Apple Refused to Pay Kaspersky for Four iPhone Zero-Days: What Actually Happened

On 5 June 2024, The Record reported that Kaspersky said Apple had declined to pay a bug bounty for four iPhone zero-day vulnerabilities its researchers disclosed. The story spread fast, and some headlines got ahead of the facts. Here is what is actually established.

The discovery came from a real attack

In 2023, Kaspersky researchers investigated compromised iPhones belonging to their own staff. That investigation uncovered Operation Triangulation.

The attack was a zero-click chain. An attacker could send a malicious iMessage attachment and compromise the phone without the owner opening it or clicking a link. The investigation turned up four previously unknown vulnerabilities, and Apple patched them.

The attackers got past hardware protections

The most striking flaw was CVE-2023-38606. It involved an undocumented hardware feature that let attackers manipulate protected memory.

Kaspersky could not establish how the attackers learned about that feature or what it was originally for. That open question is a big reason the discovery drew so much attention.

The "$1 million" figure needs context

Reports said the discovery could potentially qualify for roughly US$1 million under Apple's bounty programme at the time.

That was a potential reward, not a confirmed payment Apple had promised. Kaspersky said Apple declined its request, citing policy. The public reporting does not show that Apple approved an award and then withheld it.

The charity detail is murky

Some reports said Kaspersky proposed donating the reward to charity and Apple still declined. However, The Record could not confirm that Kaspersky had actually nominated a charity when it first contacted Apple. Accounts differ on how firmly this detail is established.

The geopolitics

Russia's FSB accused Apple of helping US intelligence. Apple denied the allegation. Kaspersky itself said it lacked the technical evidence needed to identify which country was behind the attack.

The vulnerabilities and the bounty refusal do not show that Apple deliberately enabled any spying.

The bottom line

Apple declined to pay a bug bounty for the iPhone vulnerabilities Kaspersky's researchers reported. It cited its bounty policy but did not publicly explain the specific reason.

Everything beyond that, including the charity offer and the political claims, is either disputed or unproven.

text