Ring
External Program
Submit bugs directly to this organization
Ring
We believe that stronger communities are the key to safer neighborhoods. That’s why we’re driven to create products that help you protect what matters most at home and empower you to connect with your neighbors from wherever you are. Together, we’ll make neighborhoods safer.
The Ring and BlinkForHome Bug Bounty Program is designed to recognize security research on our consumer electronics, associated devices, cloud services and web/mobile applications through bounty rewards. If you believe you have discovered a vulnerability impacting our devices and services, we encourage you to report it to us through this portal. Please review this page for our process, responsible research and disclosure policy, reward guidelines, and detailed scope of this program. We are committed to being responsive and keep you informed of our progress on the investigation.
In order to be eligible for a bounty reward, you must be the first to report an issue to us for assets outlined in scope. To ensure appropriate reward allocations, please provide a detailed report including - software version of device/application research was performed on, clear description of the issue, proof of concept (wherever applicable), along with detailed steps to reproduce the issue; you can optionally also provide patch/mitigation suggestions. We will acknowledge the receipt of the report, and in case of any additional questions, we will communicate and work with you through the HackerOne portal. Once the validity and severity of the reported issue has been confirmed, we will notify you through the HackerOne portal and allocate rewards based on the severity of the reported issue. Additionally, to be considered for a reward, you must comply with all parts of this policy, including the following requirements -
Please note that we will prioritize the remediation of the submissions based on the risk, customer impact, severity of the issue reported.
Violation of the above rules may result in forfeit of bounty eligibility, or further, disqualification from bounty program participation at Amazon/Ring's discretion.
**Not using a version hosted yourself, will result in complete forfeiture of any reward. **
If you find a bypass of a previous report you’ve created, or we ask that you create a new report due to the content being different enough, please fill out the Custom Field Bypass Reference with the original ID of the finding. This has no bearing on reward, it just helps Amazon with secondary data tracking.
##Creating Accounts for Vulnerability Research
Please create accounts using a HackerOne email to help us track security research activity. You can create accounts with Ring or Blink by using [email protected]
###In Scope Devices
The latest available software should be applied, old versions are out of scope.
###In Scope Services & Apps This program awards the vulnerabilities discovered on all Ring, and Blink backend services & apps available to customers and the supporting systems for delivery of those services (customer support, ordering, etc.). The Secondary focus of this program is on sites and services used for marketing or brand presence (i.e. main web site).
###In Scope Mobile Application Packages:
| Name | Android Package Name | Apple IOS App ID |
|---|---|---|
| Blink Home Monitor | com.immediasemi.android.blink | 1013961111 |
| Neighbors by Ring | com.ring.neighborhoods | com.ring.neighborhoods |
| Ring - Always Home | com.ringapp | com.ring |
###In Scope Application Domains
##Vulnerability Severity Ratings
The severity of a vulnerability generally reflects the security impact of the issue on the product. Please use the following description to determine the severity of reported issues. Please note there maybe additional vulnerabilities that are not explicitly called out in the below description, in such cases, Amazon/Ring/Blink reserves the sole discretion to determine the severity of the vulnerability based on security impact.
The Severity mentions below are a guideline, and not definitive. There may be situations where compensating controls or complexity of a finding increases or decreases severity.
###How we determine Device severity ratings
Note, issues that are demonstrated with ADB are generally accepted only if ADB is used to demonstrate a behavior that is possible to implement in an app.
Critical
Critical vulnerabilities may allow a remote attacker to gain control of the device or cause a permanent, unrecoverable device failure even after factory reset. Vulnerabilities that allow an attacker to perform remote or local bypass of critical security controls for example secure boot bypass fall into this category. Vulnerabilities that allow an attacker to perform arbitrary code execution, or remote access to sensitive assets on the device for example a device owner’s Amazon account credentials or authentication tokens, are also classified as critical vulnerabilities.
High
High severity vulnerabilities may allow temporary bypass of critical security controls through local access. This category includes vulnerabilities that could allow arbitrary code execution in an unprivileged process or local code execution in a privileged process with user interaction. Vulnerabilities that could allow local access to owner’s Amazon account or other sensitive data protected by device kernel or a privileged process fall into this category. Vulnerabilities that allow bypass of core security features such as mandatory access controls, sandboxing mechanisms or bypass user interaction requirements for device operations example, modifying privacy settings, or installing apps. Additionally, these vulnerabilities may include device bricking scenarios such as vulnerabilities that cause permanent, unrecoverable device failure even after factory reset with local access vector, and vulnerabilities that cause temporary device failure requiring a factory reset with remote access vector.
Medium Vulnerabilities that could allow a local attacker to cause temporary device failure requiring a factory reset with local access vector would be categorized as Medium severity. Protocol security weaknesses that allow observing of sensitive information through physical access are included in this category. Vulnerabilities that allow bypassing of exploit mitigations would also fall into this category. These vulnerabilities could have similar impact to High vulnerabilities but may require other vulnerabilities or user interaction.
Low Low security vulnerabilities that may not pose a direct security impact to customer or the device such as parental control bypasses.
Use following table to determine the severity ratings for web and mobile app vulnerabilities.
| Vulnerability | Severity Range |
|---|---|
| Remote Code Execution | Critical |
| SQL Injection | High - Critical |
| XXE | High - Critical |
| XSS | Medium - Critical |
| Server-Side Request Forgery | Low - Critical |
| Directory Traversal - Local File Inclusion | Medium - High |
| Authentication/Authorization Bypass (Broken Access Control) | Medium - High |
| Privilege Escalation | Medium - High |
| Insecure Direct Object Reference | Medium - Critical |
| Misconfiguration | Low - High |
| Web Cache Deception | Low - Medium |
| CORS Misconfiguration | Low - Medium |
| CRLF Injection | Low - Medium |
| Cross Site Request Forgery | Low - Medium |
| Open Redirect | Low - Medium |
| Information Disclosure | Low - Medium |
| Request smuggling | Low – Medium |
| Mixed Content | Low |
##Not In Scope Please do check whois record before you submit any issues on domains found from Subdomain Scanners. Ring/Blink use a number of third-party providers and services. Our bug bounty program does not give you permission to perform security testing on their systems. Vulnerabilities in third-party systems will be assessed case-by-case, and most likely will not be eligible for a reward. Direct attacks against any part of AWS infrastructure are explicitly out of scope.
###Non-qualifying Vulnerabilities This program does not award low severity, purely theoretical and best-practice issues. Here are some examples:
###Non-qualifying Vulnerabilities for Mobile Apps (Android & iOS) -
The goal of this program is to improve the security of our services for Customers. We do not reward, but will accept “Operational Security” (OpSec) submissions. OpSec issues include leaked employee passwords, leaked business documents, etc. These submissions will only receive reputation points.
Responsible Research and Disclosure Policy
We require that you -
While it is our goal to resolve the vulnerabilities reported to us in responsible timeframe, the vulnerabilities initially disclosed publicly or to a third party without our consent may not be eligible for rewards.
Safe Harbor
Amazon will not bring any legal action against anyone who makes a good faith effort to comply with program policies, or for any accidental or good faith violation of this policy. This includes any claim under the Digital Millennium Copyright Act (DMCA) for circumventing technological measures to protect the services and applications eligible under this policy.
As long as you comply with this policy:
Amazon cannot authorize any activity on third-party products or technology (including any third-party technology that is included in, or that interoperates with, Amazon products) or guarantee that third parties won’t pursue legal action against you. We aren’t responsible for your liability from actions performed on third parties or their technology.
Don’t do anything illegal or unethical. You are responsible for complying with local laws, restrictions, regulations, etc.