A student white hat hacker has been paid a record fee from the Apple bug bounty programme after uncovering a serious device exploit.

Cybersecurity student Ryan Pickren was awarded $100,500 by Apple after revealing a vulnerability that hackers could exploit to compromise devices and user web accounts.

In a blog post, Pickren revealed that the vulnerability would give hackers access to accounts used on a compromised device and allow access to filesystems by exploiting Safari webarchive logs.

Webarchive files are created by Safari as an alternative to HTML when a user saves a website locally, Pickren explained.

“A startling feature of these files is that they specify the web origin that the content should be rendered in,” he noted.

“This is an awesome trick to let Safari rebuild the context of the saved website, but as the Metasploit authors pointed out back in 2013, if an attacker can somehow modify this file, they could effectively achieve UXSS by-design.”

The vulnerability also gave hackers the ability to access device microphones, cameras and enable screen sharing, according to Pickren.

Recommended

• Opinion | Digital tech can help women deliver transformational change
• Converge’s biggest ever prize pot open to Scots uni entrepreneurs
• Broadband funding gives over 500k Scots full fibre access

“The bug gives the attacker full access to every website ever visited by the victim,” he said. “That means in addition to turning on your camera, my bug can also hack your iCloud, PayPal, Facebook, Gmail, etc. accounts too,” he added.

In Pickren’s account of the exploit, he notes that the bug requires a victim to “open a pop-up from a malicious website in order to compromise a device”.

As such, Pickren says Apple did not believe the supposed vulnerability to be a realistic threat to user safety.

“Apple did not view this attack scenario as very realistic because ‘the webarchives must be downloaded and manually opened by the client’.”

At present, the six figure pay-out represents the largest issued by the Apple bug bounty programme, which offers a maximum reward of up to $1 million.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

We will keep you up to date on the pivotal issues impacting the sector and let you know about key upcoming events to ensure that you don’t miss out on what’s going on across the Scottish tech community.

To subscribe, click here.