apple needs you to find the bug.

[@LowLevelTV]

haha no way thats crazy anyway you should learn to code at lowlevel.academy it's on sale I think

[@binary_ironclad]

Bruh

[@rubberduckdebug]

> work at apple > put an RCE in cloud software > "find" exploit in cloud > profit

[@chrisalex82]

infinite money glitch

[@TheVirtualArena24]

What is rce?

[@markdatton1348]

@@TheVirtualArena24 remote code execution/exploit

[@Kane0123]

Really Cheap Explaination

[@shapelessed]

@@TheVirtualArena24 Let's be fair, if you're watching this channel, you should be familiar with the term...

[@john_smith281]

To be clear, this is confidential computing and it is neither new nor exclusive to apple or arm. AWS and Google Cloud also offer these computing services. x86 has a similar concept. Great video.

[@cooolkie]

However they don't provide read only boot disk. Unless you're using Cloud Run or Lambda. Also the confidential computing architecture is a little bit different to ARM. You can check out GCP or AWS documentation.

[@bigpod]

Azure also has confidential compute, but yes confidential compute on arm is a bit better(mainly becasue its newer so expect x86 to catch up)

[@bigpod]

@@cooolkie wait they dont or at least they provide ephermeral boot disks(boot disks that gets created fresh on every boot from image aka no data saved on boot disk is kept after shutdown)

[@cooolkie]

@@bigpod They do allow you create a new machine from a fresh boot disk. It's like they copied OS image(Ubuntu, Amazon Linux etc..) to a disk. And boot up system with this disk. However they're still writable. The disk won't be deleted when you shutdown the VM. But you can choose not to keep this disk when you delete or terminate the machine.

[@bigpod]

@cooolkie interesting on azure you have ephemeral boot disk option where boot disk is created at boot based on image and only data on additional mounted drives stays but any data on boot disk is gone on shutdown

[@seansingh4421]

I’m pretty sure the CIA will pay me about 5x that for the same RCE.

[@kmcat]

I'm sure the NSA would be more intrested or China

[@petroz5505]

Make that 20

[@test-sc2iy]

Read Pegasus, a spy in your pocket, saudi princes will pay a billion

[@wolcek]

Why? They can come to ARM/Apple and "kindly request" secret modifications to give them access. And until someone finds out, you will be none the wiser.

[@neurobioboy]

Kim would offert you a North Korean citizenship with a diplomatic passport for it. ;)

[@Ganerrr]

state actors surely won't insist on manufacturing a version of these chips that record all the secret stuff

[@isbestlizard]

exactly.. a few years from now we'll discover a 'bug' in the realm implementation that for some reason bypasses all security when a certain io is performed with a certain register value such a strange weird bug that nobody can explain how it got there

[@Veptis]

the new Intel chips have "dummy structural support chips"... sure - or just a hardware backdoor

[@ninele7]

I can't imagine how can it be verifiably private in this case. I haven't found out any high level description on how it works, but I can imagine one way: CPU is manufactured by different company and contains HW key that can subscribe attestation requests. That way you can actually verify that software runs on correct hardware in right environment but you need to trust CPU manufacturer not to leak this key anywhere. In case of apple they control both cloud and CPU production. So if you don't trust Apple all this things seems useless even being open source. If someone dug deeper it would be interesting to learn how it works.

[@FryGuy1013]

​@@ninele7 I think the only way to truly do this securely without some level of trust is with homomorphic encryption. But that adds tons of overhead which this doesn't seem to be.

[@user-fed-yum]

So what you're saying is that you have no idea how any of this works.

[@xjjfjfdjdh9993bbhhhh5hjjjjd]

Strangely, this is probably the cheapest way for Apple to harness free security analyzers and not have to pay them like an employee or independent contractor. However, this might be a better idea, assuming they implement the fix for the bug correctly and share the architecture as an open source standard so everyone can truly benefit in a world in which we unwillingly are forced to give our private info to people that don't understand basic security practices. Maybe this is the new work model for paying FOSS developers.

[@jonathanodude6660]

"new"?

[@Veptis]

isn't $1M kinda low for such a zero day. I mean adversaries will likely pay more, right? RCE on iOS was like 2M for example on zerodium.

