3 ms·
I can't tell whether they attempted to disclose it to Toyota through normal vulnerability disclosure channels, though. The article implies to me that they didn'
by cjbprime 4y ago
I can't tell whether they attempted to disclose it to Toyota through normal vulnerability disclosure channels, though. The article implies to me that they didn't.
- mynameisvlad 4y ago> Ian has tried to get in touch with Toyota to discuss the CAN Injection attack, and to offer help, but hasn’t had much success. That certainly sounds like a yes.
- cjbprime 4y agoI read that as more "we cold emailed people looking for a potential contact" than "we submitted this vulnerability to their PSIRT". The fact that they say this is not a vulnerability disclosure situation suggests that they did not use the vulnerability disclosure communication methods.
- mynameisvlad 4y agoI read it as "we tried contacting them through their standard processes, and were told it didn't fit in" but I can see your reading now that I've gone back and reread that specific section again. It's indeed quite vague as if they were the ones that made the decision or Toyota.