TIDAL

Description

Block, Inc. This program is part of Block, Inc. You can participate in our other bug bounty programs below: Square Cash App Afterpay Block Open Source Serious about security We adhere to industry-leading standards to manage our network, secure our web and client applications, and set policies across our organization. Part of our mission at TIDAL is to protect the information of our customers and artists. To do that we need to proactively find and fix any security issues in our software offerings. We recognize the important contributions the security research community can make and hope that you’ll help us protect our customers and artists.

Targets

Any domain/property of Block (including TIDAL) not listed in the targets section is out of scope. This includes any/all subdomains not listed under “Target information”. Target Information: tidal.com and any subdomains wimpmusic.com and any subdomains tidalhifi.com and any subdomains tidalhi.fi and any subdomains tdl.sh and any subdomains TIDAL Desktop Client (Electron application) TIDAL Client for iOS: Here TIDAL for Android: Here Any other official TIDAL clients for any platform. If you’re unsure whether a client is official, please contact us for clarification before beginning work. Access: Please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here Focus Areas: Flaws within authentication or authorization workflows, especially Vulnerabilities that might expose personal information Vulnerabilities that might expose unauthorized content Rules of Engagement Testing or messaging live Artist accounts is an automatic program expulsion. Do not reach out to other TIDAL artists or users unless it’s an account you own. If you are able to access or modify personal data of TIDAL customers or other sensitive data, immediately contact Block - do not attempt to conduct post-exploitation work. Do not use, share, publish, or disclose information obtained in the course of identifying issues. After submitting you must delete, purge, and/or destroy all copies of information or digital samples. Do not attempt a denial-of-service attack without prior written approval. Please contact [email protected] for any concerns or escalations. Do not contact TIDAL directly or other Block product lines. Doing so can result in point reduction or program expulsion. Subdomain Takeovers Findings for subdomain takeovers are sorted by risk category. Please review the severity and descriptions below before submitting a report. Impact │ Severity │ Reward │ Description High Impact Subdomain Takeover │ P2 │ $1,500 │ Awarded for domains and subdomains with reputational or technical risk. Also for subdomains under a parent domain with reputational or technical risk, and access to sensitive data on that parent domain. Basic Subdomain Takeover │ P3 │ $250 - $500 │ Awarded for domains and subdomains under a parent domain with reputational or technical risk, but without access to sensitive data on that parent domain. Concession award │ P4 │ $100 │ Awarded for domains and subdomains that are owned by Block and have no risks except publicity risk (which is inherent in ownership). Known Issues: Member addition to family: Ability to create accounts without proof of email address control. Plain text password in email. Secrets embedded in application code (web, mobile or desktop). TIDAL client embeds a key to allow Last.FM scrobbling. Lack of certificate pinning enabling man-in-the-middle attack. No subscription is needed to play music. TIDAL has a free tier that allows clients to play music even without a paid subscription, as long as they are logged in. Personal accounts with @tidal.com addresses are not considered Admin/Employee accounts. Leaked credentials found via a web archive or info stealer are considered out of scope . Playlists are explicitly left out of the block functionality. They are still accessible via uuid/shared url/favorites tab. TIDAL app geo-restriction bypass. Out of Scope bugs for Android apps: Information leaked through the system clipboard Susceptibility to MITM attacks (e.g. Absence of certificate pinning or sensitive data in URLs or request bodies when protected by TLS) Sensitive data stored in app private directory Sensitive data stored unencrypted on external storage Lack of code obfuscation or anti-debugging controls Recoverable secrets hard coded in APK (e.g. OAuth "app secret") Hijacking or installing a third-party app to attack the TIDAL platform Out of Scope bugs for iOS apps: Information leakage through Snapshot/Pasteboard Susceptibility to MITM attacks (e.g. Absence of certificate pinning Sensitive data in URLs or request bodies when protected by TLS) Sensitive data stored unencrypted on the file system Lack of code obfuscation or anti-debugging controls Recoverable secrets hard coded in app binary (e.g. OAuth "app secret") Lack of exploit mitigations ie PIE, ARC, or Stack Canaries Lack of jailbreak detection Exploits only possible in a jailbroken environment Hijacking or installing a third-party app to attack the TIDAL platform Out of Scope for Tidal & related subdomains Cache poisoning resulting in DoS Third Party Vendor Policy: Third party submissions will be considered Out of Scope. With that said, if you believe you’ve identified an issue with one of our third-party service providers as the result of Tidal’s misconfiguration or insecure usage of that service, we’d appreciate your report regarding the issue. Please keep in mind that any reports regarding third-party services are likely to NOT be eligible for a reward – both cash and Kudos points. Disclosure Procedures Block recognizes the important contributions the security research community can make. We do not publicly disclose vulnerabilities by default. We take the security of our services very seriously and monitor their use for indications of a malicious attack. In order to distinguish legitimate security research from malicious attacks against our services, we promise not to bring legal action against researchers who: Share with us the full details of any problem found. Do not disclose the issue to others until we’ve had a reasonable time to address it and disclosure has been approved by us. Do not intentionally harm the experience or usefulness of the service to others. Never attempt to view, modify, access, disclose, exfiltrate, use or damage data belonging to Block, its customers, or others. Do not perform any research or testing in violation of the law. Submission Quality Detailed steps for reproducing the bug. If valuable, please include any screenshots, links you clicked on, pages visited, etc. We prefer detailed repro steps and video demos. Describe the versions of all relevant components of the attack (e.g. browser, OS, mobile app version). Describe a concrete attack scenario. How will the problem impact TIDAL, its users, or content providers? Put the problem into context and demonstrate with clear evidence. Please group related issues into the same report rather than submitting nearly-identical reports. For example, an authorization bypass might affect a handful of endpoints. Multiple Submissions of the Same Vulnerability We ask that researchers who identify the same or similar types of issues in multiple locations throughout an application combine those findings into a single submission whose description includes the locations where the issues were identified. This greatly assists us in our triage process and allows us to process your submissions faster. The combined submission will be evaluated holistically and will be rewarded corresponding to the collective findings. For example, if an application is discovered to have broken access control on a number of API endpoints, please submit a single submission that includes a list of those API endpoints. If separate submissions are made, they may be inadvertently closed as duplicates. OpenPGP key If you have data that you feel is particularly sensitive and would like to encrypt before sending it to our bug bounty, please use the following OpenPGP key for encryption: https://tidal.com/.well-known/pgp-key.txt Write this key to a file (ie tidal-public.key) Then import it: gpg --import tidal-public.key Encrypt your report (ie report-tidal-security.docx): gpg --output report-tidal-security.docx.gpg --encrypt --recipient [email protected] report-tidal-security.docx Send your encrypted report to us by email at [email protected].