Apple Will Award Teen Who Discovered FaceTime Bug

[DrMacintosh]

The teen responsible for finding and exposing the FaceTime Bug that allowed users to be listened in on despite not answering the call will be eligible for Apple’s Bug Bounty Program. 

Quote

The 14-year-old kid who accidentally discovered the recent FaceTime eavesdropping bug has been told by Apple that he will be eligible for the company’s bug bounty program.

Apple set up its bug bounty program in 2016, offering rewards of up to $200,000 for security researchers who find vulnerabilities on the company’s software platforms. It’s not clear how much Grant Thompson can expect to claim from Apple — although it will reportedly go toward his college tuition savings.

I guess it’s good to see Apple rewarding someone with their program. Most people either don’t get credit or go to a third party. 

 

He was interviewd about his experience with Apple:

Quote

“I was contacted late Thursday evening by a higher level executive at Apple. He asked if he could meet with me the following day, so he flew in. He met with Grant and I in my office, and he thanked us in person and asked for our feedback.”

The executive (whose name hasn’t been shared, but is a software engineering manager at Apple) then said that Grant is eligible for Apple’s bug bounty program. While the family has yet to hear what this will entail, Apple has said that it will follow up with details.

As for Thompson? “I’m still going to continue to use Apple,” he told CNBC. “This was just a one-time-thing. Every now and then, something like this slips through the cracks and can be found. But in general I think Apple tries to keep our privacy safe, and I respect that.”

Good PR and everyone wins

 

Source: https://www.cultofmac.com/604504/apple-will-reward-teen-who-discovered-facetime-bug/

[Sauron]

Seems fair, it's a shame he has to blow it all just so he can go to college.

[Ashleyyyy]

good. they did what they said they would do when they set up the program. 

[ARikozuM]

2 minutes ago, GoldenLag said:

mfw you need to put money towards college 

Spoiler

Vote Bernie for 2020! 

 

On topic: People are always bashing Apple for having bugs, but these positive plays will never be heard. Also, college savings? I'd let him stay at my place in Uruguay so he can get 4 years of free college. 

[Sauron]

5 minutes ago, ARikozuM said:

On topic: People are always bashing Apple for having bugs, but these positive plays will never be heard.

It seems to me we're hearing about it

 

Also bugs happen, that's fine - the problem arises when the bug is so severe that it renders the phone unusable and shouldn't have passed the QA of the most valuable company in the world.

[Neftex]

6 minutes ago, ARikozuM said:

but these positive plays will never be heard.

what are you hearing right now then?

[ARikozuM]

7 minutes ago, GoldenLag said:

r/historymemes are allowed right?

  Reveal hidden contents

US: sounds like communist propganda

*civil war

 

good question. would it be cheaper moving to another country instead of saving for collage?

I already own the house in Uruguay, flight would cost about $600 round-trip, if it's the same as three years ago. I'm a URU citizen, so I am eligible for free college once I take and score well on the national test. 

 

5 minutes ago, Sauron said:

Another fun fact: if you need a dentist, it's cheaper to fly to, say, Spain and get a visit there than to get it in the US.

I just go to Colombia for vision and dental work. The US medical system is a mix of "doesn't work" and "too many hands to feed". 

[GoldenLag]

Just now, ARikozuM said:

-snip-

i can hear the vacuum cleaner coming. lets hide under the rug before its too late. 

 

 

 

*cough

 

what are the requirements to be eligible for reward for finding bugs?

[Sauron]

1 minute ago, GoldenLag said:

what are the requirements to be eligible for reward for finding bugs?

1) report a bug that apple aknowledges is a bug and not a feature

2) ???

3) profit

[ARikozuM]

2 minutes ago, Sauron said:

1) report a bug that apple aknowledges is a bug and not a feature

2) ???

3) profit

2) Attack Apple for having bugs in their closed ecosystem. 

3) ???

 

[BuckGup]

This is stupid. Remember the kid that found the bug where 13 spaces in any UNIX password field would grant them access

[ZacoAttaco]

Good story, was listening to a John Gruber podcast where they were wanting Apple to give this kid some compensation. Particularly considering it was group Facetime, which obviously has more application for enterprise users, it's especially good that this was found and patched ASAP.

 

Also, Apple has been in the news a lot recently and most of the stories have been positive. Good guy Apple. 

