Microsoft Offers Bug Bounty to Prevent Another Spectre-Meltdown Fiasco

Fact is they are still patching away! And yes I have seen no public disclosure on many of the problems. Try asking Intel for help, it is a brick wall. My guess is that they made a huge mistake, that they thought that high precision timers were needed, and they did not put the effort into otherwise fixing the problems. Lack of sharing probably made it much worse. They had still not addressed these at the public disclosure date. They either realized the mistake themselves or various people told them of their mistakes, and they were left with known vulnerable products on the market that they had no hope of fixing in a timely manner. At that point they could have advised their users to move to alternative products, e.g. Google had a head start, but that would likely have ended them, most people would not come back many months later when they claim to have fixed the problems, and that is a big expense for them! Another alternative was to take drastic coding measures, lfence branch paths, but at a high performance loss, they did not do that either, again who wants a slow product if the competition has not also taken the same action. The really kicker is people had been trying to get them to move on this for years and they had been resisting it strongly.

> Unless you believe that Intel or Microsoft would lie about already knowing about a vulnerability

Imagine they know of a vulnerability but believe that it's not practical to exploit, or something. Then someone comes along and demonstrates that it actually is practical to exploit. They could say, well, we knew about this already and didn't believe it's practical, so we're not paying you for it.

It can sometimes be hard to convince a vendor that a vulnerability is "their fault" and this policy only increases the difficulty.

My experience from being involved in a couple of them (though obviously not quite on the scale of Microsoft) is that people underestimate both the difficulty of running bug bounties and the average quality of submissions to them.

When I worked at Mozilla on the MDN team, for example, there was a lot of inevitable spamming of "security" bugs which basically boiled down to "MDN is a publicly-editable wiki and hosts code samples" (MDN also goes to some trouble to do that safely). The current bug bounty exclusions are still pretty broad as far as I can tell, and thankfully will automatically throw out a bunch of the worst of the spam.

Same thing happens still with Django. I've considered writing up something with similar exclusions to Mozilla's policy just because it would save time dealing with meaningless reports (though Django would get a few categories the Mozilla policy doesn't, like "it's not a vulnerability if the only person you can CSRF is yourself").

We can use cryptography instead of 3rd parties to solve most of the trust problem. The companies publish encrypted documentation of a vulnerability so that when they claim a researcher has found something already known, they share the key to prove they already know it. A 3rd party might be useful in a complaint process where the researcher claims the two vulnerabilities are not the same. Given that is hopefully now a minority case, the researcher can resort to the court of public opinion.

It doesn't need to be a block-chain but I guess it would help create a tamper proof time ordered record.

Ok, but if a working web browser POC is not worthy of a bug bounty reward, because they claim to already know, then what is the point of the bug bounty? Why are they not just paying for specialists to advise them on how to fix this if they have no plan. They don't even listen when you try and try and try to explained what needs to be done. How can a bug bounty fix this?

The point is that the vendor was claiming they had patched the flaw. They can't simultaneously claim to have a patch and that they know the patch doesn't fix it.

The mitigation and litigation costs to the large players, even in the case of a successful defense, are surely larger than $250k.

These bugs are probably most valuable against cloud providers (Where else do you get arbitrary code execution on a machine with other's valuable data on it?). Most cloud providers run Linux, not Microsoft (except Microsoft) and definitely not Apple.

Raspberry Pi? It was unaffected [https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne...].

I know it is not a realistic alternative for many needs, but Intel's Atom cores are not affected by Meltdown or Spectre.

on gray market it's worth 10X that

5-6 years of living expenses.

The government should let go the taxes on such bugs (not all).

Probably because it isn't the core conversation. What matters is that Microsoft is pushing bug bounties, not how big they are.

But it's really splitting hairs. I don't really get it either - just a guess.

It's not only that the money is sketchy, you'll most likely won't know who you are selling to and how it will be used. Conscience might bite you in the ass.

Define sketchy. Is an israeli company who will be then reselling the exploit to all sort of law enforcement agencies from democratic countries and less democratic countries sketchy? It's certainly safe from a legal point of view.

I was just taking issue with the title. Bug bounties don't make bugs go away.

Meltdown/Spectre was not a "fiasco" due to Microsoft and Intel not finding out. It was "responsibly" disclosed to the companies, and there were multiple months to prepare a response. A bigger bounty would not change anything for Meltdown/Spectre.

It was a "fiasco" because it affected over 90% of all servers and laptops out there. And there was just no way to prepare enough of a response, while keeping it secret. For a few months, too few engineers knew about it for good mitigation development. Towards the end, as more people who needed to know were looped in, everyone could see it coming. The vulnerabilities, and mitigations, were just too big.

I mean why does it matter which CPU component is mis-designed if it is a side-channel that allows you to extract data from other security domains?

If the last 10 years of VT-x implementations had a flaw that lets you extract data from other VMs that would be about as juicy as Meltdown.