Thread by @sickcodes

Apple was supposed to be in our @DEFCON talk.

We sent them the vulnerability 4 months ago. They contacted us before the talk assuring us that we wouldn’t mention them, and we said, “sure because it’s not fixed yet.”

The vulnerability was discovered using a virtualized MacOS

This is weird because the SRD is only for iPhones.

@Apple will you release a security research device for the desktop?

Does the Mac security not matter as much as iOS?

I used a jailbroken iPhone to verify and then on old OS via @CorelliumHQ.

Leave Corellium alone #safeharbor

Apple takes security researchers for granted. Every single CVE is discovered on non-SRD devices.

I don’t think NSO Group was in the SRD program 😂

I used my own security research tool, along with 130,000 others:
github.com/sickcodes/Dock…

If Apple realistically cared about researchers they would set MINIMUM bounties instead of MAXIMUM bounties.

Ever vendor in the world uses minimums but Apple baits researchers and journalists into “100k,” but the bounty is much lower.

$100k but got $18k:
thezerohack.com/apple-vulnerab…

Here are the other security researchers btw, absolute A team of distributed & talented individuals from ~4 continents:

@johnjhacking
@tensor_bodega
@kaoudis
@Koroeskohr
@huntharo
@_xucheng_
@ryotkak
Tony Chung

And here’s the DEF CON talk from thread^

Well this is awkward....

Quote: “Pretty much a full iOS build on the Orka cluster”

macOS VM running the iOS simulator 🤣

“Rules for the and not for me”

macstadium.com/orkademo



*cough github.com/sickcodes/Dock…*