Apple Security Research Device
security.apple.com
security.apple.com
It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
Probably both things are true.
Either way, consumers ultimately win in that the products and services they use will be made more secure.
> Either way, consumers ultimately win
Except when the exploits fall into the _right_ hands. /s
The subsequent sentence on the page also says that if you find a vulnerability in a third-party app you have to tell the third party.
> For a reported security vulnerability affecting any Apple platform to be eligible for an Apple Security Bounty award, you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability.
Which does not have the meaning of prohibiting disclosure to third parties or the public; it only means that you forfeit the bounty.
"Apple reserves the right to immediately end your participation in the Apple Security Bounty program if you violate any of these terms and conditions as determined by Apple"
Entirely reasonable.
They can report it but have to wait until it’s fixed.
I think anyone angry about this is just looking for reasons to be angry. I also doubt the people complaining the loudest are even the targets of this program.
this is the unintended consequence that whoever came up with this policy missed: it effectively leaves only bad actors in your pool
Apple has safeguards to avoid selling exploits to criminals that attack Apple's own customers. Good. I wouldn't want Apple to "play ball" like that.
How is that not playing ball?
This manufactured outrage is getting ridiculous.
Is Apple also required to fix them ? Because my impression was that Apple only fixes vulnerabilities _after_ they are exploited or _publicly_ reported.
No, it's a way of making sure that Apple can fix the security issue and deliver the fix to customers before it can be exploited.
It’s not a ‘sneaky way of avoiding vulnerabilities going public’, it’s a responsible disclosure agreement between two consenting parties.
The text says they can’t disclose until after it’s fixed.
That’s reasonable. Calling this sneaky bribery and leaving out the fact that the agreement is only to wait until it’s fixed is really distorting the facts for maximum outrage.
This shouldn't exist in the first place. There would be no need for it if Apple didn't insist on "we own all the iPhones, our users just get to tap at them".
If you could just unlock the bootloader, re-enable SWD and do what you want with an iPhone that you actually own, there would be no need for this restrictive program at all.
The greatest middle finger to Apple is freeing their hardware. Been at it since I built and booted a uCLinux kernel on my first iPod I got as a kid.
Given how many high profile politicians, journalists and businessmen have gotten their phones hacked, the iPhone is not unhackable.
For instance, the much-touted "iCloud hack" of several years back was not made possible by iCloud being insecure; it was made possible because the users whose accounts were accessed had their passwords stolen in, IIRC, spearphishing attacks.
A bit of side track, but the 2014 massive hack was due to bad passwords hygine AND a serios vulnerability in Apple icloud (backup restore would bypass f2a and login failure rate limiting).
Back to the subject. See the reports from citizen labs, Google TAG and others. You will see they are often due to undisclosed vulnerabilities not user stupidity
They could start throwing an error when an iMessage pic looks funny from a decoder point of view. But this is so 90's.
I for one am not comfortable with anyone having that much power over something that is supposed to be mine, so they are the same to me. Untrustable black boxes.
The signatures enable the update client to verify the releases and the firmware to verify the OS with the public key flashed by the user as part of installing the OS. Signed updates and verified boot fully work with any build of GrapheneOS following our build instructions. Auditor and AttestationServer also work once they're rebuilt with the new verified boot hash included.
This one is not really a fault of GrapheneOS, and more a reality that Android is not actually an open platform and never will be. I require a lot more control of a device I need to be able to trust than anything in the android ecosystem can offer anymore.
Replicant was the right approach but sadly never got the resources to pursue it at the required scale to support new devices.
You can litteraly build and sign GrapeheneOS yourself and you can audit it, if this is your concern. While in the chain of trust there is still Google Root key first, is this far away from "run any software they want on your device at any time, and even remotely brick it"
(and ofc you could also block updates on grapheneOS, which would also prevent this aswell)
And a black box is not something that you dont understand, applying that logic anything becomes a black box.
Also what setup are you using then ?
edit: and i mean i understand the idea of not trusting devices, but this is just a false equivalence. While at the same time, if you dont want to live with technology from like 100 years ago, at some point do you have to trust a black box, if you want to call it that.
GrapheneOS is 100% open source and supports reproducible builds. It is in no way a black box.
If you do not want anyone to hold your signing keys, you will need to stop using nearly all modern hardware and software.
This is not the fault of the Graphene team so much as a fundamental problem in the mobile chipset market.
Desktop/Laptop CPUs give you dramatically more control, especially with OpenSIL etc.
There are simply are no sovereign software solutions for modern mobile hardware.
The Linux distro I founded has zero blobs. Built completely from source and boots and runs on real laptops and desktops. That is what 100% open source looks like. Meanwhile every Android distro requires a vendor partition with dozens of black box blobs.
This is a silly argument to make. By pretty much any standard, the iPhone has really good security.
Anyone know if those exploit(s) worked on iPhones with Lockdown Mode enabled?
* https://support.apple.com/en-ca/105120
* https://arstechnica.com/tech-policy/2026/02/fbi-stymied-by-a...
