4 ms·

They're not considering it not to be a vulnerability. They're simply saying it's outside the scope of their bug bounty program.

by tptacek 9mo ago

Retr0id 9mo ago
Looks like there's a serious security bug in their scope document.
- tptacek 9mo ago
  How's that? What do you think the purpose of a bug bounty is? If you think it's "to eradicate all bugs", no, very no.
  - JJJollyjim 9mo ago
    This is the place they direct researchers to report bugs. If they don’t want to pay out for MITM, that’s fine, but they should still be taking out-of-scope reports seriously
    - bravetraveler 9mo ago
      +1 Bounty aside, this deserves attention. I wouldn't want to award bounties for MitM either if I made it so easy. They closed the issue as 'out of scope'... with no mention of follow-up (or even the bounty we don't care about). I'm skeptical to say the least. Industry standard has been to ignore MitM or certificates/signatures, not everything.
  - Retr0id 9mo ago
    I don't expect an unbounded scope but I do expect it to cover the big scary headline items like RCE. Additionally, this can be exploited without MitM if you combine with e.g. a DNS cache poisoning attack. And they can still fix it even if they're not willing to pay a bounty.
    - tptacek 9mo ago
      DNS poisoning is a MITM vector; in fact, it's the most popular MITM vector.
      - webstrand 9mo ago
        Really? I thought MitM was always intercepting/manipulating traffic from or to the victim.
        vishnugupta 9mo ago
        What you wrote is the definition of MITM. Op and others are saying DNS poisoning is a popular way of achieving that goal.
        webstrand 9mo ago
        Oh you mean that it's a popular way of initiating the interception part of MitM, got it.
  - LoganDark 9mo ago
    A bug bounty should motivate exploitable bugs to be reported so that they can be fixed. IMO, if it refuses to accept certain kinds of bugs that can still be exploited, it's not working properly.
    - tptacek 9mo ago
      A bug bounty directs internal engineering efforts. It can't eradicate bugs; that's not how bugs work.
      - LoganDark 9mo ago
        I wasn't agreeing with your example.
- atq2119 9mo ago
  If you read it carefully, you'll notice that the blog post misrepresents the AMD response. The blog post title is "AMD won't fix", but the actual response that is quoted in the post doesn't actually say that! It doesn't say anything about will or won't fix, it just says "out of scope", and it's pretty reasonable to interpret this as "out of scope for receiving a bug bounty". It's pretty careless wording on the part of whoever wrote the response and just invites this kind of PR disaster, but on the substance of the vulnerability it doesn't suggest a problem.
deleted 9mo ago
[deleted]
Hizonner 9mo ago
Apparently it's also outside the scope of their bug fixing program, despite being trivially remotely exploitable to get privileged code execution. Man in the middle attacks may be "out of scope" for AMD, but they're still "in scope" for actual attackers. Ignoring them is indefensibly incompetent. A policy of ignoring them is a policy of being indefensibly incompetent.
- tptacek 9mo ago
  The only thing cited here is a response from their bug bounty program. Excluding MITM from a bug bounty is perfectly legitimate. Actually, excluding anything from a bounty program is.
  - gusgus01 9mo ago
    The response from the screenshot appears to be a "out of scope" response, but the blog poster used some editorial leeway and called it "wont fix/out of scope". Going forward, we can keep de-compiling and seeing if this vulnerability is still there and whether "wont fix" was a valid editorialization. Though, by publishing this blog and getting on the HN front page, it really skews this datapoint, so we can never know if it's a valid editorialization. Edit: Ah, someone else in this thread called out the "wont fix" vs "out of scope" after I clicked on reply: https://news.ycombinator.com/item?id=46910233 https://news.ycombinator.com/item?id=46910233. Sorry.
  - tgsovlerkhgsel 9mo ago
    Excluding severe vulnerabilities like ones that completely pwn your machine just by connecting it to an untrusted network is not legitimate for any reasonable bug bounty program. Of course, a company can do it (they just did!), but it shows that they don't care about security at all. Especially if the answer is "sorry this is out of scope" rather than "while this is out of scope for our bug bounty so we can't pay you, this looks serious and we'll make sure to get a patch out ASAP".
    - Stefan-H 9mo ago
      Ethical disclosure existed before bug bounties. Someone who wants to ensure the remediation of the bug might recognize that the staff member responding to bug bounty reports is limited in their purview and might be badly trained. Upon learning that it is out of scope for the bug bounty program did the author try their security@ or another a referenced security contact? Your characterization of this bug as one "that completely pwn your machine just by connecting it to an untrusted network" is also hyperbolic to the extreme.

