eero
External Program
Submit bugs directly to this organization
eero
#eero Program Policy
##Introduction The first mesh home wifi system, eero blankets any home in reliable and secure wifi. eero offers advanced online security tools, eero Secure and eero Secure+, to help protect personal data, devices, and networks from online threats. Founded in 2014 by Amos Schallich, Nate Hardison, and Nick Weaver, eero is an Amazon company.
The eero Bug Bounty Program is designed to recognize security research on our consumer electronics, and associated Devices and Services cloud services and web/mobile applications through bounty rewards. If you believe you have discovered a vulnerability impacting our devices and services, we encourage you to report it to us through this portal. Please review this page for our process, responsible research and disclosure policy, reward guidelines, and detailed scope of the eero Bounty Program. We are committed to being responsive and keep you informed of our progress on the investigation.
In order to be eligible for a bounty reward, you must be the first to report an issue to us for assets outlined in scope. To ensure appropriate reward allocations, please provide a detailed report including - software version of device/application research was performed on, device model (if applicable), clear description of the issue, proof of concept (wherever applicable), along with detailed steps to reproduce the issue; you can optionally also provide patch/mitigation suggestions. We will acknowledge the receipt of the report, and in case of any additional questions, we will communicate and work with you through the HackerOne portal.
To be considered for a reward, you must comply with all parts of this policy, including the following requirements:
Please note that we will prioritize the remediation of the submissions based on the risk, customer impact, severity of the issue reported.
##Rules of Engagement (Behavior)
Violation of the above rules may result in forfeit of bounty eligibility, or further, disqualification from bounty program participation at Amazon/eero's discretion.
##Rules of Engagement (Testing)
eeroResearcher_yourh1username while testingeeroResearcher_yourh1username may result in your account/IP getting blocked by automated protections. It can take time to reinstate these so please make sure to include it.cb is added as a cache buster to prevent any customer impact.
**Not using a version hosted yourself, will result in complete forfeiture of any reward. **If you find a bypass of a previous report you’ve created, or we ask that you create a new report due to the content being different enough, please fill out the Custom Field Bypass Reference with the original ID of the finding. This has no bearing on reward, it just helps Amazon with secondary data tracking.
Please create accounts using a HackerOne email to help us track security research activity. You can create accounts on eero by using [email protected]
In Scope Devices This Bug Bounty program covers all eero-branded or manufactured devices sold by eero or an authorized retailer. The eero device must be running the latest available software and must be listed on the ‘eero security updates’ page listed below and not have a date in the past.
Software Update Reference
In Scope Services & Apps: This program awards the vulnerabilities discovered on all eero backend services & apps available to customers and the supporting systems for delivery of those services (customer support, ordering, etc.). The Secondary focus of this program is on sites and services used for marketing or brand presence (i.e. main web site).
In Scope Mobile Application Packages:
| Name | Android Package Name | Apple IOS App ID |
|---|---|---|
| eero home wifi system | com.eero.android | 1023499075 |
In Scope Application Domains
The severity of a vulnerability generally reflects the security impact of the issue on the product. Please use the following description to determine the severity of reported issues. Please note there maybe additional vulnerabilities that are not explicitly called out in the below description, in such cases, eero reserves the sole discretion to determine the severity of the vulnerability based on security impact.
The Severity mentions below are a guideline, and not definitive. There may be situations where compensating controls or complexity of a finding increases or decreases severity.
Severity Ratings for Devices
Note, issues that are demonstrated with ADB are generally accepted only if ADB is used to demonstrate a behavior that is possible to implement in an app.
Critical
Critical vulnerabilities may allow a remote attacker to gain control of the device or cause a permanent, unrecoverable device failure even after factory reset. Vulnerabilities that allow an attacker to perform remote or local bypass of critical security controls for example secure boot bypass fall into this category. Vulnerabilities that allow an attacker to perform arbitrary code execution, or remote access to sensitive assets on the device for example a device owner’s Amazon account credentials or authentication tokens, are also classified as critical vulnerabilities.