[@moderndiscourse]

@@Veptis you’re correct. It’s absurdly low. State level actors would pay upwards of 10 mil on the grey market for a zero day like this.

[@nommy8599]

And it's 'maximum' too with minimum not mentioned.

[@poke_champ]

sell it to both 😁

[@comosaycomosah]

way low for a zero day that would break their compute encryption

[@Kane0123]

Kind of an interesting forcing function. If you find something, you could hold onto it and try sell on the black market, but someone else might find it and hand it to apple first.

[@fy7589]

I think if ARM is involved and if this is implemented on the instruction set level, it may be a good thing for this to be done with cloud computing as they can catch bugs much faster and make it really secure. We may end up seeing secure architecture on our devices much sooner because a lot more testers will be on board this way, rather than dealing with a bunch of shipping.

[@phy3451]

need an apple id to submit a bug

[@nommy8599]

Is this true? It was sus already with the "maximum bounty" meaning actual bounty is likely 0...

[@shizo1013]

make apple ID or get 50k. Real hard decision

[@shizo1013]

@@nommy8599 it is in their best interest to pay the people bruh. If they don't then no one will come to them with bugs

[@hrmny_]

​@@nommy8599 these companies do pay a lot of money to people finding security issues How much always depends on the severity, but definitely not even close to 0

[@71Jay17]

Or sell it on the black market for twice and get put in jail when it's used

[@vicaya]

So this is just AMD SEV-SNP (4th gen now with extensive research coverage) Intel TDX (some research) implemented in Apple silicon. Good thing they chose to add encryption extension over the vanilla CCA. Source available is a must for public attestation. The fundamental issue is the conflict of interest: chip manufacturer is controlled by the same company that provides the service.

[@robertosutrisno8604]

Source available is useless if we can't verifiable prove that the hardware runs that code, something that currently isn't possible for a cloud instance

[@izzieb]

I'm not convinced, particularly with regards to ARMs hardware security extensions. Only this year, an exploit was found in ARM's "Memory Tagging Extensions" (MTE was intended to help mitigate memory safely bugs). While ARM acknowledged the exploit, they said it could potentially be mitigated with changes in software like the Linux kernel. Kind of defeats the point of hardware protections then, at least to me...

[@robertosutrisno8604]

Yeah because fixing hardware-level bug that's burned into the silicone isn't as easy as patching code, if a future exploit due to hw bug I think the manufacturer should issue a recall especially if they advertise and charge premium for the feature

[@DavidGrossNYC]

I always tell people. I don’t trust any of them, but I trust Apple more than anyone else at the moment. It can change, but that’s the current environment I see.

[@offgrid-bound]

Wrongly worded! I don’t trust any of them, but distrust Apple the least. 😜

[@g.i.l.l.e.s]

First off: I did enjoy your video. But there's one issue sticking out: You're calling the code "open source". But the page you're scrolling through clearly states "limited use"... There is way more required than just the source being available for it to be "Open source"! You could call it source available or similar, but please don't muddy the water by calling it open source if it is not. There are already enough corporations currently trying that. :-/

[@BitZorg]

Yeah looking at license file you can't do much with the code other use it security analysis, definitely source available not open source. I'm glad Apple used better terminology at least.

[@pi_ist_toll]

I agree, but the point of this video isn't "Apple goes Open Source".

[@maboesanman]

“Source Available” would be the correct term in this case

[@ChrisM541]

@@maboesanman "Limited Source Available” would be the correct term in this case.

[@Kane0123]

What your actually referring to be GNU/Source Available

[@nexttonic6459]

The real question is does the user see what is happening in realm? Or is it just one more layer to put corporate spyware in?

[@chri-k]

i had some long explanation in here but it got too tangled, so here's the short version: The answer to the first question is no, but the the answer to the second question is "also no, unless you're running a suspicious OS which allows it to do that"

[@bearwolffish]

9:55 Ye I like the shift towards hardware TEE's and trustless solutions across sectors.

[@nightshade427]

wait, so you can get the vre and run it local on mac? so do macs already have the trusted private compute hardware in the m series chips, or is the trusted compute really done in all software with no hardware realms?

[@josephlabs]

I believe so, they are using M3 Macs for their private cloud computing.

[@sUmEgIaMbRuS]

@@josephlabs It could also work as a purely software emulator. If that's the case, it just runs significantly slower than the real thing. But if you're a security researcher, that isn't really a problem.

