Skip to main content
Became Hot Network Question
added 32 characters in body
Source Link
dudekowsky
  • 321
  • 2
  • 6

In the last decade side-channel attacks like fault injection attacks (e.g., voltage glitching attacks) have been used to bypass JTAG locks or read-out memory protections. Such vulnerabilities might not be easy to prevent. They can be caused by the hardware design or by the firmware in use. Therefore, in order to fix such vulnerabilities, vendors might need to change hardware design of their products so that the vulnerability cannot be easily fixed in customer products without replacing the component.

Is such a thing as "responsible disclosure" even possible, given that fixing such a vulnerability might need a hardware redesign and a replacement of components?

Would it therefore not be unethical to release any public information after 90 days?

In the last decade side-channel attacks like fault injection attacks (e.g., voltage glitching attacks) have been used to bypass JTAG locks or read-out memory protections. Such vulnerabilities might not be easy to prevent. They can be caused by the hardware design or by the firmware in use. Therefore, in order to fix such vulnerabilities, vendors might need to change hardware design of their products so that the vulnerability cannot be easily fixed in customer products without replacing the component.

Is such a thing as "responsible disclosure" even possible, given that fixing such a vulnerability might need a hardware redesign?

Would it therefore not be unethical to release any public information after 90 days?

In the last decade side-channel attacks like fault injection attacks (e.g., voltage glitching attacks) have been used to bypass JTAG locks or read-out memory protections. Such vulnerabilities might not be easy to prevent. They can be caused by the hardware design or by the firmware in use. Therefore, in order to fix such vulnerabilities, vendors might need to change hardware design of their products so that the vulnerability cannot be easily fixed in customer products without replacing the component.

Is such a thing as "responsible disclosure" even possible, given that fixing such a vulnerability might need a hardware redesign and a replacement of components?

Would it therefore not be unethical to release any public information after 90 days?

edited title
Link
dudekowsky
  • 321
  • 2
  • 6

Responsible Is a responsible disclosure process for hardware-based vulnerabilities even possible?

deleted 19 characters in body
Source Link
dudekowsky
  • 321
  • 2
  • 6

In the last decade side-channel attacks like fault injection attacks (e.g., voltage glitching attacks) have been used to bypass JTAG locks or read-out memory protections. Such vulnerabilities might not be easy to prevent. They can be caused by the hardware design or by the firmware in use. Therefore, in order to fix such vulnerabilities, vendors might need to change hardware design of their products so that the vulnerability cannot be easily fixed in customer products without replacing the component.

Is such a thing as "responsible disclosure" even possible, given that fixing such a vulnerability might need a hardware redesign? Would

Would it therefore not be unethical to release any public information after 90 days and harm the vendor?

In the last decade side-channel attacks like fault injection attacks (e.g., voltage glitching attacks) have been used to bypass JTAG locks or read-out memory protections. Such vulnerabilities might not be easy to prevent. They can be caused by the hardware design or by the firmware in use. Therefore, in order to fix such vulnerabilities, vendors might need to change hardware design of their products so that the vulnerability cannot be easily fixed in customer products without replacing the component.

Is such a thing as "responsible disclosure" even possible, given that fixing such a vulnerability might need a hardware redesign? Would it therefore not be unethical to release any public information after 90 days and harm the vendor?

In the last decade side-channel attacks like fault injection attacks (e.g., voltage glitching attacks) have been used to bypass JTAG locks or read-out memory protections. Such vulnerabilities might not be easy to prevent. They can be caused by the hardware design or by the firmware in use. Therefore, in order to fix such vulnerabilities, vendors might need to change hardware design of their products so that the vulnerability cannot be easily fixed in customer products without replacing the component.

Is such a thing as "responsible disclosure" even possible, given that fixing such a vulnerability might need a hardware redesign?

Would it therefore not be unethical to release any public information after 90 days?

added 107 characters in body
Source Link
dudekowsky
  • 321
  • 2
  • 6
Loading
Source Link
dudekowsky
  • 321
  • 2
  • 6
Loading