Google says Apple employee found a zero-day, but did not report it

Google fixed a zero-day in Chrome that was found by an Apple employee, according to comments in the official bug report. While the bug itself is not newsworthy, the circumstances of how this bug was found and reported to Google are, to say the least, peculiar.

According to a Google employee, the bug was originally found by an Apple employee who was participating in a Capture The Flag (CTF) hacking competition in March. But that Apple employee did not immediately report the bug, which at the time was a zero-day — meaning Google wasn’t aware of the bug and no patch had been issued yet. The bug was instead reported by someone else who also participated in the competition, didn’t actually find the bug themselves and wasn’t even on the team that found the bug.

“This issue was reported by sisu from CTF team HXP and discovered by a member of Apple Security Engineering and Architecture (SEAR) during HXP CTF 2022,” the Google employee wrote.

After this story first published, TechCrunch viewed a Discord channel where someone claiming to be the Apple employee who originally found the zero-day explained their side of the story, particularly the reason why they didn’t report the bug immediately, in response to Sisu, the person who reported the bug to Google.

“It took me 2 weeks working on it full time to root cause, write [the] exploit [Proof of Concept] and writeup the issue such that it can be fixed,” the person, who goes by Gallileo, wrote on July 6.

“It was reported on June 5th, through my company. Yes it was late, there are multiple reasons for that. I first had to find the person responsible, the report had to be signed off by people and then the person responsible was OOO. It’s commendable that chrome decided to fix it asap, but I think there wasn’t any real urgency. Only you and my team was aware of it and the issue is likely not that great in a real world scenario (doesn’t work on Android, pretty visible since it freezes the Chrome GUI for a few seconds),” Gallileo wrote.

Gallileo and Sisu did not respond to a request for comment.

Apple did not respond to a request for comment.

Google spokesperson Ed Fernandez told TechCrunch in an email that “our understanding is public in the bug.”

“We recommend reaching out to Apple for any further details,” Fernandez wrote.

It’s not uncommon for CTF teams and CTF players to find zero-days during competitions, especially in challenges of this type and competitions that are “high profile,” according to Filippo Cremonese, a researcher who participates in CTF competitions with the Italian team mhackeroni, which incidentally may be the best hacker team name ever.

What makes the story of this bug interesting is that it was apparently found by an Apple employee in a Google product, and — for some reason — that Apple employee decided not to report the bug at the time.

In the original report on March 26, the person who reported it said that the bug was found by someone on the team COPY during a CTF organized by the team HXP. The person, whose name is not disclosed in the report, said they decided to report it even if they didn’t find it themselves because they were “not 100% sure it was reported to the chromium team.”

“So I wanted to be safe,” the person wrote.

“Since you are the one disclosing this issue and there are no duplicates, it seems that the team that discovered this issue has chosen not to disclose it to us?” the Google employee wrote in another comment to the bug report.

The bug was fixed on March 29, according to the bug report. Google decided to award $10,000 as a bug bounty to the person who reported it, who, again, was not the one who found it.

UPDATE, July 20, 2:30 p.m. ET: This story was updated to include Discord messages posted by the person who claims to have found the bug originally.

UPDATE, July 24, 12:09 p.m. ET: Added clarification on twelfth paragraph.

UPDATE, July 24, 12:017 p.m. ET: On Friday, Sisu, who identified as Martin Radev, and is the person who first reported the bug to Google, published a timeline explaining his side of the story. Radev said that the Apple employee reported the bug in June. They also said they are in touch with the Apple employee to figure out what to do with the $10,000 bounty they received from Google. Radev wrote that “a donation is to be made.”

GOG Pulls Hitman – GOTY; Admits It Has DRM In Its Current Form

Late last month, GOG put up its version of Hitman – Game of the Year Edition. Being on GOG usually meant no DRM, but gamers soon found out that many of the game’s unlocks were tied to having an internet connection. After over two weeks, the CD Projekt storefront finally unreleased the game.

In a forum post, GOG community manager Gabriela Siemienkowicz, via the handle “chandra”, said that “we shouldn’t have released it in its current form, as you’ve pointed out”. The post also mentions talks with IO Interactive, the developers of Hitman – GOTY, presumably to properly work on a version of the game that didn’t need online connectivity to unlock new gear and starting locations.

