Apple lowers Mac security bounty rewards in seeming shift to iPhone attacks

Macworld

There’s been a long-held belief that Macs are more secure than Windows PCs. Whether that’s true or not is up for debate, but it is a key marketing point used by Apple. But Apple’s latest move with macOS security is a bit of a concern.

According to Csaba Fitzl, a macOS security researcher at Iru (spotted by 9to5Mac), Apple has reduced the security bounties it offers for macOS. In a LinkedIn post (membership required), Fitzl states that, “Full TCC (privacy) bypasses are down from 30,5k to 5k…Individual TCC categories are also down from 5-10k to 1k,” and that “macOS sandbox escapes are also down to 5k from 10k.”

The reductions send the wrong message to security researchers, according to Fitzl. “There aren’t many people looking for vulnerabilities on the macOS platform anyway, and this move might reduce this even further.” In the meantime, as security researcher Andrew Poole points out in a response to Fitzl’s post, Apple raised the bounties for iOS.

It’s unclear why Apple would make these cuts (Macworld reached out to Apple for comment). Several recent reports have stated that macOS malware is on the rise, and other reports show that the Mac market share has increased. It seems more vital than ever to maintain macOS’s security. If anything, Apple’s security notes for macOS updates seem to get longer each time.

Apple continues to be a very successful company financially–the company posted record revenue in its most recent financial quarter, not to mention a double-digit increase in Mac sales. Money and Mac demand aren’t the issue, so the reasons seem to indicate a shift towards macOS development. Whatever the reason, security researchers now have less incentive to work on the Mac, and that could be costly for Apple in the long run.