The "no root access, no bootloader unlock, no installing your own Apple-unapproved software" bullshit is mandated by Apple, with no opt-out.
I don't think that is a logical statement. Just something doesn't exist, does not prove that it can't exist. You need a stronger proof than that to show that in my opinion. At some point, you have to empower your users and trust them to do the right thing.
Let me expand the claim to include the caveats:
>The fact so many technical people believe that security and freedom are mutually exclusive [under current technological/financial/political constraints]
>At some point, you have to empower your users and trust them to do the right thing.
All I know is, my and my parents’ quality of life is far better after switching them to devices where they are not empowered.
Let's assume for the moment that such a thing can exist. Why does it not exist?
What do we know about free (as in speech) software?
- It tends to be written by people on their own time, or funded by companies that want to make sure it continues to exist (though generally, AFAIK, such companies only support existing projects; they don't fund people to create new open-source projects that wouldn't be under their control).
- Largely because of this and the Unix philosophy, it tends to be created as individual projects each made to do one job well, which can then be glued together to do larger jobs.
- It tends to be much less user-friendly than commercial software.
Putting all this together, it is not too hard to see why there aren't widely-adopted free-as-in-speech phone OSes. A phone OS is a large project, which needs to bring a lot of smaller components together within it in a consistent and predictable way; it is a very significant undertaking, requiring a high number of person-hours of work to make usable; and vitally, in order to be commercially viable, it needs to be user-friendly.
So it is very likely that such a project could, theoretically exist, but in practice never will, unless some very wealthy person or group decides to fund its creation without hope of commercial ROI.
I think if you don’t get the point of protecting a device against the user, you’ve not had to help un-tech savvy relatives get out of situations where dark or confusing UI practices have got themselves into a mess.
The average user has zero reason to go into some deep settings menu, or even plug in over USB and execute against it to unlock the bootloader.
Unless of course what you install is nefarious?
My Aunt Millie's iPhone is secure against herself because she can't install random garbage off the Internet and is in a walled garden.
As someone who works in IT: users are often their (and their organization's) own worst enemy. We've tried training and blacklisting (with anti-virus) for decades, and it appears that whitelisting and locking things down is what actually works.
I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
You just described what Samsung does with their phones. You can unlock them, but even if you later switch back to the normal OS, some features are permanently disabled by that fuse.
I got screwed by this by buying a used Samsung Tablet for the purpose of rooting it and made the mistake of letting it update after I factory reset it. Never buying a Samsung product again.
I wish they stop finding ways to lock down the device in the name of security and/or release different SKUs for the more secure use cases, provided by the organizations themselves if they deem it necessary.
I have a house full of servers and self host virtually my entire digital life and even my own usage of AI, but when I leave home I typically carry no electronics at all.
We convince ourselves we need phones, but I promise you, they are optional. Being offline a few hours a day is also good for your brain.
> Not everyone’s life is your life. Not everyone living not your life is doing it wrong.
The irony.
But I do advocate pretty strongly for open phones because they are becoming indispensable for leading a normal life without becoming a digital hermit.
They should be either open and indispensable or closed and dispensable, not indispensable and closed at the same time.
I make an actual case for the things I advocate for and actually live my convictions.
Why everyone would is better off electing Apple or Google or Meta to decide what software we are allowed to install, what content we can share with our friends, when our data should be deleted, and when it should be sold to the highest bidder that wishes to manipulate us at scale?
I am convinced surveillance capitalism is a net negative for society, but if you really think otherwise, please make an actual case for your own view instead of complaining about me making mine.
Many people's employer's use of MFA (including my own) says otherwise.
For many people ensuring their spouse and/or their children's school be able to reach them for emergencies and sudden matters says otherwise. Or an elderly parent (e.g., location tracking).
yubikey/nitrokey. Much more secure by a mile and works when your phone battery is dead. I switched multiple past employers from apps to these, joining as an SWE.
> tracking elderly parent (e.g., location tracking)
meshtastic asset tracking tag which will work even in emergencies when cell towers are down.
> children's school be able to reach them for emergencies
call-to-one-way-pager bridge, or voip-to-meshtastic bridge. Cheap to free solutions that will also work when cell towers are down.
Hit me with more perceived blockers if you are actually interested. Give me your gotchas. I have probably heard it all and am passionate about engaging people on this topic.
My wife and I have lived without a cell phone subscription for going on a decade and live a modern life as silicon valley tech workers.
Most have the choice to enjoy mostly the same lifestyle they have today, without Apple or Google or proprietary software or cell phones or even debit cards. There are reliable solutions for everything outside of the US surveillance capitalism bubble for those that actually want them.
Exiting surveillance capitalism is possible without major lifestyle changes.
Read Digital Vegan by Andy Farnell.
It really isn't - credit rating agencies are the most egregious examples by far, and next to impossible to opt out of.
We did have hardware tokens for corporate logins and banking needs.
There is no real reason why an open phone cannot be secure for sensitive applications.