To quickly recap, the Hitman reboot trilogy by IO Interactive required an internet connection to unlock new gear, costumes and starting equipment for every stage that you clear. This is the crux of the game’s massive replayability value. But all those unlocks, and by extension replay value, being tied to an internet connection is considered DRM, and it’s not difficult to see why.

The bit about dialogue with IO Interactive implies that GOG will one day rerelease a version of Hitman – GOTY that doesn’t need an internet connection for the unlocks. But it’s still up in the air as to when, or even if, that will happen.

Trump Calls Bitcoin A Scam, Claims It Competes With The US Dollar

Former US President Donald Trump has described bitcoin as a “scam” and claimed that the cryptocurrency competes with the US dollar. Unsurprisingly, he said he wanted the dollar to be “the currency of the world”.

“Bitcoin, it just seems like a scam,” Trump said on Fox Business, according to the BBC. “I don’t like it because it’s another currency competing against the dollar.”

This isn’t the first time that the controversial “America First” politician has spoken against cryptocurrency. In 2019, back when he was US president, he slammed cryptocurrencies, including Facebook’s proposed digital coin Libra.

According to Reuters, he wrote on Twitter, “I am not a fan of Bitcoin and other Cryptocurrencies, which are not money, and whose value is highly volatile and based on thin air.” Trump, of course, is now banned from the social media platform due to his public support for insurrectionists who attacked the US Capitol on 6 January.

While his claim that bitcoin competes with the US dollar will certainly be disputed by experts, he’s not alone in carrying a dim view of cryptocurrencies. Bank of England Governor Andrew Bailey said cryptocurrencies “have no intrinsic value” and pointedly told potential investors to “buy them only if you’re prepared to lose all your money.”

Ironically, Trump’s archnemesis, China, has embarked on a massive clampdown on cryptocurrency even though the country is a major global hub for bitcoin mining. Furthermore, crypto-enthusiast Elon Musk’s Tesla pulled an awkward 180 on its decision to accept bitcoin as payment for its cars.

iPad mini 6 Dummy Unit Shows That It Will Be Keeping Its Archaic Design

While rumours of the iPad mini 6 have been floating around, they’ve not been consistent about the tablet’s design. Some point to it having the same design it has always had, while others claim that it too will get the iPad Pro makeover. More evidence for the former have since appeared, in the form of dummy units.

Blogger and leaker Sonny Dickson shared on Twitter what looks to be dummy units of the upcoming iPad Pros and mini. And for better or worse, all three tablets look like there will be no change in their design. Not that bad a deal for the pricier tablets, but definitely a downer for the smaller sibling.

If the dummy units are representative of the actual products, then the iPad mini 6 sticks out like a sore thumb among other iPads. The vast majority of them have already adopted the design of the Pro, including the iPad Air 4. Only the base iPad and the mini are still stuck with the forehead and chin.

The dummies also casts more doubt on the possibility of the iPad mini 6 coming with two punch hole cutouts. The same applies for the possibility of a Pro model for the mini line.

Spotify Launches Website To Explain How It Pays Musicians

Under frequent criticism for exploiting artists, Spotify has launched a new website called Loud & Clear to better explain how it pays musicians – or in fact, how it doesn’t, not directly anyway.

Spotify founder and CEO Daniel Ek said the website is intended to “increase transparency and shed light on the complicated economics of music streaming.”

He claimed that, last year alone, Spotify paid over US$5 billion (~RM20.5 billion) in royalties and makes up about 20% of global recorded music industry revenue – more than any other streaming service.

Where does all that money go?

The website and nifty accompanying video makes it very clear that Spotify doesn’t hand money directly to artists, but rather to rights holders like record labels, distributors, aggregators, and collecting societies.

Spotify explained that it makes agreements with those right holders and pays them roughly two-thirds of the revenue it gets from subscriptions and advertising. Then the right holders will pay artists according to their contracts.

It sure looks like Spotify is saying, don’t blame us, go blame greedy record companies instead – an argument that has so far failed to convince many irate artists.

On Monday, artists and other music workers protested at Spotify offices around the world under a campaign organised by the Union of Musicians and Allied Workers (UMAW), Pitchfork reported.

Spotify was recently in the news due to a brief licensing breakdown with Korean music distributor Kakao, which caused K-pop songs to be temporarily yanked from the platform. Whether that confirms the case made by Spotify or its critics is hard to say.