Motorola Mobility Hardware Engagement

Description

Welcome to the Motorola Mobility IOT program! As part of the Lenovo family, Motorola Mobility is creating innovative smartphones and accessories designed with the consumer in mind. That’s why we’re looking for the thinkers, innovators and problem solvers who believe in working together to challenge the status quo. If you share our commitment to creativity and a passion for bringing new possibilities to life in mobile technology, we want you to say hello to Moto. Motorola has a long history of inventing game-changing technology. As a member of the Motorola team, you’ll help us continue our legacy by collaborating with talented colleagues around the globe to create new products that are not only different, but better. We thrive in an open and supportive culture, working in teams where your contribution has impact. We believe in transparency across all levels of the business, valuing every person’s opinion and encouraging new ways of thinking. Here, we all take accountability for our work, we drive consumer-centric decision-making, and we enable our people to push the line of innovation. Want in? Let’s get started on something different, together. This program adheres to the Bugcrowd Vulnerability Rating Taxonomy for the prioritization/rating of findings. If relevant, the deviations from the VRT should be listed here in a markdown table:

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Motorola Mobility that is not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Motorola Mobility, you can report it here . However, be aware that such reports will be ineligible for rewards or points-based compensation. Severity Breakdown Rating │ Description │ Reward Range P1 │ Demonstrate an immediate, reproducible, and severe concern to security, privacy, or business operations. In this category are full-chain exploits which take control of the device remotely, exfiltrate sensitive information (e.g. passwords, audio recordings of phone calls), or bypass critical business safeguards, such as the secure boot chain, subsidy locks, or critical device attestations (e.g. financing). Other exploits may be considered for this category if the report contains an evidence-based claim regarding the extent of impact. │ Most rewards for this category will range from 4,000.00 to 5,000.00 USD . However, the upper threshold of the award for this category does not have a strict bound and will be brought to the consideration of an award review committee, which will provide an explanation for the final payout. Supply and licensing of tools or methods used to discover the vulnerability readily applicable to Motorola’s code base and for which no public alternative exists can increase award payouts. Upper bounds are subject to budget constraints, however, we strive to supply researchers with proper and equitable funding for responsible disclosure. P2 │ Include non-immediate or less readily reproducible but demonstrably severe concerns for security, privacy, or business operation. These include, for example, crashes that could be bootstrapped into code execution, sensitive information leaks which require an APK to be installed on the device or some user interaction, and bypasses for high-visibility security protections such as the Thinkshield application platform. Exploits against security platform improvements and security features in this category must not be a known part of the versioning pipeline for the given component, i.e. if a mitigation is already in the development stage but not yet deployed or has been previously reported internally. │ Rewards for this category range from 1,337.00 to 2,500.00 USD , depending on the visibility and severity of the exploit. For example, an android protection bypass leveraging an infrequently used Motorola system service may have less of a reward than that same bypass for awidely-used component marketed as being for security, as the latter indicates a greater expectation of security to the end-user. P3 │ Include medium severity concerns to security, privacy, or business operation. These include non-trivial theft of some sensitive device information that would normally be protected by an SELinux policy or other mechanism, crashes in critical components or applications that cannot be readily bootstrapped into a more serious vulnerability or are prior to other protections, such as ASLR, ARM BTI, code integrity checks, or other application issuesnin bundled or pre-loaded applications managed by Motorola, such as unprotected broadcast receivers. │ Rewards for this category range from 300.00 to 750.00 USD, with the payout determined by the component affected, data leaked, any user interaction requirements, and other factors which may hinder or amplify the issue’s severity. P4 │ Present a low severity concern for security, privacy, or business operation. These include exploits such as HTML injection from an intent that is rendered to a non-critical page of a Motorola managed APK, cross-site-scripting attacks on non-critical web resources, and other issues that do present some potential concern but are likely not to be exploited in practice when compared to other vulnerabilities or do not need an immediate patch or incident response. │ Rewards for this category range from 100.00 to 200.00 USD if the vulnerability is something Motorola will fix and has not already been added to an internal issue tracker. P5 │ Issues that do not pose a security concern │ Unrewarded Credentials / Access Credentials are not needed to access any of the devices within the scope. Focus Areas Root priviledge Unauthorized access Bootloader Crash Bootloader Full Chain Bypass Subsidy Lock Bypass Device Financing Bypass Low-Level 0-Day (e.g. in Modem) Remote Sensitive User Data Breach Local Sensitive User Data Breach Rootkit Visible Application Bypass (e.g. ThinkShield) APK-Level Threat or Information Leak (e.g. implicit intents, unregistered broadcast receivers, poorly-protected content providers) Native application exploit, e.g. local web server or system service, crash or leak Other non-technical information leak Hardcoded credential or credential leak Exploit affecting build systems or code signing Exploit affecting DevOps system or internal tools Out-of-Scope Android related vulnerabilities Third party applications Vulnerabilities not directly related to Motorola. (Google, Android, Qualcom etc.) Report Format All reports should contain: A descriptive title A step-by-step guide on replicating the vulnerability A demonstrative proof-of-concept showcasing the vulnerability effectively, swiftly, and clearly, with any relevant reproduction output A precise and detailed account of the issue, including the device name and version A list of the components affected, e.g. APK file names, driver names, and versions A thorough root cause analysis explaining why the issue is happening and identifying the specific source code requiring patching for resolution Optionally, the report can also contain a proof-of-concept script, an artifact of the tool used to find the vulnerability, contact information, and a list of relevant, semicolon separated tags, e.g. “kernel module”. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.

In Scope (in scope)

Target information: All Motorola devices that are running Android 13 and above along with the most recent security patch are within scope of testing. Motorola Product List: Available Here