Xfinity Home & xFi

Description

Program Overview At Comcast, we’re committed to working alongside the security research community, and know we’re at our best when we continually enhance this process. That's why we’ve launched Xfinity Home’s bug bounty and expanded the scope to include Xfinity xFi . With your help, we continue with our mission to make Xfinity products more secure. What is Xfinity Home? Xfinity Home is a total home security solution that includes professional monitoring and advanced technology, all installed by experts and powered by WiFi from Xfinity. What is xFi? Xfinity xFi lets you manage your home WiFi network and connected home. You can self-install and set up your WiFi environment in minutes, find your WiFi password, know who's online, view camera video, troubleshoot issues and manage family members' online experiences with features like Pause and Parental Controls. xFi Advanced Security helps keep you safe on sites people visit, prevent remote access from unknown sources, and report/block suspicious device activity with real-time app notifications. Please note, this program is specifically scoped for Xfinity Home and Xfinity xFi. If you believe you've found a security issue related to any other product or service(or are unsure) please report through our vulnerability disclosure program . Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, in some cases, a vulnerability priority will be modified due to its attack complexity, requirements, likelihood, or impact of successful exploitation. All submissions are reviewed to determine an accurate priority and any change will result in a detailed explanation provided to the researcher with the opportunity for a follow up. Rewards are determined through an internal impact assessment, researcher interaction and the overall quality, content, and accuracy of the report Reward Guidelines Rewards are determined through an internal impact assessment, researcher interaction and the overall quality, content, and accuracy of the report. High impact findings Comcast may reward eligible P1 submissions up to $10,000 for findings related to: Xfinity Home Remote unauthorized access (via publicly accessible internet, not on the same LAN/wireless network) of: Cloud storage videos Live camera feeds Bypassing Armed Systems Abuse/Theft of Service Xfinity xFi Abuse/Theft of Service Unauthorized access to WiFi credentials Unauthorized access to Profile’s Active Time Unauthorized access to Advanced Security settings or alerts VRT Amendments VRT Name │ Adjusted Priority High Impact Subdomain Takeover │ P2 -> P3 Basic Subdomain Takeover │ P3 -> P4 We welcome reports of XSS arising from Swagger-UI but regret to inform you that they do not qualify for a bounty. Such instances will be categorized as P5 Informational.

