Why We Want Researchers Looking at Our Products
By Louis Bester, Founder, CTO and Head of Security at Titan Secure.
Not everyone looking closely at our products is an attacker.
Some of the most useful people in security are the ones who find a weakness and tell the company that made it. They are security researchers, and today we are making it clear that we want to hear from them. Titan Secure now publishes a vulnerability disclosure policy.
Titan builds technology that can stop a vehicle from being driven away. A product with that kind of power has to be secured as carefully as it is built. We review and test our own work, but no company finds everything itself. If there is a weakness in something we make, I would much rather hear about it from a researcher than from an attacker.
What the Policy Covers
The policy covers our website and its subdomains, the Partner Service Dashboard, Halo, the Titan Secure Lifestyle App, our APIs, and Titan in-vehicle units that the researcher owns or is authorized to test.
It doesn't cover denial-of-service testing, social engineering or phishing of our staff or customers, physical attacks on our offices, or automated scanner output with no demonstrated impact. If you are not sure whether something is in scope, email us and ask before you test.
The Rule That Matters Most
Never send a command to a vehicle that is moving or that someone else is using.
Most disclosure policies are about data. Ours has to be about people on the road as well. A vehicle can be a family's car, a rental customer's ride home or a fleet driver's workplace. No finding is worth putting someone at risk to prove it, so the policy asks researchers to test only accounts, data and vehicles that are theirs or that they have permission to test, and never in a way that could put anyone on the road in danger.
The other rules are the ones you would expect: touch no more data than you need to show the issue, and give us a reasonable time to fix it before telling anyone else.
What We Promise
When you report a vulnerability to us, we will:
- acknowledge your report within 3 business days;
- give you our assessment within 10 business days;
- aim to fix confirmed issues within 90 days, and keep you updated along the way;
- credit you by name when we publish the fix, if you would like to be credited.
We don't offer cash rewards today. We do offer a fast, straight answer and the credit for your work.
What Happens After a Fix
When a confirmed issue affects our customers, we publish an advisory describing it once it is fixed, and we request CVE identifiers where they apply. An advisory says what was affected, what we changed and whether customers need to do anything. Researchers who want to be named are listed on our Security page.
Being open about what we fix is part of being trustworthy about what we build. I wrote about the same principle, applied to who can send a command to a vehicle, in Who Can Stop This Car?.
How to Reach Us
Email louis@titansecure.com with the affected product, the steps to reproduce the issue and its impact. Automated tools can find the same contact in our security.txt file.
Thank you to everyone who takes the time to look closely and tell us what they find.
For more from Titan Intel, read Relay Attacks, Key Cloning and GPS Jammers and Thefts Are Down 21%. Southern California Is Still Number One.