[@BeefIngot]

I can't help think anything that isn't Homomorphic encryption is liable to basically any of the security concerns anything else would have. It seems like you'd just have to trust that this hardware was what was being used.

[@JamesGroom]

Yeah, it doesn't seem to be based on that at all. So this thing is about as secure as any other cloud offering, seeing as it's physically impossible to verify what hardware/software Apple is running from over the Internet. I bet someone will find a timing attack or something and claim the $1M.

[@doingwell5629]

That's not a ton of money; for breaking into a cloud, it's very little money.

[@ChrisM541]

Then find exploits but keep them to yourself until the timing is right...or negotiate for a higher price (but then, they have the upper hand because we're not at release stage).

[@oaklyfoundation]

@@doingwell5629 You are such a downer..

[@davidh6831]

It's a trade-off of whether you think someone else won't find your 0Day before they go live.

[@offgrid-bound]

As a software developer for forty years, I should be filled with hope watching this. Why does it give me only despair…? We (IT people) have created a monster. Meanwhile, kids can’t use basic tools.

[@brunhildegerdruth643]

IBM has the same concept already called IBM Secure Execution since IBM z15. I'm not aware of any bug bounties for their implementation though.

[@everyhandletaken]

I think inviting people into the process is definitely a step in the right direction & hopefully we will see more of this

[@petergerdes1094]

Looking at the apple docs I see no mention of ARM realms only the apple silicon implementation of memory protection using AES XEX encryption mode and anti-replay tags. Do you have some other source? I think that's it and there is no ARM realms just the secure enclave etc.

[@josephmazor725]

Apple is seemingly doing the best job at cloud implementation I’m genuinely impressed so far

[@Jenny_Digital]

When I started in computing, the processor I had was 8-bit. It was an NMOS 6502 and didn’t even know the word _secure._ Back then games were protected in clever ways that could often be beaten with a special cartridge with an NMI button and custom ROM.

[@shantanusapru]

4:30 -- Link to this paper?

[@SunsetGraffiti]

I almost burst into tears at 4:35.

[@wolcek]

"Trust zone" - the zone you *have to* trust. "System management" - the way someone can manage your system (Intel's ME - running minix, with unknown functionality and vulnerabilities). You have no choice but to trust these components, without knowing what is inside and with no guarantee they do not contain backdoors.

[@absolute-narwhal]

i got an ad for mac on this video 😂

[@comosaycomosah]

yea but like as others mentioned a million (max) really aint that much for that kind of zeroday, somewhat cool they made it at least an option tho i guess lol idk

[@useless274]

physical changes to silicon or microcode never lead to new security bugs

[@Satoshic_]

your privacy only exists before the government or some other authorized party request in the case of anything that is running not locally

[@papakamirneron2514]

The problem is that most vulnerabilities would probably be in the hypervisor a.k.a. backdoor land.

[@papakamirneron2514]

Which they would probably modify whenever they feel like it.

[@arawup8007]

I may not be fully understanding this, but it feels like a confidential compute(Arm realm management extension) could be a good alternative(with other new complementing system) to kernel based anti-cheat. Example if you can keep all the network communication in that confidential compute, with the game server and the output is just the frame. it would keep conventional cheats from accessing geometry, and other player position data. It still doesn't prevent AI and Visual recognition models from interpreting those frames, but i think that is a different problems.

[@aravindpallippara1577]

The reason anti cheat fails isn't due to not having enough complicated software locks, it's entirely due to the hardware that has been compromised by the user themselves.

[@johnmcparland3277]

any attempt to ship hardware locked compute onto your personal computer should be smacked down IMMEDIATELY. microsoft has been trying to ship that for literal DECADES so they can enforce DRM. Encountering a wallhacker in counterstrike every once in a while is a small price to pay for having full control over the compute happening on MY machine in MY home.

[@j14wei]

That money comes from the docked salary of the security team

[@Edogmonkey]

on that last point about wanting your AI to be all local. i just don’t think that's realistic for the average person. i honestly think most "tech savvy" would have trouble with it. i hope apple allows you to run prompts on your local instance from your phone as if it were the apple servers. like an option to setup a local compute instance fully integrated and promotable from your phone and ideally they release all the source i would buy a fully specced mac mini instantly. maybe they make the chatgpt integration generic enough to implement local as well. pipe dream ik but i sure feel like a plumber

[@kellymoses8566]

How does this compare to AWS Nitro Enclaves?

