Friday, May 17th 2019
Intel Tried to Bribe Dutch University to Suppress Knowledge of MDS Vulnerability
Cybersecurity researchers at the Vrije Universiteit Amsterdam, also known as VU Amsterdam, allege that Intel tried to bribe them to suppress knowledge of the latest processor security vulnerability RIDL (rogue in-flight data load), which the company made public on May 14. Dutch publication Nieuwe Rotterdamsche Courant reports that Intel offered to pay the researchers a USD $40,000 "reward" to allegedly get them to downplay the severity of the vulnerability, and backed their offer with an additional $80,000. The team politely refused both offers.
Intel's security vulnerability bounty program is shrouded in CYA agreements designed to minimize Intel's losses from the discovery of a new vulnerability. Under its terms, once a discoverer accepts the bounty reward, they enter into a NDA (non-disclosure agreement) with Intel, to not disclose their findings or communicate in the regard with any other person or entity than with certain authorized people at Intel. With public knowledge withheld, Intel can work on mitigation and patches against the vulnerability. Intel argues that information of vulnerabilities becoming public before it's had a chance to address them would give the bad guys time to design and spread malware that exploits the vulnerability. This is an argument the people at VU weren't willing to buy, and thus Intel is forced to disclose RIDL even as microcode updates, software updates, and patched hardware are only beginning to come out.
Update: (17/05): An Intel spokesperson commented on this story.
Intel contacted us with a statement on this story pertaining to the terms of its bug bounty program:
Sources:
NRC.nl, EverythingIsNorminal (Reddit)
Intel's security vulnerability bounty program is shrouded in CYA agreements designed to minimize Intel's losses from the discovery of a new vulnerability. Under its terms, once a discoverer accepts the bounty reward, they enter into a NDA (non-disclosure agreement) with Intel, to not disclose their findings or communicate in the regard with any other person or entity than with certain authorized people at Intel. With public knowledge withheld, Intel can work on mitigation and patches against the vulnerability. Intel argues that information of vulnerabilities becoming public before it's had a chance to address them would give the bad guys time to design and spread malware that exploits the vulnerability. This is an argument the people at VU weren't willing to buy, and thus Intel is forced to disclose RIDL even as microcode updates, software updates, and patched hardware are only beginning to come out.
Intel contacted us with a statement on this story pertaining to the terms of its bug bounty program:
"We [Intel] believe that working with skilled security researchers across the globe is a crucial part of identifying and mitigating security vulnerabilities. One of the ways we engage with researchers is through our bug bounty program. We provide a clear overview of our bug bounty program requirements, eligibility and award schedule on our website."
87 Comments on Intel Tried to Bribe Dutch University to Suppress Knowledge of MDS Vulnerability
This has been widely documented and even landed Intel in a certain court for anti-trust/anti-competitive practises and fined a few million or billion for their behavior.
Did you read the whole thread, beyond the headline? I point you to Post#17
Though I would have contacted a member of the FTC or something to accept the money on my behalf from Intel. In secret.
Again, we don't really know for sure so it is hard to say and everyone will make of it what they will. Considering Intel got busted paying off OEMs previously, the former is accusation is plausible. But since we also accused MSI (with no evidence whatsoever) of trying to pull the wool over everyone's eyes with the AM4 socket, I am not surprised by the wording either.
But, alas, this isn't a "news" site, it's an editorial site.
I'm fence sitting on this... One side is such findings should at least come to light/public (low level details) after a IDK a 4 week "grace period" where the company has a time to either fix or minimize vulnerability affect. But this... hey we'll pay you for a 6mo extension to not make public...? How many nefarious groups are exploiting it while Intel keep's it hush-hush... Or, that's just enough time to release their next offerings and minimize damage to a launch of products that vulnerability is still there. Perhaps the people who are exploiting it use the extra 6 mo's to release Drumps tax returns, make an attack on your country, or just ruin your credit. In-action is not a option.
Sounds about right.
The key is that the longer it is not public then generally speaking the longer it doesn't get exploited. If the company is dragging their feet then they usually get called out and the vulnerability goes public. The problem with that is that it leaves people with the vulnerable system at the mercy of companies and bad actors.
The researchers have to use their judgement about which path to take: Hopefully protect users by not releasing the vulnerability while the patch happens or release the vulnerability to force the company to fix it (hope they do) and put users at greater risk.
To me it seems to be a misconception on the part of the finders as to how IT works in large corporations. Every IT shop has approvals and thorough testing that every change has to go through, to make sure that a change doesn't have an unintended consequence or introduces a big bug. Intel became the market leader because their chips are reliable. I don't want them throwing out untested patches that are rushed out asap either, and the public would uproar if Intel operated that way. It's not feasible to expect hotfixes for things like this in hours, and although Intel deservedly doesn't have a great rep I don't think this is the hill to die on for railing against big corporate evil. I also personally wouldn't view the payment as a "bribe". To me the flaw finders shot themselves in the foot turning down the money.
So a fix is going to take a little time, and that should be expected.