Nintendo just paid off 3 people for the HackerOne Program

01b07c077f.png

Last year, Nintendo debutted its HackerOne program that involved giving a bounty of range of $100 - $20,000 to hackers that disclose their system exploits and vulnerabilities for the 3DS. Everyone thought it wouldn't work out for Nintendo, but just around last month the program was extended to include the Nintendo Switch too.

Just recently as you can see in the picture, three people were rewarded so far, however the amounts paid will not be made public. It seems as if a few hackers wouldn't mind giving out their newfound exploits for some easy cash, hopefully for the sake of the Switch hacking scene, it isn't the same with our own resident hackers.

A few examples of what information Nintendo is interested in receiving:
  • System vulnerabilities regarding Nintendo Switch
    • Privilege escalation from userland
    • Kernel takeover
    • ARM® TrustZone® takeover
  • Vulnerabilities regarding Nintendo-published applications for Nintendo Switch
    • Userland takeover
  • System vulnerabilities regarding the Nintendo 3DS family of systems
    • Privilege escalation on ARM® ARM11™ userland
    • ARM11 kernel takeover
    • ARM® ARM9™ userland takeover
    • ARM9 kernel takeover

:arrow:Source
 
Last edited by Chary,

sarkwalvein

There's hope for a Xenosaga port.
Member
Joined
Jun 29, 2007
Messages
8,506
Trophies
2
Age
41
Location
Niedersachsen
XP
11,221
Country
Germany
LOL, hadn't seen this before. First feeling I got was those people are nothing but cheap whores... on second thought though, that's not really fair to anyone who has to prostitute themselves, they're way better than those three people.
Entitled much?
 

MagnesG

GBAtemp Lurker
Member
Joined
Sep 11, 2016
Messages
432
Trophies
0
XP
1,972
Country
United States
LOL, hadn't seen this before. First feeling I got was those people are nothing but cheap whores... on second thought though, that's not really fair to anyone who has to prostitute themselves, they're way better than those three people.

Bah. The dog barks more than it should. Scum of earth like you should be proud having the nerve to bash someone you'll never be like. Might as well prove yourself by posting your own exploit on this site, see how the community treat you like faggots, then maybe you can bark more.

I can't even fathom what kind of attitude yours in irl. You'll never rest in peace with your conscience.
 
  • Like
Reactions: NekoMichi

Kioku

猫。子猫です!
Member
Joined
Jun 24, 2007
Messages
12,003
Trophies
3
Location
In the Murderbox!
Website
www.twitch.tv
XP
16,127
Country
United States
LOL, hadn't seen this before. First feeling I got was those people are nothing but cheap whores... on second thought though, that's not really fair to anyone who has to prostitute themselves, they're way better than those three people.
Entitled little twats like you are why I hope we never get a public exploit for the Switch. Your attitude is pathetic and selfish. What's better is I hope a fake exploit is released and you brick your system.
 

goldensun87

Well-Known Member
Member
Joined
Jan 24, 2017
Messages
343
Trophies
0
Age
29
XP
737
Country
United States
Can't the hackers just tip off the community, before submitting their findings to Nintendo? That way, they still get paid, and we know not to update until the exploits are released.
 

dubbz82

Well-Known Member
Member
Joined
Feb 2, 2014
Messages
1,572
Trophies
0
Age
41
XP
1,215
Country
United States
Can't the hackers just tip off the community, before submitting their findings to Nintendo? That way, they still get paid, and we know not to update until the exploits are released.

I believe this probably puts them in the breach of contract territory according to nintendo's terms of use, and potentially open to a lawsuit, so likely not.
 

Kioku

猫。子猫です!
Member
Joined
Jun 24, 2007
Messages
12,003
Trophies
3
Location
In the Murderbox!
Website
www.twitch.tv
XP
16,127
Country
United States
I believe this probably puts them in the breach of contract territory according to nintendo's terms of use, and potentially open to a lawsuit, so likely not.

If they don't release the exploit, and aren't tied to the public release, Nintendo can't do anything.
 

Toni456

Well-Known Member
Member
Joined
Oct 31, 2012
Messages
344
Trophies
1
XP
490
Country
Australia
What if a team is working on a bug and one person then sells out, rest of the team is under no such obligation.
If one person from a group reports a bug then it's their own fault and have to take full responsibility.