[@jouniosmala9921]

It also makes a potential cyber criminal enough money to choose a take a legal money instead of taking a risk of getting caught of a crime.

[@pimpstick2]

Meh, I would take the fappening 2 over the 10k or whatever bs real world payment they would pay out.

[@nommy8599]

If they're paid the 'maximum'... I have no doubt a large corporation will jump at the opportunity to give money away when they don't have to... This seems more like a half arsed publicity stunt. Others here have pointed out such Apple vulnerabilities sell for more elsewhere too. If they were serious they could offer at least as much and not be ambiguous about the reward amount.

[@Otakutaru]

Hi Ed, could you please leave the source of the publications you talk about on the video? As a purely constructive critique: It would be really nice and elevating for the channel if you were to provide the source AND ALSO cite the page and section you're currently showing on screen, so that we could read directly from the PDF/website/etc.

[@Katchi_]

Feeding by the spoon...

[@Otakutaru]

@Katchi_ It's just common practice to share the link. Reading directly from source publication is not spoon feeding

[@ultrasive]

I wonder how many kernel bugs allow you to escape the namespace and cgroup isolation of the containerd runtime such that you can execute commands on the host.

[@GreatTaiwan]

hence why it's snadboxed i would assume

[@mundanesquirrel8687]

Intel tried and failed doing the same using their secure enclaves. They made it before the sidechannel data leaks and their implementation ripped to pieces a few years back.

[@DavidZech]

PCC doesn't really use the confidential compute concepts that are typically laid out, which usually describe a setup that protects (vm) workloads from a privileged-yet-malicious hypervisor, which is kind of backwards when you think about it. Instead, any code executed after boot-rom is transparently verifiable and attestable. The full binary images of PCC, including firmware images, OS, and any overlaid packages will be released for researches to disassemble, and verify the claim that no personal data is mishandled.

[@whophd]

This simultaneous focus on the high-level and low-level - with massive global applications tied strictly to behaviours implemented on RISC hardware, where one or two specific commands make such a difference - reminds me of the study of astrophysics. They always spend one minute describing the massive interactions of inconceivably large structures and energies, followed immediately by a statement on the bounding principles of molecules and atoms and particle interactions. The super large macro events are defined by the super small micro elements.

[@an742_]

they also produce severance

[@velho6298]

Incentives in correct place

[@GreatTaiwan]

where are the sources? usually u had them in the description 😭

[@thansyprimezax]

6 months ago i have reported ai cloud security vulnerbility in apple security research platform but it still reproduced issue tag

[@juskolk5839]

Hi could you make video about Vin instructions

[@juskolk5839]

Vim*

[@yramagicman675]

I wish the world of zero knowledge proofs was more advanced in computer science. We could answer the question of trust around private cloud compute with a zero knowledge proof. Sure, exploits would fracture the privacy and security of this, but a zero knowledge proof would help set a foundation of trust.

[@autohmae]

Yeah, Intel and AMD64 have been doing that and working on improving on what they've created for over a decade and thus this is not really news.

[@HadTooMuchToDream]

Should confidential computing be claimed truly mastered. Where by a user can have a secure, trusted cloud environment where data cannot be intercepted by any of the means available to the owners and administators of that environment or hardware it runs on. I would disbelieve the claims.

[@MelroyvandenBerg]

no they dont pay you.. they most likely relabel the severity to a lower classification.

[@Furry_Lord]

And a worser possibility could very well happen when you hit the limit. I am not about to find out. Don't we see all the criminals out there? Some likes breaking stuff but not so many of them, sometimes I did wonder why they still did what they did, perhaps grudge or smthg idk.

[@JakMihoff]

If i understand: by going for the million reward...lets say one succeeds. Isnt that a crime committed?

[@xCheddarB0b42x]

They should immediately pay the Kaspersky research team that discovered Operation Triangulation. hue hue hue

[@newtonchutney]

Doesn't Intel have some secure enclave thingy like these arm realms?

[@hairetsu]

give me a few minutes.... got it!

