Drone-Maker DJI Offers Bug Bounty Program, Then Threatens Bug-Finder With The CFAA

Furnished content.


Far too many companies and industries out there seem to think that the best way to handle a security researcher finding security holes in their tech and websites is to immediately begin issuing threats. This is almost always monumentally dumb for any number of reasons, ranging from the work these researchers do actually being a benefit to these companies issuing the threats, to the resulting coverage of the threats making the vulnerabilities more widely known than they would have been otherwise.But drone-maker DJI gets special marks for attacking security researchers, having decided to turn on one that was working within the bug-bounty program it had set up.

DJI, the Chinese company that manufactures the popular Phantom brand of consumer quadcopter drones, was informed in September that developers had left the private keys for both the "wildcard" certificate for all the company's Web domains and the keys to cloud storage accounts on Amazon Web Services exposed publicly in code posted to GitHub. Using the data, researcher Kevin Finisterre was able to access flight log data and images uploaded by DJI customers, including photos of government IDs, drivers licenses, and passports. Some of the data included flight logs from accounts associated with government and military domains.Finisterre found the security error after beginning to probe DJI's systems under DJI's bug bounty program, which was announced in August. But as Finisterre worked to document the bug with the company, he got increasing pushback—including a threat of charges under the Computer Fraud and Abuse Act (CFAA). DJI refused to offer any protection against legal action in the company's "final offer" for the data. So Finisterre dropped out of the program and published his findings publicly yesterday, along with a narrative entitled, "Why I walked away from $30,000 of DJI bounty money."

When Finisterre submitted his full report on the exposure to the bug bounty program, he received an e-mail from DJI's Brendan Schulman that said the company's servers were suddenly not in scope for the bounty program. Still, Finisterre received notification from DJI's bug bounty program e-mail account on September 28 that his report earned the top reward for the program—$30,000 in cash. Then, Finisterre heard nothing for nearly a month.Ultimately, Finisterre received an e-mail containing an agreement contract that he said "did not offer researchers any sort of protection. For me personally, the wording put my right to work at risk, and posed a direct conflict of interest to many things including my freedom of speech." It seemed clear to Finisterre that "the entire ‘Bug Bounty’ program was rushed based on this alone," he wrote.

DJI is investigating the reported unauthorized access of one of DJI’s servers containing personal information submitted by our users. As part of its commitment to customers’ data security, DJI engaged an independent cyber security firm to investigate this report and the impact of any unauthorized access to that data. Today, a hacker who obtained some of this data posted online his confidential communications with DJI employees about his attempts to claim a “bug bounty” from the DJI Security Response Center.DJI implemented its Security Response Center to encourage independent security researchers to responsibly report potential vulnerabilities. DJI asks researchers to follow standard terms for bug bounty programs, which are designed to protect confidential data and allow time for analysis and resolution of a vulnerability before it is publicly disclosed. The hacker in question refused to agree to these terms, despite DJI’s continued attempts to negotiate with him, and threatened DJI if his terms were not met.

0 comments, click here to add the first

Top German Judges Slam EU Plans To Create Global Court To Enforce Corporate Sovereignty

Furnished content.


A few weeks ago, we wrote how many -- even the US Trade Representative, Robert Lighthizer -- seem to think it's time for corporate sovereignty, also called "investor-state dispute settlement" (ISDS), to go. For some reason the European Commission disagrees. As Techdirt readers may recall, after receiving a bloody nose in a public consultation about corporate sovereignty, the Commission announced to great fanfare that it was "replacing" ISDS with something called the Investment Court System (ICS). In fact, this amounted to little more than putting lipstick on the ISDS pig, since ICS suffered from the same fundamental flaw: it gave companies unique rights to sue countries in a supra-national court. The EU is still plugging away at the ICS idea, and it now wants to go further by creating a truly global corporate sovereignty system enforced by a new Multilateral Investment Court (pdf), an initiative formally launched a couple of months ago:

the [EU's] approach since 2015 has been to institutionalise the system for the resolution of investment disputes in EU trade and investment agreements through the inclusion of the Investment Court System (ICS). However, due to its bilateral nature, the ICS cannot fully address all the aforementioned problems. Moreover, the inclusion of ICSs in [EU] agreements has costs in terms of administrative complexity and budgetary impact.The multilateral investment court initiative aims at setting up a framework for the resolution of international investment disputes that is permanent, independent and legitimate; predictable in delivering consistent case-law; allowing for an appeal of decisions; cost-effective; transparent and efficient proceedings and allowing for third party interventions (including for example interested environmental or labour organisations).

Because of [the arbitration courts'] position, they can override decisions of national administrations and courts in favour of an investor. This exercise of power, exercised by an arbitral tribunal, has thus far been limited to the enforcement of individual arbitral awards. However, it would be considerably strengthened if the arbitral tribunals were upgraded to an MIC with permanent jurisdiction, which would operate under an international convention. Together with the investment protection agreements, as part of European law, the MIC Convention will be recognised by international law and can thus bind national courts. This will make the MIC a standard-setting organization.

The protection of individual goods, including those of investors, is the daily work of the judges of all judicial courts and instances. In principle, these rights can also be claimed by foreign investors....the best investor protection is a functioning, uncorrupted administration and jurisdiction and a democratic legislative process. It is the task of every investor to determine this; they can avoid investments in countries that do not fulfil these standards. If they, nonetheless, take the risk, no special protection is necessary.

0 comments, click here to add the first