6 ms·

The offer is limit to bugs that are not already known to Microsoft or their partners, and they are not disclosing what these bugs are, and they are making no cl

by WebLLL 9y ago

The offer is limit to bugs that are not already known to Microsoft or their partners, and they are not disclosing what these bugs are, and they are making no claim to have fixed them. I made a submission to Intel and others weeks after some were claiming to have mitigated this with small reductions in timer resolution, showing that the timer mitigation would not stop these vulnerabilities, no one would pay out, said they were already aware of it, have they informed the public, have they withdrawn their product, have their transitioned their user base to safer products??? No one is going to hand over their well documented exploits under such terms. Let them offer twice the reward for public disclosures of issues that they already know and have not fixed or not warned the public about, and then we might take their offer seriously.

tptacek 9y ago
I don't understand the disincentive you're describing. Unless you believe that Intel or Microsoft would lie about already knowing about a vulnerability --- which is extremely dumb, given how minimal the expense is, and how much publicity you'd immediately generate by going public --- then what's the risk?
- WebLLL 9y ago
  Fact is they are still patching away! And yes I have seen no public disclosure on many of the problems. Try asking Intel for help, it is a brick wall. My guess is that they made a huge mistake, that they thought that high precision timers were needed, and they did not put the effort into otherwise fixing the problems. Lack of sharing probably made it much worse. They had still not addressed these at the public disclosure date. They either realized the mistake themselves or various people told them of their mistakes, and they were left with known vulnerable products on the market that they had no hope of fixing in a timely manner. At that point they could have advised their users to move to alternative products, e.g. Google had a head start, but that would likely have ended them, most people would not come back many months later when they claim to have fixed the problems, and that is a big expense for them! Another alternative was to take drastic coding measures, lfence branch paths, but at a high performance loss, they did not do that either, again who wants a slow product if the competition has not also taken the same action. The really kicker is people had been trying to get them to move on this for years and they had been resisting it strongly.
- shawnz 9y ago
  > Unless you believe that Intel or Microsoft would lie about already knowing about a vulnerability Imagine they know of a vulnerability but believe that it's not practical to exploit, or something. Then someone comes along and demonstrates that it actually is practical to exploit. They could say, well, we knew about this already and didn't believe it's practical, so we're not paying you for it. It can sometimes be hard to convince a vendor that a vulnerability is "their fault" and this policy only increases the difficulty.
  - baddox 9y ago
    If it’s not practical to exploit, why wouldn’t Microsoft disclose it publicly? I thought that the “best ethical practice” for vulnerability disclosure is to notify the vendor privately, then disclose publicly after some period of time if the vendor is uninterested or unresponsive, with the idea being that it’s safer in the long run for vulnerabilities to be publicly known than only known to a small number of parties (since some of those parties may be trying to exploit the vulnerability).
    - dspillett 9y ago
      > If it’s not practical to exploit, why wouldn’t Microsoft disclose it publicly? Because of the public? If someone decides to try make a name for themselves by taking a shot at embarrassing MS/Intel/Linux/AMD/other which do you think will have more affect on public perception: intelligent, detailed discussion about practicalities and real world attack/defense profiles, or loud shouty "but what if" reporting carefully word to be as scary as possible?
      - baddox 9y ago
        But this is the entire point of bug bounties, right? Companies literally pay people to find vulnerabilities in their software.
  - tptacek 9y ago
    I don't follow. You're describing a circumstance in which you report a vulnerability the vendor already knows about. What did you expect?
- ubernostrum 9y ago
  My experience from being involved in a couple of them (though obviously not quite on the scale of Microsoft) is that people underestimate both the difficulty of running bug bounties and the average quality of submissions to them. When I worked at Mozilla on the MDN team, for example, there was a lot of inevitable spamming of "security" bugs which basically boiled down to "MDN is a publicly-editable wiki and hosts code samples" (MDN also goes to some trouble to do that safely). The current bug bounty exclusions are still pretty broad as far as I can tell, and thankfully will automatically throw out a bunch of the worst of the spam. Same thing happens still with Django. I've considered writing up something with similar exclusions to Mozilla's policy just because it would save time dealing with meaningless reports (though Django would get a few categories the Mozilla policy doesn't, like "it's not a vulnerability if the only person you can CSRF is yourself").
c3534l 9y ago
I've heard similar frustrations from bug-hunters before. I don't know enough to side with anyone, but it would be nice if there were some kind of oversight body for this sort of thing, an independent third party that offered some consistency in the experience.
- duncanawoods 9y ago
  We can use cryptography instead of 3rd parties to solve most of the trust problem. The companies publish encrypted documentation of a vulnerability so that when they claim a researcher has found something already known, they share the key to prove they already know it. A 3rd party might be useful in a complaint process where the researcher claims the two vulnerabilities are not the same. Given that is hopefully now a minority case, the researcher can resort to the court of public opinion. It doesn't need to be a block-chain but I guess it would help create a tamper proof time ordered record.
JoachimSchipper 9y ago
> I [showed] that the timer mitigation would not stop these vulnerabilities Yes, that was obvious to people with some background in this class of attacks. Good on you for figuring that out independently (seriously!), but you're not going to get a bounty for something widely known.
- WebLLL 9y ago
  Ok, but if a working web browser POC is not worthy of a bug bounty reward, because they claim to already know, then what is the point of the bug bounty? Why are they not just paying for specialists to advise them on how to fix this if they have no plan. They don't even listen when you try and try and try to explained what needs to be done. How can a bug bounty fix this?
- tgb 9y ago
  The point is that the vendor was claiming they had patched the flaw. They can't simultaneously claim to have a patch and that they know the patch doesn't fix it.
deleted 9y ago
[deleted]

by WebLLL 9y ago

tptacek 9y ago

I don't understand the disincentive you're describing. Unless you believe that Intel or Microsoft would lie about already knowing about a vulnerability --- which is extremely dumb, given how minimal the expense is, and how much publicity you'd immediately generate by going public --- then what's the risk?

