3 ms·
"Another $500,000 will be given to those who can find a "network attack requiring no user interaction."" The implication of this conditional reward is that int
by 3xblah 7y ago
"Another $500,000 will be given to those who can find a "network attack requiring no user interaction.""
The implication of this conditional reward is that interactive use presents more/easier attack opportunities than non-interactive use. To clarify terminology, it is arguable that "non-interactive" can be a synonym for "automated" in this context.
Further, we might argue that canonical examples of "interactive" use are clicks, drags, taps or swipes. In other words, the prevailing "UI" for many users and the one promoted by many developers.
Now, if you agree these are fair statements then it is also arguable that from the user's persepctive it could be useful to engage in non-interactive/automated use not only for reasons of efficiency or convenience but also for reasons of "security".
Finally, given these propositions, the question I ask is why website and app users are continually faced with "terms and conditions" that seek to prohibit non-interactive use. Interactive use benefits those running a website or app server in at least one obvious and significant way: more interaction means more data to collect. But if we accept the implication of this bug bounty it also means greater risk to the user.
Regulators need to protect the user's right to use her computer, including a "smartphone", in a non-interactive manner. This right is constantly under attack (no pun intended) by those who are in the business of collecting user data. Interactive use can result in less data privacy and more/easier attack opportunities.
- saagarjha 7y ago> The implication of this conditional reward is that non-interactive use presents more/easier attack opportunities than interactive use. Doesn't this mean the opposite?
- azernik 7y agoIt means that, once you've found the vulnerability, it's more valuable because it's easier to use. Not that they're easier to find.
- deleted 7y ago[deleted]
- cortesoft 7y agoThis seems backwards.... they are offering more money for attacks that don't require user interaction because they are HARDER, not easier, to accomplish.
- nemosaltat 7y agoExactly. I seem to remember an app a while back that was billed as a heartbeat reader and it would have you repeatedly press and release the fingerprint sensor. After a delay it would flash some sort of in-app purchase authorization. Pwnage that relies on some sort of user interaction is worth 50% less, and rightly so.
- 3xblah 7y agoOops. I apologise. Indeed I framed that statement backwards. If non-interactive use makes attacks "harder" then terms and conditions should not seek to prohibit non-interactive use. That is the argument in one sentence. Another phrasing is that if interactive use makes attacks easier then users should not be discouraged or prohibited from engaging in non-interactive use.