Well, except that one-click PDF persistent root exploit American researchers found, and there not being any sort of iOS malware wave in the EU.
Also every iOS usually ends up with a "jailbreak", which is also known as an exploit. But somehow in Apple world that's different.
I really wish we could have a simple "don't bother me, I know what I'm doing" switch on these phones but I can certainly understand the reasons why Apple and Google are putting in as many roadblocks as possible to protect users from themselves.
I wouldn’t mind phones having “Adult” mode that intentionally fails secure net and is completely split off from the standard user space. In adult mode I install what I want.
No. They want more control. If they really cared about malware, they would have started with Google Play.
iPhones are aimed at the many millions/billions of technically unsophisticated users who don't care about rooting their phone, but would be very unhappy to get phished out of their life savings.
Grandma does not need the freedom to install the DeFlock or ICEBlock to help protect herself and her neighbors, right? Tim Cook is a Trump doner but of course has no political bias, and remains confident ICE and law enforcement always behave ethically so there is nothing to fear.
A corporation takes away basic freedoms of people over the tools they use to communicate with society, and then consumers get on the internet in public forums and -defend- them for it. Unbelievable.
I really hope you do not vote with this type of thinking.
You can muddy the waters with strawmen and politics, but I doubt you'll convince many people around here.
Tech CEOs will always do the right thing and act in public interest before profits or political favors, right?
They would never censor an app that the public largely wanted, right?
Fortnite did not pay their Apple tax, so no one got to install Fortnite. For safety.
To be clear, Google is just as bad. I do not use or recommend any products from either company.
I use laptops, desktops, or nothing, and get along just fine.
As an serial OS architect and infosec worker myself with over two decades of experience in OS hardening, and many critical public finds impacting nearly every fortune 500 company, I do not use Apple or Google products at all. They are both complete shit at security and privacy, among other reasons.
I rarely leave home with any electronics at all. Sometimes a portable music player.
My only portable computers are sub 10 inch laptops running QubesOS, but will be replacing that with an OS of my own design soon based on stagex, which I founded.
Any software I absolutely need to -trust- is built with stagex and run in dedicated enclaves, servers, and VMs.
...if you're primarily concerned with security.
Most people are not. They're primarily concerned with convenience, staying connected to people in their lives, and entertaining themselves.
And guess what? The iPhone does a pretty good job at this, while also being very good (not perfect) at security.
In general, if you start thinking of anything in the mode of "most people would be better off doing X the way I do it, but they don't", you need to start thinking about a) in what way they would be better off (because in 99% of cases, it's not going to be "universally, with no tradeoffs"), and b) what differences in understanding and priorities "most people" might have from you that would cause them to make those choices.
But look at people like Bunnie that actually reverse engineer things down to the metal. He made his own mobile device from scratch, from OS to metal, exactly because all existing options are garbage. These are the types people we should be paying attention to IMO.
Also had the ability to run Linux natively on my work machine, which was nice.
Obviously. Most people also were once not concerned with basic sanitation at hospitals, or with avoiding lead paint, or avoiding giving their kids alcohol to help them sleep.
The evidence these things were really bad came decades before public behavior changes.
Humans are so tribal that most will put fitting in and social norms before objective evidence to the point of killing themselves, and even their kids, so we should never assume the popular choices are the least harmful and well informed ones.
It is an evolutionary advantage that some of us do not weigh social norms so much.
So what happens when there's a baseband exploit?
I do not own a cell phone, but I build my operating systems from 386 bytes of machine code all the way up to dual hardware anchored remotely attestable servers with memory encryption and hardware anchored disk encryption, and can do whatever I want on them with confidence.
I even rack my own GPUs at home and own my own AI and "Cloud" too for less than the price of a used car.
The motivated and technical can do virtually anything with tech with total sovereignty and privacy. It has never been easier.
You keep posting this stupid crap that's meaningless. The second you step out of your house nearly everything you do is being logged by someone. Your internet connection is being spied on at multiple levels.
You cranking out at autist level 11 and thinking this is somehow normal and won't get you put on your own list.
You read to me as someone in an American tech bubble suffering from cognitive dissonance so profound you cannot even engage with the substance of a single viewpoint not shared by you or those in your bubble, except to mock and insult.
Almost certainly. Nero divergent people make up a large part of the tech crowd.
It's not mocking and insulting. It's pointing out you are atypical and therefore any solution you have is not global.
And if you only take into account stock phones, stock Pixels are still above it as per exploit costs.
So they are basically 3rd or 4th place if you add some other Android flagships into the list.
Graphene is iOS
Citation needed. cough iMessage, HW backdoors cough
It wasn't that long ago that my bank's app had its own NFC payment feature that worked perfectly fine on a rooted phone. Unfortunately, they killed that feature and moved to Google Wallet.
As it turns out, payment infrastructure only requires tamper proofing if that's part of the arbitrary requirements of the app you're using.
What problem are you trying to "solve"?
Do not fall for it. Publish everything publicly after appropriate embargo periods.
There are some really ridiculous attempts to be outraged about this program.