4 ms·
> this particular set of bug bounty rules is exclusive to vulnerabilities that surround speculative execution bugs I wonder what the rationale is for that narr
by the8472 9y ago
> this particular set of bug bounty rules is exclusive to vulnerabilities that surround speculative execution bugs
I wonder what the rationale is for that narrow scope. Is it just that there aren't that many potential sources of side-channels?
- austincheney 9y agoSo that they aren't paying out huge sums of money for trivial defects in fringe products. For example a userland defect in editing tools of Sharepoint is not going to be worthy of a $250,000 reward to MS.
- the8472 9y agoI mean why does it matter which CPU component is mis-designed if it is a side-channel that allows you to extract data from other security domains? If the last 10 years of VT-x implementations had a flaw that lets you extract data from other VMs that would be about as juicy as Meltdown.
- nickpsecurity 9y agoI agree. We're going to see more types of attacks especially given two papers are already showing researchers where to look: https://eprint.iacr.org/2016/479.pdf https://eprint.iacr.org/2016/479.pdf https://ts.data61.csiro.au/publications/csiro_full_text//Ge_YCH_toappear.pdf https://ts.data61.csiro.au/publications/csiro_full_text//Ge_... They should broaden it to confidentiality or integrity breaches on CPU components that affect Windows-based products. That will cover more ground. Availability is important, too, but the other two are a nice start that won't break the bank with crashes or stalls. They might still pay for them but with less money.