WebLLL 9y ago
Fact is they are still patching away! And yes I have seen no public disclosure on many of the problems. Try asking Intel for help, it is a brick wall. My guess is that they made a huge mistake, that they thought that high precision timers were needed, and they did not put the effort into otherwise fixing the problems. Lack of sharing probably made it much worse. They had still not addressed these at the public disclosure date. They either realized the mistake themselves or various people told them of their mistakes, and they were left with known vulnerable products on the market that they had no hope of fixing in a timely manner. At that point they could have advised their users to move to alternative products, e.g. Google had a head start, but that would likely have ended them, most people would not come back many months later when they claim to have fixed the problems, and that is a big expense for them! Another alternative was to take drastic coding measures, lfence branch paths, but at a high performance loss, they did not do that either, again who wants a slow product if the competition has not also taken the same action. The really kicker is people had been trying to get them to move on this for years and they had been resisting it strongly.
shawnz 9y ago
> Unless you believe that Intel or Microsoft would lie about already knowing about a vulnerability Imagine they know of a vulnerability but believe that it's not practical to exploit, or something. Then someone comes along and demonstrates that it actually is practical to exploit. They could say, well, we knew about this already and didn't believe it's practical, so we're not paying you for it. It can sometimes be hard to convince a vendor that a vulnerability is "their fault" and this policy only increases the difficulty.
- baddox 9y ago
  If it’s not practical to exploit, why wouldn’t Microsoft disclose it publicly? I thought that the “best ethical practice” for vulnerability disclosure is to notify the vendor privately, then disclose publicly after some period of time if the vendor is uninterested or unresponsive, with the idea being that it’s safer in the long run for vulnerabilities to be publicly known than only known to a small number of parties (since some of those parties may be trying to exploit the vulnerability).
  - dspillett 9y ago
    > If it’s not practical to exploit, why wouldn’t Microsoft disclose it publicly? Because of the public? If someone decides to try make a name for themselves by taking a shot at embarrassing MS/Intel/Linux/AMD/other which do you think will have more affect on public perception: intelligent, detailed discussion about practicalities and real world attack/defense profiles, or loud shouty "but what if" reporting carefully word to be as scary as possible?
    - baddox 9y ago
      But this is the entire point of bug bounties, right? Companies literally pay people to find vulnerabilities in their software.
- tptacek 9y ago
  I don't follow. You're describing a circumstance in which you report a vulnerability the vendor already knows about. What did you expect?
ubernostrum 9y ago
My experience from being involved in a couple of them (though obviously not quite on the scale of Microsoft) is that people underestimate both the difficulty of running bug bounties and the average quality of submissions to them. When I worked at Mozilla on the MDN team, for example, there was a lot of inevitable spamming of "security" bugs which basically boiled down to "MDN is a publicly-editable wiki and hosts code samples" (MDN also goes to some trouble to do that safely). The current bug bounty exclusions are still pretty broad as far as I can tell, and thankfully will automatically throw out a bunch of the worst of the spam. Same thing happens still with Django. I've considered writing up something with similar exclusions to Mozilla's policy just because it would save time dealing with meaningless reports (though Django would get a few categories the Mozilla policy doesn't, like "it's not a vulnerability if the only person you can CSRF is yourself").

c3534l 9y ago

I've heard similar frustrations from bug-hunters before. I don't know enough to side with anyone, but it would be nice if there were some kind of oversight body for this sort of thing, an independent third party that offered some consistency in the experience.

duncanawoods 9y ago
We can use cryptography instead of 3rd parties to solve most of the trust problem. The companies publish encrypted documentation of a vulnerability so that when they claim a researcher has found something already known, they share the key to prove they already know it. A 3rd party might be useful in a complaint process where the researcher claims the two vulnerabilities are not the same. Given that is hopefully now a minority case, the researcher can resort to the court of public opinion. It doesn't need to be a block-chain but I guess it would help create a tamper proof time ordered record.

JoachimSchipper 9y ago

> I [showed] that the timer mitigation would not stop these vulnerabilities Yes, that was obvious to people with some background in this class of attacks. Good on you for figuring that out independently (seriously!), but you're not going to get a bounty for something widely known.

WebLLL 9y ago
Ok, but if a working web browser POC is not worthy of a bug bounty reward, because they claim to already know, then what is the point of the bug bounty? Why are they not just paying for specialists to advise them on how to fix this if they have no plan. They don't even listen when you try and try and try to explained what needs to be done. How can a bug bounty fix this?
tgb 9y ago
The point is that the vendor was claiming they had patched the flaw. They can't simultaneously claim to have a patch and that they know the patch doesn't fix it.

deleted 9y ago

[deleted]