GM embraces white-hat hackers with public vulnerability disclosure program
GMâs vulnerability coordination portal on HackerOne.GM / HackerOneOn January 5, General Motors quietly flipped the switch on Detroitâs first public security vulnerability disclosure program, launched in partnership with the bug bounty and disclosure portal provider HackerOne. General Motors Chief Cybersecurity Officer Jeff Massimilla told Ars the new portal was a first step in creating relationships with outside security researchers and increasing the speed with which GM discovers and addresses security issues.
âWe very highly value third-party security research,â Massimilla said. He explained that under the program, those third parties can reveal vulnerabilities they find with the guarantee that GM will work with them and not take legal actionâas long as they follow the fairly straightforward guidelines posted on the programâs portal.
The choice of HackerOne was a key part of the program strategy, Massimilla said, because of that companyâs existing relationship with security researchers. âWe donât have a lot of experience with this sort of program,â Massimilla admitted. HackerOne is hosting the programâs Web portal, which handles much of the workflow of managing disclosures. âWe also have e-mail addresses and other contact points where we can communicate,â he added.
HackerOne is currently hosting more than 400 vulnerability disclosure and bug bounty programs, of which about 100 are currently public. The remainder are âinvitation only,â said HackerOne founder and CTO Alex Rice. With those, âthe companies start testing their coordination with a few trusted hackers, working out the edge cases of coordination.â
GMâs effort isnât a full-blown bug bounty program like the one announced by Tesla at last yearâs Def Con conference in Las Vegasâat least not yet. âRight now, itâs a public coordinated disclosure program, so when vulnerabilities are discovered we can work with researchers to resolve them,â Massimilla said. âWeâre going to continue to assess and modify the program as it goes forward.â Various forms of recognition and rewards will be considered, he added, as the program evolves.
Eight simple rules for hacking our cars
The GM programâs rules are mostly simple. GM has publicly declared that researchers are safe from legal action as long as they:
do not cause harm to GM, our customers, or others;
provide a detailed summary of the vulnerability, including the target, steps, tools, and artifacts used during discovery (the detailed summary will allow us to reproduce the vulnerability);
do not compromise the privacy or safety of our customers and the operation of our services;
do not violate any criminal law;
do not violate any other law (other than those that would result only in claims by GM), or disrupt or compromise any data or vehicle that is not their own;
publicly disclose vulnerability details only after GM confirms completed remediation of the vulnerability and not publicly disclose vulnerability details if there is no completion date or completion cannot be ascertained;
confirm that they are not currently located in or otherwise ordinarily reside in Cuba, Iran, North Korea, Sudan, Syria or Crimea; and
confirm that they are not on the US Department of the Treasuryâs Specially Designated Nationals List.
The creation of a disclosure program may appear to be a small step in comparison to other bug bounty programs offered, like the Tesla initiative mentioned above. But Joshua Corman of the grassroots security advocacy organization I Am The Cavalryâa group that has lobbied automakers, medical device manufacturers and other industries to work with security researchers to build safer productsâtold Ars that GMâs move is âa hugeâ step. âThis first of a kind disclosure program, if copied by rest of the auto industry, will really catalyze the maturity of their security practices,â he said.
Part of the reason for that is because of the massive work that GM has had to do (and will continue to have to do) in simply working the bugs out of the bug-killing process itself.
âThereâs been a lot of tension around the bug bounty program,â said Rice. âBut thatâs obscuring the complexity that has to go into the underlying process. For a small company, itâs pretty straightforward. But for startups, it starts to get complicated pretty quickly. If thereâs an open source project involved, for example, vulnerabilities need to be passed along. Take it up to a company the size of GM, and getting it right is a real problem, because many of the vulnerabilities that are going to be coming into the program arenât their faultâbut theyâre still going to be stepping up to coordinate getting those bugs fixed.â
Beware of dog
Starting off with building a relationship with the security research community is, as Corman described it, the âcrawling before the walkingâ of a bug program. But thereâs a lot of relationship building to be done. Most automakers have private bug-hunting programs that involve internal staff or contract security researchers, Corman noted. Some accept bugs from external trusted researchers through private programs. But for independent security researchers who discover vulnerabilities, âDetroit currently has an implicit âbeware of dogâ sign,â he said. âWeâve met people who say, âI found this bug but Iâm not going to tell them, I donât want a lawsuit.ââFurther ReadingHighway to hack: Why weâre just at the beginning of the auto-hacking eraA slew of recently revealed exploits shows gaps in carmakersâ security fit and finish.
