Enlarge / If you don’t maintain good relationships with bug reporters, you may not get to control the disclosure timeline. (credit: mhatzapa via Getty Images / Jim Salter)
The Washington Post reported earlier today that Apple’s relationship with third-party security researchers could use some additional fine tuning. Specifically, Apple’s “bug bounty” program—a way companies encourage ethical security researchers to find and responsibly disclose security problems with its products—appears less researcher-friendly and slower to pay than the industry standard.
The Post says it interviewed more than two dozen security researchers who contrasted Apple’s bug bounty program with similar programs at competitors including Facebook, Microsoft, and Google. Those researchers allege serious communication issues and a general lack of trust between Apple and the infosec community its bounties are supposed to be enticing—”a bug bounty program where the house always wins,” according to Luta Security CEO Katie Moussouris.
Poor communication and unpaid bounties
Software engineer Tian Zhang appears to be a perfect example of Moussouris’ anecdote. In 2017, Zhang reported a major security flaw in HomeKit, Apple’s home automation platform. Essentially, the flaw allowed anyone with an Apple Watch to take over any HomeKit-managed accessories physically near them—including smart locks, as well as security cameras and lights.
