Further Reading Security firm pledges $1 million bounty for iOS jailbreak exploits

As part of a security presentation given at this year's Black Hat conference, Apple today announced that it would be starting up a bug bounty program in the fall. The program will reward security researchers who uncover vulnerabilities in Apple's products and bring them to the company's attention. Google, Microsoft, Facebook, and many other companies have offered bug bounty programs for some time now, but this is Apple's first.

For now, Apple is intentionally keeping the scope of the program small. It will initially be accepting bug reports from a small group of a few dozen security researchers it has worked with in the past. For now, bounties are only being offered for a small range of iDevice and iCloud bugs. The full list is as follows:

Secure boot firmware components: Up to $200,000 (~£150,000)

Extraction of confidential material protected by the Secure Enclave: Up to $100,000.

Execution of arbitrary code with kernel privileges: Up to $50,000.

Access from a sandboxed process to user data outside of that sandbox: Up to $25,000.

Unauthorized access to iCloud account data on Apple servers: Up to $50,000.

As the program continues and Apple works the, um, bugs out of its processes, the company will expand the list of eligible security researchers as well as the list of hardware and software bugs for which bounties are offered.

Researchers who want to claim the bounties will need to submit a report to Apple with a working proof-of-concept exploit that works on the latest stable version of iOS. If the bugs are hardware-related (as may be the case for Secure Enclave bugs), the proof-of-concept must also work on the latest shipping iPhone or iPad hardware. The payment amounts outlined above are upper limits—actual payments will depend on the novelty of the issue and how likely the issue is to be exploited.

Researchers are also asked not to disclose the bugs before Apple has time to fix them, though the company would only say it would fix them as soon as possible and wouldn't commit to a firm time window. Once the fix is published, researchers will be given credit if they want it (Apple already does this in its security update release notes). Successful researchers will also be given the opportunity to donate their bounty to charity alongside a matching donation from Apple, though Apple says it may choose not to match donations at its discretion.

Apple says it is implementing its bounty program in part because bugs are becoming harder to find, but these programs also deter researchers from selling those bugs to other companies, governments, or individuals who might want to exploit them. Back in November of 2015, an outfit called Zerodium paid a $1 million bounty for a browser-based jailbreaking exploit. And when Apple faced off against the FBI over encryption earlier this year, the FBI ended up paying "gray hat" security researchers for a vulnerability that allowed agents to access the data on the iPhone 5C at the center of the case.

Apple employees talking to the New York Times in the wake of the FBI case claimed that the company was "disinclined to keep up with a financial arms race of paying for bugs." This new bounty program points to a change in that way of thinking. The amount that Apple is willing to pay for bugs isn't quite as high as what third parties have offered in the past, but it's a good first step.