Targets

Exclusions The following assets are not yet eligible for bounty and should be reported through our vulnerability disclosure program . Target Info All submissions must have demonstrable impact on the Xfinity Home or xFi. To be able to test comprehensively, researchers must be a current Xfinity subscriber. Without an active Xfinity account, the available attack surface is highly limited - however, we encourage researchers to test with what is available to them. ​ Endpoint Details All Comcast/Xfinity endpoints called by Xfinity Home/xFi applications are in-scope. Custom User-Agent Header Please add the following header to your HTTP traffic to prevent interruptions and verify non-malicious behavior: X-Bug-Bounty: Xfinity Home │ Description xhomeapi-.codebig2.net │ API Gateway xhomeapi-.cloud.comcast.net │ API for fetching device information -cvr-aws-.sys.comcast.net │ Endpoints for CVR data *signalservice.comcast.net │ Endpoint for live video oauth.xfinity.com │ User Authentication api.sc.xfinity.com │ API for retrieving user information ​ Xfinity xFi │ Description internet.xfinity.com │ Website for xFi functionality siorc.xfinity.com │ Endpoint for mobile app orchestration speedtest.xfinity.com │ Used to determine Internet speed connection orc-xfi.com │ xFi orchestration layer smartinet.xfinity.com │ xFi orchestration layer ​ Xfinity Home Hardware/IoT Touchscreen Controller Windows/Door Sensors Wireless keypad Wireless motion sensors Xfinity Home Cameras Xfinity xFi Hardware │ Type xFi Gateways (e.g., XB3, XB6, XB7) │ Hardware xFi Pods │ Hardware Out of Scope Any domain/property of Comcast not listed in the targets section is out of scope for this bounty program. This includes any/all subdomains not listed above. If you believe you've identified a Comcast vulnerability on a system outside the scope of this program, please report it through our vulnerability disclosure program . The following is also out of scope of testing: COPS Monitoring Solutions Load Testing (DoS, DDoS, wireless jamming, etc.) Email spoofing issues (e.g., SPF, DKIM, DMARC) Automated scan reports without valid proof of concept Physical tampering of the device (I/O devices such as USB, SIM, and SD card slots are in scope) Submissions that require an attacker to physically open the case, including removing screws or breaking plastic casing (open chassis) to gain access to the internal hardware of a device. Vulnerabilities in pre-release product versions (e.g., Beta, Release candidate). Vulnerabilities in product versions no longer under active support. Vulnerabilities already known to Comcast. However, if you are the first external security researcher to identify and report a previously known vulnerability, you may still be eligible for a bounty award. Submissions that utilize third party websites or tools for cracking or validating secrets, passwords, keys or tokens. 3rd party integration For a running list, please refer to our Works with Xfinity page. 3rd party Marketing/Analytics endpoints Reports requiring a rooted/jailbroken device Duplicate/known submissions Social engineering attacks Theoretical security issues Protocol-specific flaws Rules Researchers must have explicit permission from the account owner to perform any form of security testing. ​ Note: This program adheres to Bugcrowd's coordinated disclosure terms . We ask that you provide us a copy of your disclosure report prior to publication and do not publicly report findings until they been fully remediated. If you believe a vulnerability is particularly sensitive, you may use our PGP key to encrypt your report. PGP Key: -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBGBeISUBEAC0HSrden41OvU/JV6TbyZ0vCrQrx2keOsCeX0I524BrQbQP/3d YLfDCZjaq0U2ZLwV+A/Mu8O+LEqKffOqyBEVCUVyh1Zjkmkp+Jk/FomaEwGj2KYD G5iyw0j+Cuu9S1HMrKozOJCGuJ3Aq9qn38n8vLy3spsnCIiKQpJMnYBAzKwDLuO+ 2JrQ7vpZ2ytW63mLcouQ9cKmA4W5OlD6gm7Fd63KYF7g+toxHw22ZXDT01fqAA9n zIOyoLZQcLMXAfddQuRklji65/cGhtPIVsBs2ZV9xJnn50VVvfc14P22nK9bZgf0 XoeBAL8LB+f7VIVTD/+X5ToA1BiFATbivxX3dZZwzGBMxROyFpMU2RCXwZj0NItj /YfO4DnG2K77WF9XKpeqt+D/KaV9WXd91GxTJgbjY7GRsGPEjLyGqAAZAvmBdO1p +Bc2cxIiQ9yhceVfreUOdNPwp5O1p9Z8NN48cM6J1mrm4473OqIm71BoWaoh2+wn UpwPtvQ95ZFSrPrDa9MNRieGB4/zGQkDCQegOFFD1uVF477ft8I0tNUaSc/Ixwpp Gj9ijY69Ra4I66CJGtGQ79VZ1xpML8RVROTKdbh9hvqBS1/pJiGBUtiPNg5iubvS PwmLcwowA6nRU3EYj+jMmje1pEHmcgcu7oMzaWH93EdFEzl1Av4kjnC4jwARAQAB tF1Db21jYXN0IFByb2R1Y3QgU2VjdXJpdHkgSW5jaWRlbnQgUmVzcG9uc2UgVGVh bSAoUFNJUlQpIDxzZWN1cml0eWRlZmVjdHJlcG9ydGluZ0Bjb21jYXN0LmNvbT6J