What if you go to a public access point somewhere create some fake account and release, good luck proving anything.
It's not as hard as you're making it out to be, if someone reports a bug and then releases it not long after under a fake name it's quite obvious who it was, the IP could also be given to them depending on how it escalates which would then be tracked back to the location of the public computer used to leak it and all they'd need then is camera footage but even then they might just simply not pay you altogether as even if you report something that isn't known nintendo does NOT have to pay anything, it's up to them to decide if they want to or not.

If they don't release the exploit, and aren't tied to the public release, Nintendo can't do anything.
Actually all submitted entries will be denied if anything about it is public, unless you're like "oh hey so the system settings is vulnerable guys don't update!" but if you go into any small details about how or where exactly the exploit is hidden then there is no chance to submit to nintendo and expect to be paid, i also expect some kind of delay before been paid to avoid exploitation of the system.
 
Last edited by Toni456,

omegasoul6

ಠ_ಠ
Member
Joined
Aug 16, 2007
Messages
515
Trophies
1
Location
Toronto
XP
1,090
Country
Canada
LOL, hadn't seen this before. First feeling I got was those people are nothing but cheap whores... on second thought though, that's not really fair to anyone who has to prostitute themselves, they're way better than those three people.

This isn't your normal everyday entitlement...
This is advanced entitlement.
 
  • Like
Reactions: GerbilSoft

TVL

#|
Member
Joined
Feb 17, 2004
Messages
577
Trophies
2
Location
World -1
XP
2,301
Country
Sweden
This is perhaps the worst attitude to have.

As @FAST6191 said, there is a possibility that these weren't meant for homebrew entries, but rather weapon hacks. Such as viruses or other things. I can tell you that I would much rather see people sell their exploits. $500 is more than they will ever make developing for an ungrateful, demanding community. Smea & Crew are gracious enough to develop any exploits.

Your kind is the reason I hate the hacking community.

Relax, I was just trying to be funny. I don't care that these people found vurnabilities and reported to Nintendo, that's their own decision and doesn't effect me in the least.

And this is a prime example why GBATemp is laught at by the console hacking community.

I think there are a few other reasons, but ok.

Bah. The dog barks more than it should. Scum of earth like you should be proud having the nerve to bash someone you'll never be like. Might as well prove yourself by posting your own exploit on this site, see how the community treat you like faggots, then maybe you can bark more.

I can't even fathom what kind of attitude yours in irl. You'll never rest in peace with your conscience.

Lol, scum of the earth. You really got angry. And you are correct, I will never be something I don't want to be. It's weird how that all works.

Entitled much?

...

This isn't your normal everyday entitlement...
This is advanced entitlement.

...

Entitled little twats like you are why I hope we never get a public exploit for the Switch. Your attitude is pathetic and selfish. What's better is I hope a fake exploit is released and you brick your system.

I don't even have a Switch, so your first have to wish that I get one. ;)

Entitled seems like a very popular word these days. But you all felt entitled to call me entitled I guess.
 

goldensun87

Well-Known Member
Member
Joined
Jan 24, 2017
Messages
343
Trophies
0
Age
29
XP
737
Country
United States
It should definitely be possible to avoid breaching a contract. The hackers who find the exploits, pass the info down to someone relatively unrelated, tell them not to go into any specific details, only to inform the community to refrain from updating for a while. Said hackers submit their findings to Nintendo, get paid, THEN work on releasing the exploits to the public. In fact, I believe something like that went down with UDSploit. The timing of its release, and the release of the system update which patched it, cannot be a coincidence. Nintendo can't do shit about it. What are they going to do, ban the very people they need to uncover exploits in record time? I don't think so, this move by Nintendo has proven that their official staff is barely competent enough to find such exploits fast enough.
 

barronwaffles

Well-Known Member
Member
Joined
May 15, 2014
Messages
344
Trophies
0
XP
1,150
Country
Syria
Endergamer549 is PokeAcer https://gbatemp.net/members/pokeacer.366315 (proof here http://i.imgur.com/EHLU8fN.png http://i.imgur.com/4S7fDSM.png)
he stole a New3DS browser update bypass someone entrusted him with and sold it to ninty, to buy things for himself. He changed his irl name on hackerone after the bounty to avoid being busted


Human filth.

