Apple Broadcasts $2 Million Bug Bounty Reward for the Most Harmful Exploits

Since launching its bug bounty program almost a decade in the past, Apple has at all times touted notable most payouts—$200,000 in 2016 and $1 million in 2019. Now the corporate is upping the stakes once more. At the Hexacon offensive safety convention in Paris on Friday, Apple vp of safety engineering and structure Ivan Krstić introduced a brand new most payout of $2 million for a series of software program exploits that could possibly be abused for spyware and adware.

The transfer displays how precious exploitable vulnerabilities could be inside Apple’s extremely protected cellular surroundings—and the lengths the corporate will go to to maintain such discoveries from falling into the incorrect palms. In addition to particular person payouts, the corporate’s bug bounty additionally features a bonus construction, including extra awards for exploits that may bypass its further safe Lockdown Mode in addition to these found whereas Apple software program continues to be in its beta testing section. Taken collectively, the utmost award for what would in any other case be a probably catastrophic exploit chain will now be $5 million. The adjustments take impact subsequent month.

“We are lining up to pay many millions of dollars here, and there’s a reason,” Krstić tells WIRED. “We want to make sure that for the hardest categories, the hardest problems, the things that most closely mirror the kinds of attacks that we see with mercenary spyware—that the researchers who have those skills and abilities and put in that effort and time can get a tremendous reward.”

Apple says that there are more than 2.35 billion of its devices active around the world. The company’s bug bounty was originally an invite-only program for prominent researchers, but since opening to the public in 2020, Apple says that it has awarded more than $35 million to more than 800 security researchers. Top-dollar payouts are very rare, but Krstić says that the company has made multiple $500,000 payouts in recent years.

In addition to higher potential rewards, Apple is also expanding the bug bounty’s categories to include certain types of one-click “WebKit” browser infrastructure exploits in addition to wi-fi proximity exploits carried out with any kind of radio. And there’s even a brand new providing often called “Target Flags” that places the idea of seize the flag hacking competitions into real-world testing of Apple’s software program to assist researchers reveal the capabilities of their exploits rapidly and definitively.

Apple’s bug bounty is just one of many long-term investments aimed at reducing the prevalence of dangerous vulnerabilities or blocking their exploitation. For example, after more than five years of work, the company announced a security protection last month in the new iPhone 17 lineup that aims to nullify the most frequently exploited class of iOS bugs. Known as Memory Integrity Enforcement, the feature is a big swing aimed at protecting a small minority of the most vulnerable and highly targeted groups around the world—including activists, journalists, and politicians—while also adding defense for all users of new devices. To that end, the company announced on Friday that it will donate a thousand iPhone 17s to rights groups that work with people at risk of facing targeted digital attacks.

“You can say, well, that seems like a very large effort to protect only that very small number of users that are being targeted by mercenary spyware, but there is just this incontrovertible track record described by journalists, tech companies, and civil society organizations that these technologies are constantly being abused,” Krstić says. “And we feel a great moral obligation to defend those users. Despite the fact that the vast majority of our users will never be targeted by anything like this, this work that we did will end up increasing protection for everyone.”