Exasperated at Apple’s recent handling of its security bounty program, a cybersecurity researcher has released proof-of-concept (PoC) exploit code for three zero-day vulnerabilities in iOS 15.
The researcher, who is only known by the alias IllusionOfChaos, said his action is in response to Apple’s inaction to fix the vulnerabilities.
“I've reported four 0-day vulnerabilities this year between March 10 and May 4, as of now three of them are still present in the latest iOS version (15.0) and one was fixed in 14.7, but Apple decided to cover it up and not list it on the security content page,” wrote the researcher.
- Protect your devices with these best antivirus software
- These are the best iPhone antivirus apps
- Here's our choice of the best malware removal software on the market
The researcher added that while Apple initially apologized for their response, they later didn’t even respond to his email when he threatened to share details about the vulnerabilities within ten days.
Caught in red tape?
In the post, the researcher said that in their initial email Apple claimed the company failed to publicly acknowledge the vulnerabilities because of a “processing issue.”
“When I confronted them, they apologized, assured me it happened due to a processing issue and promised to list it on the security content page of the next update. There were three releases since then and they broke their promise each time,” shared the researcher.
IllusionofChaos then gave Apple ten days to explain the reason for the continued lethargy in fixing the bugs, warning them that the details will be shared post-expiry of the time frame. Since Apple didn’t respond, all the research has now been shared online.
“My request was ignored so I'm doing what I said I would. My actions are in accordance with responsible disclosure guidelines (Google Project Zero discloses vulnerabilities in 90 days after reporting them to vendor, ZDI - in 120). I have waited much longer, up to half a year in one case,” the researcher reasons as he shared details of the vulnerabilities along with PoC exploit code for all of them.
Interestingly, an anonymous jailbreak developer claims to have fixed all three vulnerabilities, barely a day after they were disclosed.
TechRadar Pro has contacted Apple for comment.
- These are the best ransomware protection tools
