Apple hands security researchers a fused iPhone that runs any tool and even a custom kernel
Apple Security Research Device
Apple's Security Research Device Program loans approved researchers a specially fused iPhone for 12 months, renewable, that bypasses the need to break iOS security features. It offers shell access, custom entitlements, kernel customization, software previews, and a research community. All iOS and iPhone components are fair game except Apple Pay and third-party apps, and findings are automatically considered for Apple Security Bounty. Applications close October 30, 2026.
The SRD isn't meant for personal use or daily carry, and must remain on the premises of program participants at all times.
- alt227
If you sign up to this program and use one of their devices for 'research', then you are bound by contract to report any security bugs to them and only them (unless the bug is in a 3rd party app). I see this as a pretty sneaky way of avoiding your security vulnerabilities going public and all the bad media exposure that goes along with it.
It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
- ACCount39
Create a problem, and then heroically fight to make a solution.
This shouldn't exist in the first place. There would be no need for it if Apple didn't insist on "we own all the iPhones, our users just get to tap at them".
If you could just unlock the bootloader, re-enable SWD and do what you want with an iPhone that you actually own, there would be no need for this restrictive program at all.
- lrvick
Surely everyone sees this as an obvious trap to get researchers to sign NDAs for all research in advance, right?
Do not fall for it. Publish everything publicly after appropriate embargo periods.
- alt227
Dupe from 2020:
- potatoproduct
The title should be "Apple bribes security researchers with free devices"
- ta8903
Cool. Where can I buy one.
- sbseitz
Does this include... Israel being able to pwn any Apple device ?
- tamimio
Lol is this a joke? So you are leased a device to find vulnerabilities, that you can’t report anywhere but to apple? Mostly for free?! Why would anyone do that? If I found one sure i will give sometime to the vendor to patch it out of courtesy, then I will publish my own results, I own it, no one works for free, touch some grass, apple.