[Thaldor]

Good to hear Apple acknowledged the bug.

 

(Don't mind me on where the prize money goes, like I would know how much I would have to spent for IT engineering degree with couple of ccna and ccnp security certifications, buying a laptop, few pencils and a notebook was enough)

[Belgarathian]

Well handled by Apple for sure.

[Yoinkerman]

It was a pretty massive bug so I hope he gets a real reward and not some $5000 lol

[Bigbootyjudy]

THIS KID LIVES IN MY HOME TOWN. There was a column in the local newspaper and apparently, it took a week or two for Apple to even acknowledge that there was something wrong after he and his mother contacted apple in several different ways.

[mr moose]

<removed>

As others have said you are hearing about it, but also lets not forget that Apple ignored him and his mum's constant calls and emails for over a week. 

 

 

 

https://www.theverge.com/2019/1/29/18202398/apple-facetime-bug-warned-eavesdropping

 

Also the bounty program doesn't seem to be working to well:

https://appleinsider.com/articles/17/07/06/apples-bug-bounty-program-hindered-by-low-payouts-report-says

[ARikozuM]

3 minutes ago, mr moose said:

As others have said you are hearing about it, but also lets not forget that Apple ignored him and his mum's constant calls and emails for over a week. 

 

 

 

https://www.theverge.com/2019/1/29/18202398/apple-facetime-bug-warned-eavesdropping

Looks like that needs to be added to the OP. Apple should have at least sent out a confirm or receipt to assure that the issue was being looked at. 

3 minutes ago, mr moose said:

Also the bounty program doesn't seem to be working to well:

https://appleinsider.com/articles/17/07/06/apples-bug-bounty-program-hindered-by-low-payouts-report-says

Apple needs to pay out more then. There's an apparent lack in wanting security if the next buyer triples your offer. 

[SansVarnic]

-= Thread Cleaned for Complete Derailment of Topic =-

 

Lets get this conversation back on track.

[suicidalfranco]

And all that was needed to get here was a Twitter mob 

[Noctus]

Quote

This was just a one-time-thing. Every now and then, something like this slips through the cracks and can be found. But in general I think Apple tries to keep our privacy safe, and I respect that.

I'll take "Sentences that have never been said by a 14 year old" for 500, Alex.

 

 

@topic: Least their acknowledging it, wonder what sort of "reward" he'll get.

[Doobeedoo]

Cool stuff, good news i general and from a company. 

[vanished]

Please correct me if I'm wrong but didn't he basically announce it to the world on twitter or something as soon as it was discovered, rather than going through the proper confidential disclosure procedure and giving them time to fix it before going public?  If so, that's quite good of Apple to still honour the program like that.  It wouldn't be at all unexpected for them to give him nothing or even take legal action against him; I've seen as much or worse from other companies. That said you don't want to encourage more improper disclosure in the future as that puts users at risk and makes the company rush to fix it, potentially creating additional problems and causing lost functionality in the interim.

[DrMacintosh]

1 hour ago, Ryan_Vickers said:

Please correct me if I'm wrong but didn't he basically announce it to the world on twitter or something as soon as it was discovered, rather than going through the proper confidential disclosure procedure and giving them time to fix it before going public?

Yes. Which is why I was surprised that Apple did this. They probably saw that they were getting a lot of PR (mostly good) and once the bad PR about FaceTime came out they tried to balance it with giving the kid some cash. 

 

Apple is going to become a much larger player in services in the coming years, they need a positive brand image and this could be a calculated move. 

[79wjd]

1 hour ago, Ryan_Vickers said:

Please correct me if I'm wrong but didn't he basically announce it to the world on twitter or something as soon as it was discovered, rather than going through the proper confidential disclosure procedure and giving them time to fix it before going public?  If so, that's quite good of Apple to still honour the program like that.  It wouldn't be at all unexpected for them to give him nothing or even take legal action against him; I've seen as much or worse from other companies. That said you don't want to encourage more improper disclosure in the future as that puts users at risk and makes the company rush to fix it, potentially creating additional problems and causing lost functionality in the interim.

I thought he contacted Apple (privately) through a couple modes of contact before going to Twitter (a few days later) with a vague mention of the bug and a reference to his prior messages to Apple directly since he wasn't getting any response back (not surprising as I would expect it to take time for something to make it up the channel to someone who can actually do something).