AMD has denied a security researcher a $10,000 bug bounty despite the individual's work and cooperation with the company. Regulars at this pub might remember an article a while back about a security researcher who diagnosed a potential remote code execution (RCE) via a man-in-the-middle attack (MITM) in AMD's auto-updater software. Paul, the researcher, submitted a report at AMD's bug bounty program website, expecting both a fix and a payout for an RCE-class bug. The report was turned down as MITM attacks weren't covered by the program's policy. Nevertheless, Paul took down the blog post describing the situation due to AMD's request. It's now come back online, and the whole situation merits a facepalm or three.
First, the good news: the updater is now seemingly secured, and you if you download the latest version of AMD's software pack, you ought to get a fixed version. The road to this point has been far from smooth, though, and to this day, Paul seemingly never saw a dime for his efforts, a story that is becoming commonplace if Microsoft's issues with Nightmare-Eclipse are anything to go by. An RCE bug would otherwise be worth $10,000 if AMD fully acquiesced the significance of problem.
