this post was submitted on 10 Jun 2024

419 points (89.3% liked)

Technology

59629 readers

2874 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

419

Apple refused to pay bounty to Kaspersky for uncovering vulnerability in 'Operation Triangulation' - 9to5Mac (9to5mac.com)

submitted 5 months ago by AnActOfCreation@programming.dev to c/technology@lemmy.world

60 comments fedilink hide all child comments

Kaspersky uncovered iOS vulnerabilities in 'Operation Triangulation', reported to Apple, but was refused bounty payment
Apple's Security Bounty Program offers rewards up to $1 million for discovering vulnerabilities to prevent them from being sold on the dark web
Apple's refusal to pay Kaspersky could be due to restrictions on financial transactions with companies in sanctioned countries like Russia.

top 50 comments

sorted by: hot top controversial new old

[–] cbarrick@lemmy.world 239 points 5 months ago (4 children)

Apple Security Bounty awards may not be paid to you if you are in any U.S. embargoed countries or on the U.S. Treasury Department’s list of Specially Designated Nationals, the U.S. Department of Commerce Denied Person’s List or Entity List, or any other restricted party lists.

Kaspersky can whine all they want. Russia is embargoed. They're not getting their money.

Kaspersky is a good company doing good work in the cyber security space. Unfortunately, because of the embargo, they may have to turn to the black market to sell future exploits. Or maybe not; I'm not totally sure what kind of ethical standards they have.

[–] Bell@lemmy.world 60 points 5 months ago (1 children)

Yeah sorry guys, did you forget you work for an asshole?

[–] alcoholicorn@lemmy.ml 76 points 5 months ago (1 children)

Apple could have tried to work with them and said something like "We'll pay when the embargo ends", since now Kapersky has every reason to sell their next apple exploit on the black market.

They've just turned a department of people successfully working to make apple more secure into a department of people working to make it less secure.

[–] mindlight@lemm.ee 61 points 5 months ago (24 children)

Apple could have tried to work with them and said something like "We'll pay when the embargo ends"

.....aaaaand that would most likely be trying to circumvent the sanctions by essentially receiving credit from Kaspersky on delivered services.

Not saying the situation is optional, but the sanctions would be extremely toothless if it was that easy to circumvent.

[–] ours@lemmy.world 25 points 5 months ago (2 children)

How is holding the money until (and if) the sanctions are lifted, "circumventing"?

However unlikely it would be, if the sanctions are lifted (maybe Russia gets a new, sane Government, calls off its invasion, stops its international shenanigans), wouldn't it be OK to pay this company then?

[–] AmbiguousProps 23 points 5 months ago (2 children)

It would still probably count as some sort of trade (even when delayed), which is what would violate the sanctions.

[–] nova_ad_vitum@lemmy.ca 3 points 5 months ago

It could be argued that such delayed trade should be encouraged. Let Apple's debt to Kaspersky build up, with interest, but it'll only be paid once sanctions end which will only happen once pre-determined conditions are met. It's basically an increasing incentive to change course in a way that will result in sanctions being lifted.

There are probably some pretty severe downsides to this approach though.

[–] nilloc@discuss.tchncs.de 1 points 5 months ago

If the point of the embargo is to pressure affected parties to enact change on the governments policies, offering the reward after sanctions are lifted would be an added incentive.

It should be allowed or even encouraged to help the power of the sanctions.

[–] mindlight@lemm.ee 14 points 5 months ago

In many cases it's doing business and not just the payment!/compansation that the sanctions is about.

load more comments (23 replies)

[–] Fizz@lemmy.nz 33 points 5 months ago (2 children)

It would be very very bad for world if the folks at Kaspersky turned to black hat activity

[–] lud@lemm.ee 8 points 5 months ago

That is not for Apple to decide. They should just follow the law.

[–] MigratingtoLemmy@lemmy.world 2 points 5 months ago

I wish they opensource their framework

[–] awesome_lowlander@lemmy.dbzer0.com 2 points 5 months ago

Kaspersky also has a bunch of US-based subsidiaries or partners they're selling their software through. Or Apple could have just escrowed their reward until the embargo was over.

[–] etchinghillside@reddthat.com 1 points 5 months ago

Who/what are on those other lists.

[–] RaoulDook@lemmy.world 180 points 5 months ago (1 children)

"Apple refuses to send money to security company inside of embargoed country, to maintain compliance with USA law."

[–] suction@lemmy.world 3 points 5 months ago

Security company which is most likely controlled by the Kremlin

[–] BrownianMotion@lemmy.world 72 points 5 months ago (6 children)

This is not really a story, is it.

I worked for an Australian company, that was bought by an American company. Instantly we were required to do business as per American law, such as embargo's. We lost many customers (businesses) that honestly had nothing to do with the actual reason for the embargos. For example Iran has an American embargo because of nuclear refinement, but we just wanted to sell "knives and forks" to them. Nope - they might use those forks in their refinement centrifuges... This is what happens (but also why embargos work).

Kaspersky is Russian owned, so the hacks were discovered by Russian [whitehat] hackers. I'll bet that Apple had no ability to do "business" with the company, even if it wanted to, since Russia is currently under embargo due to the Ukraine conflict.

Now if Kaspersky spent time undermining it's own failure of a government, and putting an end to its dictatorship, things would probably work out better for everyone in Russia.

[–] Blackmist@feddit.uk 18 points 5 months ago (1 children)

Is that the case though. You can buy a copy of Kaspersky anti virus right now if you live in the US. They have a US office. You can legally send them money.

[–] exanime 15 points 5 months ago (2 children)

Or put the money in escrow pending resolution of the embargo ... This is, I think, the easiest, most responsible solution to show good faith

[–] lengau@midwest.social 11 points 5 months ago (1 children)

Apple

Good faith

Lol good one!

[–] exanime 4 points 5 months ago

Yes agreed... I was trying to point out that just not paying is a dick move

[–] Bakkoda@sh.itjust.works 2 points 5 months ago

Yeah thank you. There's a ton of ways to "hold" the money legally so Apple can still be separated from some of its money.

load more comments (5 replies)

[–] saltesc@lemmy.world 35 points 5 months ago

"refused". Okay, headline.

[–] riodoro1@lemmy.world 21 points 5 months ago

„Apple doesn’t want to send money to russia which is also illegal”

News 2024

[–] Psych@lemmy.sdf.org 14 points 5 months ago (1 children)

Should've just sold on black market . Better luck next time .

[–] alcoholicorn@lemmy.ml 12 points 5 months ago (1 children)

You trusted me? You fucking idiot. -Tim Apple

[–] dev_null@lemmy.ml 11 points 5 months ago* (last edited 5 months ago) (1 children)

What has trust go to do with anything. Apple cannot pay them due to sanctions. There is nothing to indicate they don't want to pay them, they are just legally not allowed to do so.

[–] alcoholicorn@lemmy.ml 4 points 5 months ago

So do something else. Or indicate you will pay them when it is legal to do so. Kapersky's guy recommended Apple donate the bounty to a charity.

load more comments