Is a responsible disclosure for hardware-based vulnerabilities even possible?

Question

In the last decade side-channel attacks like fault injection attacks (e.g., voltage glitching attacks) have been used to bypass JTAG locks or read-out memory protections. Such vulnerabilities might not be easy to prevent. They can be caused by the hardware design or by the firmware in use. Therefore, in order to fix such vulnerabilities, vendors might need to change hardware design of their products so that the vulnerability cannot be easily fixed in customer products without replacing the component.

Is such a thing as "responsible disclosure" even possible, given that fixing such a vulnerability might need a hardware redesign and a replacement of components?

Would it therefore not be unethical to release any public information after 90 days?

Answer 1

The idea of a responsible disclosure is to protect the customers both in the short term and the long term. What this exactly means in terms of disclosure timelines and details depends on how severe the vulnerability is, how fast it can be fixed and how fast the fixes can be rolled out by the customers. There is no single approach to responsible disclosure which works for all cases.

In the long term it is good if the affected products get fixed or at least newer products don't have the same vulnerability. This might take longer with hardware based vulnerabilities than with purely software. For fixing the problem the manufacturer needs to know the problem, so disclosing it to the manufacturer is a good thing. If it is a more generic vulnerability affecting multiple manufacturers or even standards, then it needs an even wider disclosure.

But customers need to protect themselves in the short term already. For this they might not need all the details about the vulnerability or even working exploits, but customers need enough details to determine their risks and mitigate them. How this mitigation will be done with vulnerabilities in the hardware depends on how the product is used by the customer, i.e. it might mean to add better physical protection around the product or in the worst case stop using the product completely.

Answer 2

to bypass JTAG locks or read-out memory protection

In most cases, this only poses risk of exposing manufacturer's own intellectual property. Code read-out protection is not the only way to protect that, they can also e.g. monitor whether clone products appear on market and litigate.

For some specific cases, like a hardware password manager or crypto wallet, debugger access could expose user's data to an attacker with physical access. In that case a responsible disclosure would give enough time for manufacturer to alert customers about the risk, even if no fix is possible.

The debugger access also enables further security analysis that can discover security problems in the firmware. But typically those are software bugs that can be fixed with a firmware update, following a normal disclosure process.

Answer 3

Hardware vulnerabilities rarely have a proper fix short of replacing the affected hardware. Often a firmware mitigation is possible which merely disables the vulnerable hardware feature, which inherently creates a conflict of interest: users would like to keep the affected feature if they deem the vulnerability is not affecting them, while manufacturers would rather protect themselves from liability and/or protect their own IP. Note that the lion's share of such vulnerabilities are essentially failed restriction measures the manufacturer has put in place to prevent the user from getting access to certain features, such as debug interfaces.

Disclosing the vulnerability to the manufacturer before making it public can therefore put customers at disadvantage, preventing them from taking measures (such as disabling firmware updates or avoiding official repair services) that would preserve the functionality they need.

Answer 4

Everything Steffan said, and more. Specifically, in "customers need enough details to determine their risks and mitigate them", mitigate includes even things like "throw away the affected devices and go back to a non-electronic process" or "change physical security practices so that the vulnerability is no longer attack surface".

I would go so far as to say that, for hardware based vulnerabilities, the default "responsible disclosure", short of a specific reason otherwise, should be "immediate full disclosure". Unlike with software, there is no way vendors can deliver a timely fix to everyone affected, so there is utterly no benefit to the affected parties (users/customers and people they are protecting) if you give the vendor early notice.