--

Just to clarify - No issues with doing whitehat work for Nintendo, but selling an exploit someone trusted you with? Fucking low.
 
Last edited by barronwaffles,

TVL

#|
Member
Joined
Feb 17, 2004
Messages
577
Trophies
2
Location
World -1
XP
2,301
Country
Sweden
I realized I got triggered. I'm sorry.

No need to apologize, I think everyone has become angry about what a stranger on the internet has typed at some point, I know I have. And I wasn't offended. The joke was obviously not a good one when everyone took it seriously (or just didn't think it was funny).
 

g00s3y

Well-Known Member
Member
Joined
Aug 6, 2008
Messages
841
Trophies
1
Age
38
Location
FL
XP
2,783
Country
United States
The amount of whiny entitled children in this thread is hilarious. I wonder how many people on here wouldn't even have a switch if it wasn't for their parents buying it for them...
 
  • Like
Reactions: goldensun87

SweetieBelle

Well-Known Member
Newcomer
Joined
Aug 20, 2012
Messages
96
Trophies
0
XP
143
Country
I wouldn't be surprised if that is fake and Nintendo is attempting to encourage people to reveal exploits by artificially "leading by example". I highly doubt they are part of the "community", more likely Nintendo staff or people hunting for exploits for profit. I think we are going to see more of the latter in coming years.

If they allowed more customisation and weren't so strict there's be less people out there hacking the consoles. I find it obscene that we cannot even make our own themes without hacks and exploits. There's so many features Nintendo never included, but should have. We exploit for a reason, Nintendo could easily reduce the list of reasons and make a more desirable console.
 

barronwaffles

Well-Known Member
Member
Joined
May 15, 2014
Messages
344
Trophies
0
XP
1,150
Country
Syria
I wouldn't be surprised if that is fake and Nintendo is attempting to encourage people to reveal exploits by artificially "leading by example". I highly doubt they are part of the "community", more likely Nintendo staff or people hunting for exploits for profit. I think we are going to see more of the latter in coming years.

If they allowed more customisation and weren't so strict there's be less people out there hacking the consoles. I find it obscene that we cannot even make our own themes without hacks and exploits. There's so many features Nintendo never included, but should have. We exploit for a reason, Nintendo could easily reduce the list of reasons and make a more desirable console.

Bug/exploit bounties are nothing new.
 

barronwaffles

Well-Known Member
Member
Joined
May 15, 2014
Messages
344
Trophies
0
XP
1,150
Country
Syria
I'd hope so - a career prospect and financial benefits is a fanatic contrast to the 'rewards' provided by the scene community.

Also, the notion of this being fake is quashed by the fact you already have characters like PokeAcer selling exploits discovered by other people.
 

SweetieBelle

Well-Known Member
Newcomer
Joined
Aug 20, 2012
Messages
96
Trophies
0
XP
143
Country
Can't the hackers just tip off the community, before submitting their findings to Nintendo? That way, they still get paid, and we know not to update until the exploits are released.

Typically that would cost, literally. Zero day exploits are where the money is and you can be sure they have to sign a non disclosure agreement before collecting the bounty. Perhaps there is even a few month waiting period before you get paid. I am not aware of the finer points of the scheme. Perhaps, once the patch is out, and if there's no evidence the reporter leaked it, they get paid. It makes sense Nintendo would pull something like that.

If they release it, it is not beyond the realms of reason that Nintendo would sue them for losses if they can prove they released it. (I would imagine the local law enforcement would cooperate wholly and the computer would be seized and searched for evidence)

Of course, one can post relatively anonymously and leave no breadcrumbs, but it is very likely a patch would already be out before leaking, eliminating anyone who updated from the benefits of the exploit.


I'd hope so - a career prospect and financial benefits is a fanatic contrast to the 'rewards' provided by the scene community.

Also, the notion of this being fake is quashed by the fact you already have characters like PokeAcer selling exploits discovered by other people.

They publicise it for a reason, I would not put it past them to lie and embellish.

Encouraging exploit hunting is a two edged sword of course, and I look forward to many new exploits courtesy of such programs. :grog:
 
Last edited by SweetieBelle,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    SylverReZ @ SylverReZ: Sup