[@DyesViolet]

wtf apple putting some of their code out in the open? That is some news! Really love their change of hearts. At least this seems like a starting point of really good relations to security researchers!

[@Furry_Lord]

Believe what you do believe sir. 😊

[@scottspitlerII]

If this works, it’s the future. We can have true privacy on the internet

[@papakamirneron2514]

Remember guys, a cheap server is better and more secure than most cloud compute (also cheaper after a few years)!

[@lua9058]

Abuse bug yourself > make 10x the amount Apple Pays

[@bjarne9700]

> get in Jail with $0

[@cracks1291]

So now a hacker would have to write technical documentation on a zero day for iCloud and submit it for their review. For them to decide if it is valuable. It isn’t worth the money - having that level of exploit can make you waaaaaaaaay more money on a black market.

[@lotarion]

this is pre-release, so keeping any zero-day info would be a gamble, since someone else can discover the same zero-day and give Apple a heads-up. You're basically playing prisoner's dilemma except you don't know how many prisoners are there, and it's enough for only one to "defect", aka, sell the 0-day info, to spoil the game for everyone

[@daydrip]

No one smart enough to hack this is going to do it for the bounty. You could make way more by selling it or abusing it…

[@unperrier5998]

I sure hope they don't implement their ICs with TTL logic as said at 4:00 🤣

[@TKOh-tt9oi]

Definitely more valuable than $1M to keep that zero-day private

[@bjarne9700]

yes, thats how a black marked works. Offer more, than the legal competitors.

[@gregf9160]

To Apple, a million dollars is pretty insignificant. Not even petty cash for paperclips and small stationery 🤣

[@sent4dc]

How is it "cloud" though?

[@TheVirtualArena24]

How can I learn to do bug bounty ASAP???

[@geugenm]

Kaspersky confirms that it does indeed provide payment.

[@alfred.clement]

you can tell a vendor's priority by looking at the reward table, at least they beat Microsoft's bounty reward xD

[@bytesizedfeed]

Anyone got a link to the jira task for this

[@brano2yt]

Well you can still run pretty buggy server in that private cloud, whats the point of break in from "inside" (or other private cloud) when all these bugs are in software that it runs? Like be safe from apple? Hm.

[@trapfethen]

In certain cases yes. It makes it an easier sell for other entities that have what they perceive to be "really super secret highly valuable technical trade secrets implemented into code" to use and rely on cloud computing. In particular, smaller corporations are hesitant to rely on the "trust me bro" legal guarantees that Apple and other big corps provide because they know they literally don't have the resources necessary to actually ENFORCE that agreement against the big gorillas. Having a method to run your software without even the running host being able to freely ease-drop on your process memory would largely mitigate that hesitation.... for a price obviously. Couple that with the fact that quite a few moves to the cloud are not the decision of the low level devs, but CTOs and other higher level management who have varying levels of technical background who are just SOLD on the dream problem of 10X growth overnight and being able to handle that scale. Most companies don't have growth patterns that look even remotely like that, even fewer actually need to support it on a recurring basis to make the extra cost and complexity of cloud solutions worth the hassle. Most small companies would perform just fine with modular monoliths and set maintenance and upgrade schedules with a bi-annual review. This turned a bit more into a rant than I initially intended, but TLDR, there are companies that want to use the cloud, but are hesitant because they are worried the cloud provider might snoop on their stuff or enable some third-party to snoop on their stuff.

[@pimpstick2]

If only apple had paid what the hackers wanted we would have never had the fappening lol. I love how apple also doesn't like to pay out bug bounties and instead say "it's a feature" till it gets massively exploited then patch it later never to pay out.

[@official.sirhaxalot]

I wonder how much zerodium would pay?

[@dave24-73]

Is any cloud really secure, I mean you have zero visibility or control over their side.

[@vitinhuffc]

Israel/china can pay you at least like 10x that

[@hburke7799]

it's a shame all these security features will only be used by DRM and spying rootkits...

Don't take the bait. Stay off the radar and don't let everyone know you have hacking skills.

[@veccio]

Ha, they use Splunk!

[@dennisolsson3119]

I don't doubt the tech, but I doubt the actors. The HW can be emulated meaning what is seemingly private is run in clear text by NSA or another TLA.

[@cdkw2]

10:38 there is no video there...