Thereâs a reason for that defensiveness. Handling vulnerabilities in the automobile industry can be extremely complex, since the vulnerabilities are often (as demonstrated in the hack of a Jeep Cherokee last year by Charlie Miller and Chris Valasek) in systems provided by multiple tiers of suppliers. Those suppliers may or may not have vulnerability patching processes of their own. Additionally, some vulnerabilities in previous generations of vehicles may be impossible to patch without ripping and replacing components of the car wholesale. Thatâs an extremely expensive proposition, and one that will likely reach only a fraction of affected vehicles even in a recall.
âMost of the bugs found with bounty programs arenât fixable,â Rice said. Before founding HackerOne, Rice was head of product security at Facebook. He sees how his new situation can be much more difficult.
âFacebook finds bugs that it takes responsibility for but has to pass downstream,â he said. And sometimes getting those bugs fixed takes a long timeâeven when working with outside researchers. GM is now stepping into a situation that may be even thornier than that at Facebook. âFor a company like GM to step forward, theyâre telling every supplier that they also need a vulnerability coordination program.â
The Jeep hack by Miller and Valasek is âthe perfect exampleâ of the problem automakers face in doing vulnerability management, Rice said. Fiat-Chrysler was âdealing with a dependency chain that is difficult to navigate.â The vulnerabilities exploited by Miller and Valasek were in software, hardware, and services provided largely by suppliersâmost of whom donât have vulnerability management processes in place.
All that means bug fixes can take a long time. A similar demonstrated âtakeoverâ vulnerability found by University of California-San Diego researchers in GMâs OnStar service took five years to resolve after it was privately disclosed to GM and the National Highway Traffic Safety Center. The processes to deal with resolving vulnerabilities simply didnât exist at the time at GM, OnStar, or at suppliers, and most of the components involved werenât necessarily designed with the idea of security updates in mind.
Building in security
Thatâs something GM has been working to resolve through the formation of Massimillaâs organization within the company, which began with his hiring in September of 2014. âWe were one of the first automakersâI believe the firstâto put a consolidated global group in place to deal with cybersecurity,â Massimilla said. âItâs a global organization, very well-funded, and it gets attention from senior management.â
Enlarge / General Motors Cybersecurity Chief Jeff Massimilla.General MotorsMassimilla explained that the new security effort was having an impact on how GM develops its systems. âWeâre taking a layered approach to security, designing our systems so we can understand whatâs going on with them and so they can be updated over time.â Part of that involves building âdetection and monitoring and response,â he said, for vulnerabilities and possible exploits of both GMâs back-office systems and those onboard GM vehicles.
GM also joined the auto industryâs new Auto ISAC, a cyber threat information sharing and analysis center under the umbrella of the Alliance of Automobile Manufacturers. Massimilla is the vice-chair of the ISAC. âThe ISAC is the industry coming together to share threat intelligence and work to take a proactive approach cross-industry to address problems.â He added that GM is also communicating with defense and electronics industry cybersecurity groups as well.
Much of what Massimilla and GM are doing maps to the five âstarsâ proposed in I Am the Cavalryâs automotive safety program launched in August of 2014. It also follows emerging cybersecurity standards being developed by the ISO. âThere are a lot of different groups that are looking at different programs that can be a comprehensive framework for security, and security vulnerability disclosure and the ability to work with outside researchers is key for any of them,â Massimilla acknowledged. Designing for security and enabling rapid responses to security problems are major parts of the puzzleâparts that many automakers have started to recognize with no small amount of pain over the past few years.
In combination with the Library of Congressâ recent ruling exempting vehicle software from the Digital Millennium Copyright Act (DMCA)âa ruling that will kick in later this yearâCorman believes programs like GMâs will draw vulnerability reports that many researchers may have been sitting on for years. âOnce people recognize that hereâs a welcome mat, people will start reporting more things theyâve found,â he said. âItâs going to be really tough for the other automotive OEMs to not follow suit. Everybody will then start finding bugs faster. Theyâll see bugs are dense, not sparse, and that will help them make better design choices in the future.â The result, Corman said, will see an âupward spiralâ in automotive safety practices.
Automakers and their suppliers arenât alone in being slow to adopt vulnerability coordination programs. In a survey HackerOne conducted of Forbes 2000 companies last year, 94 percent of the companies who participated said that they had âno identifiable process to respondâ to vulnerability disclosures according to Rice. âThere are vulnerabilities in every single one of those companies,â he asserted. âHaving no process for dealing with them is doing everyone a disservice.â
GM embraces white-hat hackers with public vulnerability disclosure program was originally published on Cyber Parse
ellievsbear
jbbartram-illu
blakekathryn
dededos