They're not considering it not to be a vulnerability. They're simply saying it's outside the scope of their bug bounty program.

by tptacek 9mo ago

They're not considering it not to be a vulnerability. They're simply saying it's outside the scope of their bug bounty program.

Retr0id 9mo ago

Looks like there's a serious security bug in their scope document.

tptacek 9mo ago
How's that? What do you think the purpose of a bug bounty is? If you think it's "to eradicate all bugs", no, very no.
- JJJollyjim 9mo ago
  This is the place they direct researchers to report bugs. If they don’t want to pay out for MITM, that’s fine, but they should still be taking out-of-scope reports seriously
  - bravetraveler 9mo ago
    +1 Bounty aside, this deserves attention. I wouldn't want to award bounties for MitM either if I made it so easy. They closed the issue as 'out of scope'... with no mention of follow-up (or even the bounty we don't care about). I'm skeptical to say the least. Industry standard has been to ignore MitM or certificates/signatures, not everything.
- Retr0id 9mo ago
  I don't expect an unbounded scope but I do expect it to cover the big scary headline items like RCE. Additionally, this can be exploited without MitM if you combine with e.g. a DNS cache poisoning attack. And they can still fix it even if they're not willing to pay a bounty.
  - tptacek 9mo ago
    DNS poisoning is a MITM vector; in fact, it's the most popular MITM vector.
    - webstrand 9mo ago
      Really? I thought MitM was always intercepting/manipulating traffic from or to the victim.
      - vishnugupta 9mo ago
        What you wrote is the definition of MITM. Op and others are saying DNS poisoning is a popular way of achieving that goal.
        webstrand 9mo ago
        Oh you mean that it's a popular way of initiating the interception part of MitM, got it.
- LoganDark 9mo ago
  A bug bounty should motivate exploitable bugs to be reported so that they can be fixed. IMO, if it refuses to accept certain kinds of bugs that can still be exploited, it's not working properly.
  - tptacek 9mo ago
    A bug bounty directs internal engineering efforts. It can't eradicate bugs; that's not how bugs work.
    - LoganDark 9mo ago
      I wasn't agreeing with your example.
atq2119 9mo ago
If you read it carefully, you'll notice that the blog post misrepresents the AMD response. The blog post title is "AMD won't fix", but the actual response that is quoted in the post doesn't actually say that! It doesn't say anything about will or won't fix, it just says "out of scope", and it's pretty reasonable to interpret this as "out of scope for receiving a bug bounty". It's pretty careless wording on the part of whoever wrote the response and just invites this kind of PR disaster, but on the substance of the vulnerability it doesn't suggest a problem.

deleted 9mo ago

[deleted]

Hizonner 9mo ago

Apparently it's also outside the scope of their bug fixing program, despite being trivially remotely exploitable to get privileged code execution. Man in the middle attacks may be "out of scope" for AMD, but they're still "in scope" for actual attackers. Ignoring them is indefensibly incompetent. A policy of ignoring them is a policy of being indefensibly incompetent.

tptacek 9mo ago
The only thing cited here is a response from their bug bounty program. Excluding MITM from a bug bounty is perfectly legitimate. Actually, excluding anything from a bounty program is.
- gusgus01 9mo ago
  The response from the screenshot appears to be a "out of scope" response, but the blog poster used some editorial leeway and called it "wont fix/out of scope". Going forward, we can keep de-compiling and seeing if this vulnerability is still there and whether "wont fix" was a valid editorialization. Though, by publishing this blog and getting on the HN front page, it really skews this datapoint, so we can never know if it's a valid editorialization. Edit: Ah, someone else in this thread called out the "wont fix" vs "out of scope" after I clicked on reply: https://news.ycombinator.com/item?id=46910233 https://news.ycombinator.com/item?id=46910233. Sorry.
- tgsovlerkhgsel 9mo ago
  Excluding severe vulnerabilities like ones that completely pwn your machine just by connecting it to an untrusted network is not legitimate for any reasonable bug bounty program. Of course, a company can do it (they just did!), but it shows that they don't care about security at all. Especially if the answer is "sorry this is out of scope" rather than "while this is out of scope for our bug bounty so we can't pay you, this looks serious and we'll make sure to get a patch out ASAP".
  - Stefan-H 9mo ago
    Ethical disclosure existed before bug bounties. Someone who wants to ensure the remediation of the bug might recognize that the staff member responding to bug bounty reports is limited in their purview and might be badly trained. Upon learning that it is out of scope for the bug bounty program did the author try their security@ or another a referenced security contact? Your characterization of this bug as one "that completely pwn your machine just by connecting it to an untrusted network" is also hyperbolic to the extreme.