Re:Our Interesting Call with CTS-Labs
by dman on Thursday March 15, 2018 @11:35PM
(#16598413)
Am curious if it is legal to fund security research to find flaws in a competitors product. If so then going forward this might become a tool used by hardware / software companies to go after their competition.
[ Parent
| on HN ]
> Am curious if it is legal to fund security research to find flaws in a competitors product.
It’s legal. I’ve been hired to do it before.
Any restrictions at the time of disclosure?
I’m not sure how you mean; in general, I was tasked with finding vulnerabilities that could be used for reverse engineering purposes and which woukdn’t be disclosed.
Ah I meant the legality of funding efforts to find glaring bugs in competitors products and then releasing them publicly as a 0-day.
I can't think of a reason why it wouldn't be completely legal? Unless there's some sort of ToS violation, however it'd be interesting to see how that would stand up to legal scrutiny. There are however clear ethical considerations surrounding disclosure which is really interesting in this case.
Google (Project Zero) has found and published plenty of vulnerabilities in Microsoft products.
(Part of) HN got real salty after Google auto-published after the 90-day disclosure deadline expired,but before MS had a patch out. I wonder what the reaction would be if Project Zero adopted a 24-hour disclosure...
What was this on?
I believe it was for this remotely exploitable IE/Edge[1] bug.
1. https://arstechnica.com/information-technology/2017/02/high-...
There is a difference in helping and destroying competition.
If it's factually correct it wouldn't be libel.
I wouldn't be surprised if it's illegal somewhere in the world, but in the US, publishing factual information you have not signed away the right to publish via an NDA or similar contract is usually legal. I don't know that motive is ever involved as part of the test of determining whether or not you are allowed to write something.
I'm not a lawyer, this isn't legal advice.