Intel offered “reward” to Dutch researchers to downplay MDS vulnerability
1–10 of 19 posts
Re: Intel offered “reward” to Dutch researchers to downplay MDS vulnerability
#2Is this a bribe? A bug bounty is a standard program for lots of companies, we don't consider the bounty a bribe. I mean, you could bribe someone in this way but there needs to be some nefarious intent going on - just giving them money to delay announcement until you've fixed the bug seems like a fairly pure motive to me.
Re: Intel offered “reward” to Dutch researchers to downplay MDS vulnerability
#3Is this a bribe? A bug bounty is a standard program for lots of companies, we don't consider the bounty a bribe. I mean, you could bribe someone in this way but there needs to be some nefarious intent going on - just giving them money to delay announcement until you've fixed the bug seems like a fairly pure motive to me.
You question whether or not this is a bribe, but then you get to this:
> giving them money to delay announcement until you've fixed the bug
And this is why it is a bribe. Sure, maybe you feel this isn't ethically problematic in which case you could just take it.
Re: Intel offered “reward” to Dutch researchers to downplay MDS vulnerability
#4Is this a bribe? A bug bounty is a standard program for lots of companies, we don't consider the bounty a bribe. I mean, you could bribe someone in this way but there needs to be some nefarious intent going on - just giving them money to delay announcement until you've fixed the bug seems like a fairly pure motive to me.
You question whether or not this is a bribe, but then you get to this: > giving them money to delay announcement until you've fixed the bug And this is why it is a bribe. Sure, maybe you feel this isn't ethically problematic in which case you could just take it.
I think it depends on if the agreement is to delay the announcement, or hide the announcement forever.
If I were a researcher, I'd be happy to delay for 6 months for a reward, but I would consider it morally bad to delay forever for a reward.
Re: Intel offered “reward” to Dutch researchers to downplay MDS vulnerability
#5Is this a bribe? A bug bounty is a standard program for lots of companies, we don't consider the bounty a bribe. I mean, you could bribe someone in this way but there needs to be some nefarious intent going on - just giving them money to delay announcement until you've fixed the bug seems like a fairly pure motive to me.
They offered them a lower bug bounty reward with a big "gift" on the side. This would mean Intel gets to report the bug as lower severity. And presumably the extra "gift" money, which raises the total paid above the max bounty they normally offer by $20,000, had some strings attached.
I've already read articles that some of the vulnerabilities were found more than a year ago. And as others reported similar exploits, they grouped them all together into 2 "teams" and made the PR release all at once. The only reason we're hearing anything now, is that I heard the team who found the first bug threatened to leak since it had been a whole year. The first bug was discovered a year and three days ago. If they didn't threaten to leak, god knows how long Intel would have spent collecting bugs.
This CPU "bug" is actually 4 different CVE's, some quite different from the others, and presumably discovered at various times over the past year.
Just scummy as hell by Intel. They #1 forced a bunch of different researchers who found different bugs to split the bounty, #2 aggregated the bugs rolling in for more than a year to minimize impact. That's on top of the attempted bribery and rumors that the microcode + patches do not fully mitigate leaks between hyper threads.
And for the argument that they didn't have enough time at one year... They had enough time to fix and release new silicon! Intel states that chips made in the last month are fixed at a hardware level. It's orders of magnitude harder to ship silicon than software, so my assumption is that the fixes for existing chips have been ready for a while. They've just been sitting, waiting
Re: Intel offered “reward” to Dutch researchers to downplay MDS vulnerability
#6Earlier quoted context omitted.
You question whether or not this is a bribe, but then you get to this: > giving them money to delay announcement until you've fixed the bug And this is why it is a bribe. Sure, maybe you feel this isn't ethically problematic in which case you could just take it.
I think it depends on if the agreement is to delay the announcement, or hide the announcement forever. If I were a researcher, I'd be happy to delay for 6 months for a reward, but I would consider it morally bad to delay forever for a reward.
This money was also meant for downplaying the severity of the vulnerability, allowing intel to spin the discovery and lose less face. This is a politically charged bribe, their bug bounty program has been constructed to lend credibility to it.
Re: Intel offered “reward” to Dutch researchers to downplay MDS vulnerability
#7Earlier quoted context omitted.
You question whether or not this is a bribe, but then you get to this: > giving them money to delay announcement until you've fixed the bug And this is why it is a bribe. Sure, maybe you feel this isn't ethically problematic in which case you could just take it.
I think it depends on if the agreement is to delay the announcement, or hide the announcement forever. If I were a researcher, I'd be happy to delay for 6 months for a reward, but I would consider it morally bad to delay forever for a reward.
If I were a researcher, I'd be happy to delay for 6 months for a reward
Really? What if a nation state actor has discovered the same bug. Do you want to keep the world vulnerable for a 6 month window?
Also, most European university researchers are funded through taxpayer money. They should do what is best for the general population, not what is best of some company's stock value.
Re: Intel offered “reward” to Dutch researchers to downplay MDS vulnerability
#8Earlier quoted context omitted.
You question whether or not this is a bribe, but then you get to this: > giving them money to delay announcement until you've fixed the bug And this is why it is a bribe. Sure, maybe you feel this isn't ethically problematic in which case you could just take it.
I think it depends on if the agreement is to delay the announcement, or hide the announcement forever. If I were a researcher, I'd be happy to delay for 6 months for a reward, but I would consider it morally bad to delay forever for a reward.
It became morally bad to delay any longer once it was obvious that multiple teams were finding the same bugs. There's a crap ton of people listed as discoverers in the CVE's.
Who knows how many other actors discovered the same bugs and didn't say anything? Likely multiple, honestly.
We've finally run into a real life proof of why bug embargoes are bad. This is the first time I know of that multiple people independently discovering the same thing before the embargo period was over.
Re: Intel offered “reward” to Dutch researchers to downplay MDS vulnerability
#9Earlier quoted context omitted.
I think it depends on if the agreement is to delay the announcement, or hide the announcement forever. If I were a researcher, I'd be happy to delay for 6 months for a reward, but I would consider it morally bad to delay forever for a reward.
If I were a researcher, I'd be happy to delay for 6 months for a reward Really? What if a nation state actor has discovered the same bug. Do you want to keep the world vulnerable for a 6 month window? Also, most European university researchers are funded through taxpayer money. They should do what is best for the general population, not what is best of some company's stock value.
> most European university researchers are funded through taxpayer money
This is absolutely not a given. While it might be partially true, they are frequently also funded through corporate grants.
Re: Intel offered “reward” to Dutch researchers to downplay MDS vulnerability
#10Tomorrow's story: "Intel execs discovered wiping their ass with retail CPUs before packaging. Company defends measure as 'giving things a personal touch'. Stock prices rise."