HN 提问：当供应商不回应安全问题时该怎么办？
1 分•作者: cudder•28 天前
我对家里一个联网电器感到厌烦，决定研究一下它的固件。由于供应商声称该产品仍处于积极支持状态且未达到生命周期结束（EOL），我的主要目标是找到一个它存在的已知漏洞（CVE），并报告给供应商，以便他们发布更新的固件，并希望附带其他改进。
最新的固件版本已经好几年了，所以这并不难。我发现了一个过时的服务，该服务可以从局域网（LAN）未经身份验证地访问，并且存在一个允许读取设备上任意文件的已知漏洞。我还发现了另一个可以从局域网未经身份验证访问的端点，只需一个 GET 请求就可以使设备变砖，需要拆卸并使用 JTAG 才能恢复。该端点没有任何跨域检查或任何形式的限制，因此恶意网站可以将 URL 放在 img 标签或其他类似标签中，无需用户交互即可使访问者的设备变砖。
我在欧盟，所以我访问了他们的欧盟网站，在那里我首先被指示在他们的支持网站上创建一个工单。我尝试了多次，但总是因为“未知错误”而失败，并指示我“联系服务台”，但没有提供任何联系方式。我还找到了另一个表单，可以选择“安全问题”作为主题，但描述字段的长度几乎不足以填写“我发现了 ${product} 的安全问题，请联系我了解更多详情。”三周过去了，我仍在等待。
接下来，我在他们的美国网站上提交了相同的安全问题表单，并很快得到了回复。确切的型号在美国没有销售，所以他们不会直接处理，但承诺会将任何细节转发给他们的欧盟同事，因为我直接联系他们非常困难。我发送了问题详情，但此后一直没有收到回复。我发送了一封后续邮件询问状态更新，但到目前为止也没有得到答复。
接下来我该怎么办？是否有欧盟实体可以介入？如果我公开我发现的内容，我是否会惹上麻烦？
查看原文
I got fed up with a certain internet-connected appliance at home, and decided to investigate its firmware. Since the vendor claims the product is still in active support and not EOL, my main goal was to find a pre-existing CVE it was vulnerable to and report that so the vendor would need to release an updated firmware, hopefully with other improvements too.<p>The latest build was years old, so that wasn't too hard. I found an outdated service that is reachable unauthenticated from LAN and has a known vulnerability that allows arbitrary file reads on the device. I also found another endpoint that is unauthenticated from LAN and with a single GET request essentially bricks the device, requiring disassembly and JTAG access to recover from. There are no cross-origin checks or restrictions of any kind, so a malicious site could put the URL in an img tag or similar and brick visitors' devices with no interaction.<p>I'm in the EU, so I went to their EU site where I was first instructed to create a ticket on their support site. I tried numerous times but it always failed with "an unknown error", instructing me to "contact the service desk" with no clues how to reach them. I also found another form where you could select security issue as the topic, but the description field was barely long enough to fit "I found security issues with ${product}, please contact me for more details." Three weeks later I'm still waiting.<p>Next I filed the same security issue form on their US site, and promptly got a reply. The exact model isn't sold in the US so they wouldn't handle it directly, but promised to forward any details to their EU counterpart since I had such a hard time reaching them directly. I sent the issue details and have not heard back since. I sent a follow-up email asking for a status update, but so far that has gone unanswered too.<p>What should I do next? Is there some EU entity that could step in? Can I get in trouble if I just publish what I found?