[@aliengarden]

@@cdkw2 I see it (on mobile)

[@cdkw2]

@@aliengarden ik ik I just thought it looked funny lol

[@inxomnyaa]

Fixing bugs for a company that doesn't really allow anything 🤔

[@71Jay17]

The bug bounty isn't new. Nor is it a large amount of money considering what the black market would offer. That would be a better video, dive into the business end of the black hats that dwarf some countries revenue! Could link it into the disincentives of legally reporting as well like the cases of people being jailed after reporting vulnerabilities. The "must buy into one of the three big US software companies" just wrong. You don't have to, at all, & frankly is reason to avoid.

[@Furry_Lord]

Mhmm, Ikinda agree. However you really do need to watch what you type. I know you are quite intelligent but sometimes pretending to be ignorant and dumb goes a long way. >_

[@NiffirgkcaJ]

I wish I was as smart as these people. I would probably be rich now. 😔

[@JoakimKanon]

The fappening has entered the chat…

[@CheeksMcClappinn]

Not sure what individuals being hacked due to their own poor security practices has to do with anything, might as well claim that Nokia phones are unsafe because your nana gave out her bank details to a scammer while using one

[@Furry_Lord]

@CheeksMcClappinn But Nokia phones are resilient, that can't be. When making a comparison always be careful of exploits. When you compare Apple with Nokia, what you are implying is no longer related neither software, hardware or by accident. Nokia are incredibly resilient in a different way, same as Apple which is equally resilient. In this comparison you made you are assuming 1. Apple should merge with Nokia. 2. Apple product are equally impressive as Nokia product. 3. Apple can get hacked the same way as Nokia gets hacked. 4. Apple has the same software, hardware as to Nokia and if Apple gets hacked that way there is a chance Nokia can completely prevent that from happening. 5. By free speech standard, you just told everyone including Apple that Nokia is making fun of Apple, by using the company name in your sentence for this event.

[@CheeksMcClappinn]

@@Furry_Lord you wrote all that to refute something which was used as an example of something that you wouldn't say Are you on the spectrum?

[@Furry_Lord]

@CheeksMcClappinn Beep beep beepbeeep. I dont understand. beeep.

[@geoffxander7970]

Step 1: Trust Apple with your data. Found the bug.

[@Satoshic_]

there is no reason why you should trust with your data to any company

[@ValidatingUsername]

I’m not gonna show them how I put a server ping at boot level operating software that doesn’t get erased when my phones get factory reset 😂

[@Kaoson73]

A million bucks for Apple equates to a coffee price for most of us. I want a billion to take this shit seriously.

[@markjakker2091]

Someone already go the bounty and is actively exploiting data. Don’t ask me how I know

[@Furry_Lord]

You seriously think they will let you take the million dollar and leave..

[@Katchi_]

Yes. The alternative is very messy.

[@4ohm531]

CIA and China gotta bid on me working at apple

[@maboesanman]

I hope this architecture comes to personal computers, specifically so games can run low overhead anti-cheat. I don’t know how feasible that is, but it would be great to have a way to do anti-cheat that doesn’t damage user privacy.

[@flarebear5346]

That would be very very cool

[@codelinx]

Don’t do it… they deserve to have undiscovered 0 days….

[@XMickleXx]

apple and privacy ? something smell fishy here

[@jeffsprings928]

A million dollars is a million dollars 🤷‍♂️

[@markjakker2091]

Why are they putting all of this in the cpu ? This should be a kernel construct or module. Then they create new instructions for this cloud garbage. Isn’t cloud on its way out ?

[@luketurner314]

Fun fact: if you substitute the 'C's for 'P's and vice versa in the acronym PCC, you get CPP which is the file extension for C++ files Fun fact #2: PCC can also stand for Portable C Compiler

[@talkdatrue]

I don’t know nothing about all these, but my toxic trait is sure that I’ll be able to hack them and get that 1 mill 😂😂😂

[@har3nz]

Am I the only person who watches all his videos but doesn't understand anything

[@xoisnei]

I like your attitude.

[@TicoDK]

Can someone get 1 million dollar every time they find a backdor placed for the government? LUL

[@honon-cs2wl]

SALTY

[@hungrymusicwolf]

Wait a minute, when did Apple start sounding like a respectable company? Did we reality-shift back into a saner world?!