Frustrated dev drops three zero-day vulns affecting Apple iOS 15 after six-month wait

www.theregister.com
3 min read
standard
Security Bounty program slammed over 'broken promises'
Upset with Apple's handling of its Security Bounty program, a bug researcher has released proof-of-concept exploit code for three zero-day vulnerabilities in Apple's newly released iOS 15 mobile operating system.

The bug hunter, posting on Thursday to Russia-based IT blog Habr under the name IllusionOfChaos and to Twitter under the same moniker, expressed frustration with Apple's handling of vulnerability reports.

"I've reported four 0-day vulnerabilities this year between March 10 and May 4, as of now three of them are still present in the latest iOS version (15.0) and one was fixed in 14.7, but Apple decided to cover it up and not list it on the security content page," the researcher wrote.

"When I confronted them, they apologized, assured me it happened due to a processing issue and promised to list it on the security content page of the next update. There were three releases since then and they broke their promise each time."

The researcher added that the vulnerability dump conforms with responsible disclosure practices, noting that Apple was informed and has done nothing. And though the programming blunders are not terribly dire, from what we can tell, they ought to be addressed at some point.

Apple on Thursday issued a patch for macOS Catalina to address a different zero-day, having gone through a similar exercise ten days earlier to address a zero-click iMessage bug used to target human rights activists and other flaws.

The three unpatched…
Thomas Claburn
Read full article