Apple is doubling its largest bug bounty to $2 million

Apple is to update that it Security Bonus Program This November to offer some of the highest rewards in the industry. It has doubled its grand prize from $1 million to $2 million for discovering “exploit chains that can achieve goals similar to sophisticated mercenary spyware attacks” and require no user interaction. But the maximum payout can exceed $5 million for discovering more serious vulnerabilities, such as bugs in beta software and security mode bypasses. Lock Mode is an upgraded security architecture in the Safari browser.

Additionally, the company rewards detecting exploit chains through one-click user interaction with up to $1 million instead of just $250,000. The reward for attacks that require physical proximity to devices can now also rise to $1 million, up from $250,000, while the maximum reward for attacks that require physical access to locked devices has been doubled to $500,000. Finally, researchers “who demonstrated the execution of WebContent serial code with sandbox escapes could receive up to $300,000.” said Apple’s senior vice president of security engineering and architecture, Ivan Krstic Wired The company has granted more than $35 million to more than 800 security researchers since its launch Expanded program over the past few years. Obviously, top dollar payouts are very rare, but Apple has achieved multiple payouts of $500,000.

The company said in its announcement that the only system-level attacks it observed on iOS came from mercenary spyware, which is historically linked to government agencies and is typically used to target specific individuals. It said new security features such as Lockdown Mode and Memory Integrity Enforcement, which combat memory corruption vulnerabilities, could make mercenary attacks more difficult. However, bad actors will continue to develop their techniques, and Apple hopes that updating its bounty program with larger payouts will “encourage highly advanced research on the most important attack surfaces despite increasing difficulty.”