3 ms·

> Nordic Semiconductor and LimitedResults did not agree on a responsible disclosure. That’s life. Short and sweet, kind of.

pantalaimon 6y ago
I mean it’s not like they could patch it anyway
- reitanqild 6y ago
  No but Nordic could have gotten some time to warn their customers allowing their customers to create emergency plans.
  - bsder 6y ago
    What emergency plan? This is a device in the hands of a hostile adversary. You pretty much have to assume that given enough determination an adversary WILL crack the device and read your code. All you can really do is make sure anything based around security is one to one and that the attack doesn't scale. You can break you own device, but all that gets you is access to your own device and data. What you don't want is for data to come off the chip that allows somebody to break other copies of your firmware. That would be BAD(tm). However, that's a failure to consider threat model rather than a firmware fault by Nordic.
    - deleted 6y ago
      [deleted]
    - reitanqild 6y ago
      > What emergency plan? Any. Depending on what the stakes are, some examples: - apologize - refund - contact the appropriate secret service and ask them to exfiltrate devices etc etc > This is a device in the hands of a hostile adversary. You pretty much have to assume that given enough determination an adversary WILL crack the device and read your code You and I know this. I feel lucky to have had bosses that have a good idea about this, not everyone seems to be so lucky.
bsder 6y ago
What's Nordic going to even agree to? This is a firmware power glitch exploit. It's not like they can patch it in the field. If all they said was: "Nordic Semiconductor and LimitedResults did not agree on a responsible disclosure." That's fine. So be it. However, when I see: "Nordic PSIRT proposes to purchase the full report for a rock-bottom price." They lost my sympathy right there. I have no idea what they told Nordic, and Nordic really doesn't have a good way to defend against that accusation without exposing emails that they likely sent back and forth with confidentiality in place. That kind of commentary is bad faith even if Nordic may also be acting in bad faith (and I have no real way to verify that).
- monocasa 6y ago
  What's bad faith about noting that Nordic's response to responsible disclosure was trying to get money out of the researcher?
  - bsder 6y ago
    Did I miss something: "Nordic PSIRT proposes to purchase the full report for a rock-bottom price." I read that as the researcher trying to get money out of Nordic--especially with a comment like "rock-bottom price". Did I get that wrong? That "rock-bottom price" is an unprofessional sideswipe that Nordic probably can't counter without breaking confidentiality agreements. And, what's a "rock-bottom" price? A hundred dollars? A thousand dollars? Ten thousand dollars? What price should Nordic pay for a report on a power glitch exploit--something that pretty much affects every microcontroller on the planet? And what did the researchers disclose to Nordic in order to agree on a price? Nordic certainly isn't going to pay much if you just say "I found an exploit" and don't tell them much else. That "rock-bottom price" comment adds a whole bunch of character questions to my assessment of the author as "security researcher" that simply wouldn't be in scope if they had left it at "Nordic Semiconductor and LimitedResults did not agree on a responsible disclosure. That’s life."
    - monocasa 6y ago
      I guess I read that as "Nordic PSIRT [proposes for the researcher] to purchase the full report for a rock-bottom price." Given what I've seen with chip companies that aren't used to dealing with third party security researchers, that seems pretty on point. Trying to sell a support contract to someone reporting a security vulnerability.

pantalaimon 6y ago

I mean it’s not like they could patch it anyway

reitanqild 6y ago
No but Nordic could have gotten some time to warn their customers allowing their customers to create emergency plans.
- bsder 6y ago
  What emergency plan? This is a device in the hands of a hostile adversary. You pretty much have to assume that given enough determination an adversary WILL crack the device and read your code. All you can really do is make sure anything based around security is one to one and that the attack doesn't scale. You can break you own device, but all that gets you is access to your own device and data. What you don't want is for data to come off the chip that allows somebody to break other copies of your firmware. That would be BAD(tm). However, that's a failure to consider threat model rather than a firmware fault by Nordic.
  - deleted 6y ago
    [deleted]
  - reitanqild 6y ago
    > What emergency plan? Any. Depending on what the stakes are, some examples: - apologize - refund - contact the appropriate secret service and ask them to exfiltrate devices etc etc > This is a device in the hands of a hostile adversary. You pretty much have to assume that given enough determination an adversary WILL crack the device and read your code You and I know this. I feel lucky to have had bosses that have a good idea about this, not everyone seems to be so lucky.

bsder 6y ago

What's Nordic going to even agree to? This is a firmware power glitch exploit. It's not like they can patch it in the field. If all they said was: "Nordic Semiconductor and LimitedResults did not agree on a responsible disclosure." That's fine. So be it. However, when I see: "Nordic PSIRT proposes to purchase the full report for a rock-bottom price." They lost my sympathy right there. I have no idea what they told Nordic, and Nordic really doesn't have a good way to defend against that accusation without exposing emails that they likely sent back and forth with confidentiality in place. That kind of commentary is bad faith even if Nordic may also be acting in bad faith (and I have no real way to verify that).

monocasa 6y ago
What's bad faith about noting that Nordic's response to responsible disclosure was trying to get money out of the researcher?
- bsder 6y ago
  Did I miss something: "Nordic PSIRT proposes to purchase the full report for a rock-bottom price." I read that as the researcher trying to get money out of Nordic--especially with a comment like "rock-bottom price". Did I get that wrong? That "rock-bottom price" is an unprofessional sideswipe that Nordic probably can't counter without breaking confidentiality agreements. And, what's a "rock-bottom" price? A hundred dollars? A thousand dollars? Ten thousand dollars? What price should Nordic pay for a report on a power glitch exploit--something that pretty much affects every microcontroller on the planet? And what did the researchers disclose to Nordic in order to agree on a price? Nordic certainly isn't going to pay much if you just say "I found an exploit" and don't tell them much else. That "rock-bottom price" comment adds a whole bunch of character questions to my assessment of the author as "security researcher" that simply wouldn't be in scope if they had left it at "Nordic Semiconductor and LimitedResults did not agree on a responsible disclosure. That’s life."
  - monocasa 6y ago
    I guess I read that as "Nordic PSIRT [proposes for the researcher] to purchase the full report for a rock-bottom price." Given what I've seen with chip companies that aren't used to dealing with third party security researchers, that seems pretty on point. Trying to sell a support contract to someone reporting a security vulnerability.