bar to $1 million. The latest increase reflects the growing importance of security in the tech industry and the need for companies like Apple to stay ahead of potential threats.
The bug bounty program has been instrumental in identifying vulnerabilities within Apple's software and hardware. By offering substantial rewards, Apple aims to encourage responsible disclosure and prevent malicious actors from exploiting these weaknesses.
As the tech landscape continues to evolve, it is likely that other companies will follow suit and increase their own bug bounty payouts. The move by Apple sets a new standard for the industry and highlights the importance of prioritizing security in the development process.
The revised bug bounty program takes effect immediately, and interested researchers can submit their findings through Apple's website.
*Reporting by Arstechnica.*
