Upset with Apple's handling of its Security Bounty program, a bug researcher has released proof-of-concept exploit code for three zero-day vulnerabilities in Apple's newly released iOS 15 mobile operating system.

The bug hunter, posting on Thursday to Russia-based IT blog Habr under the name "IllusionOfChaos" and to Twitter under the same moniker, expressed frustration with Apple's handling of vulnerability reports.

"I've reported four 0-day vulnerabilities this year between March 10 and May 4, as of now three of them are still present in the latest iOS version (15.0) and one was fixed in 14.7, but Apple decided to cover it up and not list it on the security content page," the researcher wrote.

The researcher added that the vulnerability dump conforms with responsible disclosure practices, noting that Apple was informed and has done nothing.

Kosta Eleftheriou, the developer behind the Apple Watch keyboard app FlickType (who earlier this year sued Apple for App Store market abuse), said via Twitter that he tested the Gamed 0-day on iOS 14.8 and iOS 15 and confirmed that it works as advertised.

"The bugs are neat, but unlikely to be widely exploited," security researcher Patrick Wardle, founder of free security project Objective See and director of research at security biz Synack, told The Register.

"Any app that attempted to (ab)use them would need to first be approved by Apple, via the iOS app Store.".

"And that security researchers are so frustrated by the Apple Bug Bounty program they are literally giving up on it, turning down (potential) money, to post free bugs online.".

Wardle said he considered the researcher's critique of Apple's Security Bounty program to be fair.

While some developers have found Apple's Security Bounty program rewarding, others share the frustration expressed by "IllusionOfChaos." In July, 2020, Jeff Johnson, who runs app biz Lapcat Software, went public with a privacy bypass vulnerability because Apple failed to fix the bug he had reported.

At the time, he told The Register, "Talking to Apple Product Security is like talking to a brick wall.".

The Register asked Apple to comment, but the brick wall did not respond.

This is a very different distribution model than the one Apple or Microsoft uses, and it confuses newcomers

The Register - Independent news and views for the tech community