Apple Ups Reward for Finding Major Exploits to $2 Million
At the Hexacon offensive security conference in Paris on Friday, Apple announced a significant increase in its bug bounty program's maximum payout. The company will now offer up to $2 million for discovering chain software exploits that could be used for spyware.
The new maximum payout is part of a revised bonus structure, which also includes additional awards for exploits that can bypass Apple's extra secure Lockdown Mode and those discovered while the company's software is still in its beta testing phase. This takes the total potential award to $5 million.
According to Ivan Krstić, Apple's vice president of security engineering and architecture, "The value of exploitable vulnerabilities within our highly protected mobile environment cannot be overstated." He emphasized that the increased payouts reflect the company's commitment to keeping such discoveries from falling into the wrong hands.
Since launching its bug bounty program nearly a decade ago, Apple has consistently offered notable maximum payouts. In 2016, the company topped out at $200,000, while in 2019 it reached $1 million. The new $2 million maximum payout is a significant increase and demonstrates the company's willingness to invest in securing its products.
The bug bounty program allows security researchers to submit potential vulnerabilities for review and reward. This approach has proven effective in identifying and addressing issues before they can be exploited by malicious actors.
Apple's decision to increase its bug bounty payouts may have implications for other tech companies, which could choose to follow suit. As the threat landscape continues to evolve, companies must remain proactive in securing their products and protecting user data.
The changes take effect immediately, with Apple encouraging security researchers to submit potential vulnerabilities under the new payout structure. The company's commitment to investing in its bug bounty program is a positive step forward in the ongoing effort to secure the digital world.
Background:
Apple's bug bounty program has been in place since 2016, and the company has consistently offered notable maximum payouts. In 2019, Apple reached $1 million for discovering chain software exploits that could be used for spyware. The new $2 million maximum payout is a significant increase and reflects the company's commitment to securing its products.
Context:
The bug bounty program allows security researchers to submit potential vulnerabilities for review and reward. This approach has proven effective in identifying and addressing issues before they can be exploited by malicious actors. Apple's decision to increase its bug bounty payouts may have implications for other tech companies, which could choose to follow suit.
Next Developments:
As the threat landscape continues to evolve, companies must remain proactive in securing their products and protecting user data. Apple's commitment to investing in its bug bounty program is a positive step forward in the ongoing effort to secure the digital world.
*Reporting by Arstechnica.*
