Apple Details SPTM and MIE Security Advances, Raises Bug Bounty Awards

Dec 18, 2025 · 36:40 · Watch on YouTube ↗

Summary

Apple security engineering chief Ivan Krstić outlined formal verification for cryptography, the SPTM replacement for PPL, and MIE memory protections. He also announced higher Apple Security Bounty awards, including up to $2 million for zero-click exploit chains.

Key points

Krstić argued that security progress depends on both engineering secure systems and scientific methods for defining and verifying defenses, with offensive research integrated into defense development.
Apple used formal verification to check Core Crypto implementations from mathematical specifications through C code to optimized assembly, including memory-safety and undefined-behavior properties.
Apple designed SPTM to replace PPL; Krstić said it architecturally prevents 95% of the reviewed PPL issues, leaving a small set of rare logic bugs.
Krstić said Apple had not seen SPTM successfully exploited in the wild or through its bounty program. A six-month independent audit found one exploitable issue, which Apple had already found and fixed internally.
Apple's MIE protections constrain memory-corruption exploitation. Krstić said reviewed exploit chains could not be rebuilt and that generic, reusable memory-corruption techniques are now almost impossible, while acknowledging that some attack chains can still work.
Apple said MIE shipped in iOS 26 across about 150 processes and the kernel; 70 processes were in hard-enforcement mode, with the rest in telemetry-only mode.
Apple announced a $2 million top award for zero-click exploit chains and a target-flag system to verify some bounty submissions. It also announced plans to provide 1,000 iPhone 17 devices with MIE to civil society organizations serving at-risk users.

Article Details

Topics: [00:42] Security science, engineering, and offensive research integration
[01:53] Core Crypto and formal verification
[06:25] Replacing PPL with SPTM
[13:37] MIE memory-corruption protections
[22:36] MIE engineering and deployment
[27:43] Apple Security Bounty changes
[31:57] iPhone devices for civil society organizations
[33:02] Ethical responsibilities of offensive security research