Du rififi entre DJI & un chercheur découvrant des failles de sécurité (MAJ)
Par Didier Pulicani - Publié le
Cet été, le chinois DJI a ouvert son
A ce petit jeu, un chercheur en sécurité avait trouvé de belles perles sur les serveurs du constructeur, Kevin Finisterre avait notamment pu intercepter les clés privés de certains certificats, ce qui lui a permis d'accéder à des données clients. Mais les termes du contrat qui le liait à DJI ont finalement dissuadé le développeur de récupérer les 30 000$ promis, les conditions étant jugées trop rigides par ses avocats. Pire, la société se réservait apparemment le droit de poursuivre le jeune homme en justice pour avoir accédé à ses serveurs sans autorisation... Bref, avant de vous lancer dans la chasse (rémunérée) aux bugs, vérifiez bien les conditions d'obtention de la récompense !
Source
MAJ : DJI nous a adressé un communiqué dans lequel la société évoque des menaces du côté de Finisterre, qui refusait apparemment d'accepter les termes du Bug Bounty -notamment l'accord de confidentialité. Voici le communiqué en intégralité :
bug bounty, un système qui récompense la découverte de failles de sécurité par des sommes (allant ici de 100 à 30 000 dollars), à la condition de laisser au constructeur le temps de les corriger avant de les rendre éventuellement publiques.
A ce petit jeu, un chercheur en sécurité avait trouvé de belles perles sur les serveurs du constructeur, Kevin Finisterre avait notamment pu intercepter les clés privés de certains certificats, ce qui lui a permis d'accéder à des données clients. Mais les termes du contrat qui le liait à DJI ont finalement dissuadé le développeur de récupérer les 30 000$ promis, les conditions étant jugées trop rigides par ses avocats. Pire, la société se réservait apparemment le droit de poursuivre le jeune homme en justice pour avoir accédé à ses serveurs sans autorisation... Bref, avant de vous lancer dans la chasse (rémunérée) aux bugs, vérifiez bien les conditions d'obtention de la récompense !
Source
MAJ : DJI nous a adressé un communiqué dans lequel la société évoque des menaces du côté de Finisterre, qui refusait apparemment d'accepter les termes du Bug Bounty -notamment l'accord de confidentialité. Voici le communiqué en intégralité :
November 16, 2017 - DJI is investigating the reported unauthorized access of one of DJI's servers containing personal information submitted by our users.
As part of its commitment to customers' data security, DJI engaged an independent cyber security firm to investigate this report and the impact of any unauthorized access to that data. Today, a hacker who obtained some of this data posted online his confidential communications with DJI employees about his attempts to claim a "bug bounty" from the DJI Security Response Center.
DJI implemented its Security Response Center to encourage independent security researchers to responsibly report potential vulnerabilities. DJI asks researchers to follow standard terms for bug bounty programs, which are designed to protect confidential data and allow time for analysis and resolution of a vulnerability before it is publicly disclosed. The hacker in question refused to agree to these terms, despite DJI's continued attempts to negotiate with him, and threatened DJI if his terms were not met.
DJI takes data security extremely seriously, and will continue to improve its products thanks to researchers who responsibly discover and disclose issues that may affect the security of DJI user data and DJI's products. DJI has paid thousands of dollars to almost a dozen researchers who have submitted reports to the Security Response Center and agreed to the terms for payment. As the Security Response Center receives new reports, DJI regularly agrees to pay new bounties to researchers for their discoveries.
More details about the Security Response Center and information on how to submit bugs are available on the center's website at security.dji.com.
As part of its commitment to customers' data security, DJI engaged an independent cyber security firm to investigate this report and the impact of any unauthorized access to that data. Today, a hacker who obtained some of this data posted online his confidential communications with DJI employees about his attempts to claim a "bug bounty" from the DJI Security Response Center.
DJI implemented its Security Response Center to encourage independent security researchers to responsibly report potential vulnerabilities. DJI asks researchers to follow standard terms for bug bounty programs, which are designed to protect confidential data and allow time for analysis and resolution of a vulnerability before it is publicly disclosed. The hacker in question refused to agree to these terms, despite DJI's continued attempts to negotiate with him, and threatened DJI if his terms were not met.
DJI takes data security extremely seriously, and will continue to improve its products thanks to researchers who responsibly discover and disclose issues that may affect the security of DJI user data and DJI's products. DJI has paid thousands of dollars to almost a dozen researchers who have submitted reports to the Security Response Center and agreed to the terms for payment. As the Security Response Center receives new reports, DJI regularly agrees to pay new bounties to researchers for their discoveries.
More details about the Security Response Center and information on how to submit bugs are available on the center's website at security.dji.com.