Ak4EEwEIADgWIQQ/lltQ7aGclNQZCAinTPOe0kWI8gUCYF4hJQIbAwULCQgHAgYV CgkICwIEFgIDAQIeAQIXgAAKCRCnTPOe0kWI8uIOD/sHfn9sMRQYlzcCntyXA/jy mgkh2IdwNxOw5wG48m771AR1VFNr54dY3AgK74xPcFsiT6FUyMKrp72weyv/7/BW vOh3M2ff9VaZjWeN/L96I3mfHkzoyQ19vDhtc9MtXnZrybV8SvWFyOO0Ziu6gNSl ygBo4GjBIkAL32uRmqcyoUZTJJdDpLAM/m76lodEQ/ekC5JmJADOdK+BmVh4rJ4H bx8Uu+SseTQ0XjccqKYu+T4OxtgqmCLc2gvLpJH72XWDU0iKOyFW1BL4rqh2RTCj rn5xEYm3RBVfHjN+z/REuyNwcxcR0dqk5h9903XsYELIQO/tHyBRGxX3HKs+R0Sk GYLe/scyoETE91DnZSPrt3c3SrwOur5E8V0yNhGbADYwD6CVVPvIZcdUjusXFdjD KT/JfSU6MCqAD70CwBTIUcEobw22C0sGQuEO5ayC3EtdbYvcoAMKU1+TyYzJFPif GeQ+KU1Q94Mnc3uh9/nTL+w54IcYm4SzkTGOYqTQPYgdnlkV+kx14iBLfI54QmZS YrfY1cqb564W8bDtis9JLRm3yJ2a2q8bCadkuSGpJ3dM6cAYXtTSQeSTiWt3L3Ri Au6i2iimUF+TxMfIxUdwRsApTOBBGIDY4EPzWSFH8+Cb3SXYBAm6Bv5KXSplnEbg v5z7jnChE2TtUDQ6LM7bF7kCDQRgXiElARAAuPg110eFje7iJ+CWF3YPYlWydzt4 3syp0tzD+FNx22eiFxJufLONxSLBjpyFcRxixsQtGF1DV/88Ois1brDBkp7kAdpd X1c+ESBmqOXTsSy6/YCeD9kChzViS6T+9qUbJLLPG0GFclOrheLumh1RrrO5XRQd j+xcF0g/3oYZrWwUFfGHg0RxFp2zi+GODK5Ab7CSsDUkZxDCbGY608Mv/hy3W5GP pIty+B/i+J4OZJ4FCzgN8jCHNMftI1vMmWFbO4dljWboDf1rNxrbYSdMTCIaSYbi Gp+K+iucGabhDjo6mCAcjMM9wn/Mo+E/WeRrqHQmYqrSMfrCU/9xZHsbMlIkK+Xj CceWmUSNMVhm22qxn6AlQUI9h2jYV4wyYw4uD4vEnkUZiGM//DWCMX6YNNFfU6f/ 4YhIuctq7cv4RHWLW3/c1zHJsNq8r6uaTdYEtYBYWQvYvNj9/aNkuDnjA/TMHEH/ amND500m8HOEs7X6nHLsai/9ZpxUuAlgq+4UVKOX+qG5P+SDbeSUJEqBaCfbC8zE SQ5ngSro5et+bOsiC59JfwA/iRlSL5IfJpThIHMoI7SPWvwlQxBwLlfkiDBv0k0e w5uw07VDc32WVWg9OIMMwUL5NeMoX535Y6WEZYDPRSTMVy3doUcze+bdWnwzPLbd e/DyWjjHzoCwh00AEQEAAYkCNgQYAQgAIBYhBD+WW1DtoZyU1BkICKdM857SRYjy BQJgXiElAhsMAAoJEKdM857SRYjy/ZcP/AgQ611ciptmamHlYcwq3EsRTa050UN/ 9/Tw8KzPG5zRIrfgfJKJ90GMOtrAxGCj4Ysbm+oJpRB+M59TOBI+aFw+k4TO4LCq oaFPPHwLN9pg0Rg5nYnqm0rzCQHYC5iZYbTGnb5GxBW5wLCe+WtkUVLnoEShNEJU +Atqs5V34ZmpfzsEqCRlg9vJhodnpwZpYv5iGlqSEL4llfgRfga5P9VKBwjPCklx A3A6AXOxXDj1g1mR5DDOfE74aOIS6sB+jN7Fe4wBdF+SCgtuiOk0fr+D8xbMkGRy OrsUZZLnu534YreoUGxFnPp4svNp7HFnb1qCUnNdnDwPyeNsL1TKN3C6dqieNlbw og60fXUIZ5knYHiHm5BSEfzgVoHrykzq9DUT/fa9xLAxP381chLGTU9jSRDPIPeY 7YuLDh0pgCqoqQO/QkzsJPE8JyBke7iLFviczlhh31nH9V4dn23c3G5EWgyL3n5u S2lEuH14ieCh3Ql4lKD/hNhYEr3DTvrM3OKOgsGFKB+KMmorsT9ePWs2J6gA4dMA MQbCp6sSvxSM/lGKCZSgyRsuuWoWKRTqT7MhIhmea3AbyG5rzqLqw+aMGRiY3Uuc 6OwtW8m2ieGl4AyTUvfsIg+iE+al8FXAEFoN2rxtUFZvc8elpvSe6qkLxEAaSt3O g6h+SklSCYsx =Lfos -----END PGP PUBLIC KEY BLOCK----- Safe Harbor: We consider activities conducted consistent with any of the terms (the "Terms") of the Xfinity Home/xFi bug bounty program described on this page (the "Bug Bounty Program") to constitute “authorized” access under applicable anti-hacking laws. To the extent your activities are inconsistent with restrictions in our applicable terms and conditions governing use of our services, we waive those restrictions solely for the limited purpose of permitting security research under the Bug Bounty Program. We will not bring a claim against you for circumventing the technological measures we have used to protect the applications in scope provided such circumvention is conducted in the context of good faith security research in accordance with the Terms. We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of the Terms. For this safe harbor to be effective, researchers must comply with all applicable laws, and not disrupt or compromise any data beyond what this Bug Bounty Program permits. Please understand that if your security research involves the networks, systems, information, applications, products, or services of a third party (which is not us), we cannot bind that third party, and they may pursue legal action or give notice law enforcement. We cannot and do not authorize security research in the name of other entities, and cannot in any way offer to defend, indemnify, or otherwise protect you from any third-party action based on your actions. If legal action is initiated by a third party against you and you have complied with the Terms, upon being made aware of the foregoing, we may take steps to make it known that your actions were conducted in compliance with our policies. Please submit a report to us before engaging in conduct that may be inconsistent with or unaddressed by the Terms. Note: This program adheres to Bugcrowd's coordinated disclosure terms. We ask that you provide us a copy of your disclosure report prior to publication and do not publicly report findings until they been fully remediated.

███████████████ (in scope)

█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████ (out of scope)

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████