Two Turkish Software Developers Found Two Vulnerabilities in Apple

Tech companies are winning awards for quickly fixing vulnerabilities in their services, which consist of millions of lines of code. “bug bounty” or in Turkish, "bug hunting" programs are organized. Software developers who are interested in cyber security or system vulnerabilities report the vulnerabilities they find to giant companies. Recently, software developers in Turkey have also achieved important work regarding bug bounties. 

Rıza Sabuncu, who found a vulnerability in Apple last May and rewarded it with $7,500 at the end of the process, found another vulnerability in Apple about a month ago. When we reached him, he was aware of the gap in question. “On a cloud service where Apple's address formatting configs (setting files), usernames and passwords necessary for development are stored.” He stated that it was.

Then, a total of thousands of Apple subdomain addresses were sent to Apple for 15 days. Sending billions of HTTP requests did the test. Rıza reported the situation to Apple in detail and stated that the vulnerability was resolved in approximately 3 hours. Under normal circumstances, it takes months for Apple to review a report, reach out to the discoverer, work together if necessary, and announce the reward, but in this vulnerability discovered by Rıza, the entire process took 1 month. This actually shows how critical the vulnerability it found is for Apple. 

Another bounty hunter friend of Rıza, 18-year-old Ertuğrul, found a vulnerability in a domain name of Apple's iTunes service. Stating that he discovered the vulnerability in approximately 1 hour on June 3 and that even Apple IDs could be affected as a result, Ertuğrul reported the details to Apple with video evidence within 1.5 hours. Apple partially fixed the vulnerability within the first 24 hours to prevent users from being affected, and then the problem was completely eliminated on August 13 with regular updates.

Both software developers accepted the awards:

Rıza Sabuncu, who won a $7,500 reward from Apple after a 3-month period in May, thanks to the latest vulnerability he discovered. $2,500 was awarded with. Ertuğrul is $5,000 was rewarded with. Both software developers accepted the award.

Congratulatory messages poured in from social media to Rıza, who had been extorting Apple throughout 2020, and to Ertuğrul, who reached the result in one of his first tests on the first day he decided to look for Apple's vulnerability. Apple's bug bounty program is a subject that attracts the attention of software developers in many parts of the world. If you are a software developer and interested in this subject, you can access the details of the program on Apple's official page. In addition, you can check out the video below for more detailed information about Rıza's previous vulnerability.