High
High severity vulnerabilities may allow temporary bypass of critical security controls through local access. This category includes vulnerabilities that could allow arbitrary code execution in an unprivileged process or local code execution in a privileged process with user interaction. Vulnerabilities that could allow local access to owner’s Amazon account or other sensitive data protected by device kernel or a privileged process fall into this category. Vulnerabilities that allow bypass of core security features such as mandatory access controls, sandboxing mechanisms or bypass user interaction requirements for device operations example, modifying privacy settings, or installing apps. Additionally, these vulnerabilities may include device bricking scenarios such as vulnerabilities that cause permanent, unrecoverable device failure even after factory reset with local access vector, and vulnerabilities that cause temporary device failure requiring a factory reset with remote access vector.
Medium
Vulnerabilities that could allow a local attacker to cause temporary device failure requiring a factory reset with local access vector would be categorized as Medium severity. Protocol security weaknesses that allow observing of sensitive information through physical access are included in this category. Vulnerabilities that allow bypassing of exploit mitigations would also fall into this category. These vulnerabilities could have similar impact to High vulnerabilities but may require other vulnerabilities or user interaction.
Low
Low security vulnerabilities that may not pose a direct security impact to customer or the device such as parental control bypasses.
Use following table to determine the severity ratings for web and mobile app vulnerabilities.
| Vulnerability | Severity Range |
|---|---|
| Remote Code Execution | Critical |
| SQL Injection | High - Critical |
| XXE | High - Critical |
| XSS | Medium - Critical |
| Server-Side Request Forgery | Low - Critical |
| Directory Traversal - Local File Inclusion | Medium - High |
| Authentication/Authorization Bypass (Broken Access Control) | Medium - High |
| Privilege Escalation | Medium - High |
| Insecure Direct Object Reference | Medium - Critical |
| Misconfiguration | Low - High |
| Web Cache Deception | Low - Medium |
| CORS Misconfiguration | Low - Medium |
| CRLF Injection | Low - Medium |
| Cross Site Request Forgery | Low - Medium |
| Open Redirect | Low - Medium |
| Information Disclosure | Low - Medium |
| Request smuggling | Low – Medium |
| Mixed Content | Low |
Not In Scope Please do check whois record before you submit any issues on domains found from Subdomain Scanners. eero uses a number of third-party providers and services. Our bug bounty program does not give you permission to perform security testing on their systems. Vulnerabilities in third-party systems will be assessed case-by-case, and most likely will not be eligible for a reward. Direct attacks against any part of AWS infrastructure are explicitly out of scope.
Non-qualifying Vulnerabilities This program does not award low severity, purely theoretical and best-practice issues. Here are some examples:
Non-qualifying Vulnerabilities for Mobile Apps (Android & iOS) -
The goal of this program is to improve the security of our services for Customers. We do not reward, but will accept “Operational Security” (OpSec) submissions. OpSec issues include leaked employee passwords, leaked business documents, etc. These submissions will only receive reputation points.
We require that you -
While it is our goal to resolve the vulnerabilities reported to us in responsible timeframe, the vulnerabilities initially disclosed publicly or to a third party without our consent may not be eligible for rewards.
Amazon will not bring any legal action against anyone who makes a good faith effort to comply with program policies, or for any accidental or good faith violation of this policy. This includes any claim under the Digital Millennium Copyright Act (DMCA) for circumventing technological measures to protect the services and applications eligible under this policy.
As long as you comply with this policy:
Amazon cannot authorize any activity on third-party products or technology (including any third-party technology that is included in, or that interoperates with, Amazon products) or guarantee that third parties won’t pursue legal action against you. We aren’t responsible for your liability from actions performed on third parties or their technology.
Don’t do anything illegal or unethical. You are responsible for complying with local laws, restrictions, regulations, etc. To protect your privacy, we will not, unless served with legal process or to address a violation of this policy: