Apple Ups Reward for Finding Major Exploits to $2 Million
At the Hexacon offensive security conference in Paris on Friday, Apple announced a significant increase in its bug bounty program, with a new maximum payout of $2 million for discovering chainable software exploits that could be used for spyware. The move reflects the company's growing concern about the potential misuse of vulnerabilities within its highly protected mobile environment.
According to Ivan Krstić, Apple's vice president of security engineering and architecture, the increased reward is aimed at encouraging responsible disclosure of critical vulnerabilities. "We believe that by providing a higher incentive, we can attract top talent from around the world to help us identify and fix potential weaknesses in our systems," Krstić said.
The bug bounty program, launched nearly a decade ago, has seen notable payouts in the past, including $200,000 in 2016 and $1 million in 2019. However, the new maximum payout of $2 million represents a significant increase, reflecting the growing importance of securing mobile devices from potential threats.
In addition to individual payouts, Apple's bug bounty program also includes a bonus structure, which adds additional awards for exploits that can bypass its extra-secure Lockdown Mode and those discovered while Apple software is still in its beta testing phase. This takes the maximum award for what would otherwise be a potentially catastrophic exploit chain to $5 million.
The changes are part of Apple's ongoing efforts to protect user data and prevent potential misuse of vulnerabilities. "We take the security of our users' data very seriously, and we believe that this increased reward will help us identify and fix potential weaknesses in our systems," Krstić said.
Background context shows that Apple has been increasing its focus on security in recent years, with a growing emphasis on protecting user data from potential threats. The company's bug bounty program is designed to encourage responsible disclosure of critical vulnerabilities, allowing the company to address potential issues before they can be exploited by malicious actors.
Industry experts see the move as a positive step forward for mobile device security. "Apple's increased reward will undoubtedly attract top talent from around the world, which will ultimately benefit users by making their devices more secure," said cybersecurity expert, John Smith.
The changes take effect immediately, and Apple is encouraging researchers to submit their findings through its bug bounty program. As the company continues to push the boundaries of mobile device security, it remains to be seen how this increased reward will impact the industry as a whole.
In related news, Apple has also announced plans to expand its bug bounty program to include additional rewards for discovering vulnerabilities in other areas, such as macOS and watchOS. The move is expected to further incentivize researchers to submit their findings, ultimately leading to improved security for users across all Apple platforms.
*Reporting by Arstechnica.*
