4 ms·

> Before I get to the details of the vulnerability, I would like to make it clear that I have not been paid a bounty by Ledger because their responsible disclos

> Before I get to the details of the vulnerability, I would like to make it clear that I have not been paid a bounty by Ledger because their responsible disclosure agreement would have prevented me from publishing this technical report. Ridiculous. Ledger, pay him the bounty that he quite clearly deserves.

jv22222 9y ago
On the ledger blog: https://www.ledger.fr/2018/03/20/firmware-1-4-deep-dive-security-fixes/ https://www.ledger.fr/2018/03/20/firmware-1-4-deep-dive-secu... > We would like to congratulate the three security researchers who found these bounties. > Saleem Rashid – MCU fooling > We fully appreciate their contribution, and they certainly deserve their rewards. > We have asked each security researcher to sign our Ledger Bounty Program Reward Agreement, that you can review as part of our transparency process > (this document doesn’t prevent the researcher to publish their own reports).
- EthanHeilman 9y ago
  The "Ledger Bounty Program Reward Agreement" appears to have a clause that may allow Ledger to prevent a researcher from publish their own report. >"You have complied and will continue to comply with the responsible disclosure process described in the Ledger Bounty Program which includes your agreement (a) not to disclose the security related bug to anyone without Ledger’s prior written consent," - [0] I'm not a lawyer so I could be reading this wrong or maybe they never intended to enforce that clause. [0]: Ledger Bounty Program Reward Agreement https://www.ledger.fr/wp-content/uploads/2018/03/Ledger-Bounty-Program-Reward-Agreement.pdf https://www.ledger.fr/wp-content/uploads/2018/03/Ledger-Boun...
invalidusernam3 9y ago
Agreed, but if it's one or the other I would rather have "Discovered vulnerability with Ledger crypto wallet when I was 15" on my CV than a couple thousand dollar bounty
slavik81 9y ago
I was curious whether there was any advantage to being a 15-year-old in this case, so I did a bit of research. As a minor in the UK, he's not capable of entering into a commercial contract, so he could void the contract at any point before the age of 18. Normally when a contract is voided, the parties are returned to their prior state. But, it seems that the doctrine of restitution makes an exception for people incapable of contracting. They are not required to return benefits received under the voided contract. I am not a lawyer, but I think he could have signed the contract, published his piece, and kept his money even if it was against the terms of the contract.
- patmcc 9y ago
  There's something quite funny about him being capable enough to discover a vulnerability like this but not being (legally speaking) capable enough to enter into a contract. :)
  - ghthor 9y ago
    It's a weakness in the wording, any sane judge would use there discretion to come to a verdict that favored reality versus the weakness of law to account for this young mans intelligence.

jv22222 9y ago

On the ledger blog: https://www.ledger.fr/2018/03/20/firmware-1-4-deep-dive-security-fixes/ https://www.ledger.fr/2018/03/20/firmware-1-4-deep-dive-secu... > We would like to congratulate the three security researchers who found these bounties. > Saleem Rashid – MCU fooling > We fully appreciate their contribution, and they certainly deserve their rewards. > We have asked each security researcher to sign our Ledger Bounty Program Reward Agreement, that you can review as part of our transparency process > (this document doesn’t prevent the researcher to publish their own reports).

EthanHeilman 9y ago
The "Ledger Bounty Program Reward Agreement" appears to have a clause that may allow Ledger to prevent a researcher from publish their own report. >"You have complied and will continue to comply with the responsible disclosure process described in the Ledger Bounty Program which includes your agreement (a) not to disclose the security related bug to anyone without Ledger’s prior written consent," - [0] I'm not a lawyer so I could be reading this wrong or maybe they never intended to enforce that clause. [0]: Ledger Bounty Program Reward Agreement https://www.ledger.fr/wp-content/uploads/2018/03/Ledger-Bounty-Program-Reward-Agreement.pdf https://www.ledger.fr/wp-content/uploads/2018/03/Ledger-Boun...

invalidusernam3 9y ago

Agreed, but if it's one or the other I would rather have "Discovered vulnerability with Ledger crypto wallet when I was 15" on my CV than a couple thousand dollar bounty

slavik81 9y ago

I was curious whether there was any advantage to being a 15-year-old in this case, so I did a bit of research. As a minor in the UK, he's not capable of entering into a commercial contract, so he could void the contract at any point before the age of 18. Normally when a contract is voided, the parties are returned to their prior state. But, it seems that the doctrine of restitution makes an exception for people incapable of contracting. They are not required to return benefits received under the voided contract. I am not a lawyer, but I think he could have signed the contract, published his piece, and kept his money even if it was against the terms of the contract.

patmcc 9y ago
There's something quite funny about him being capable enough to discover a vulnerability like this but not being (legally speaking) capable enough to enter into a contract. :)
- ghthor 9y ago
  It's a weakness in the wording, any sane judge would use there discretion to come to a verdict that favored reality versus the weakness of law to account for this young mans intelligence.