Nintendo, the Japan-based multinational video game company, collaborated with HackerOne, a California- based cyber security company, to discover possible weakness to all "Nintendo 3DS" family of systems. A minimum bounty of $100 up to $20,000 is awarded to the first reporter of any of the vulnerabilities specified.
On the notification program posted by Nintendo on HackerOne, it specifically stated that Nintendo is only interested in discoveries done on "Nintendo 3DS" family of systems. The loopholes that Nintendo wants to be covered include "system vulnerabilities on Nintendo 3DS family of systems" such as privilege escalation on ARM11 userland, ARM11 kernel takeover, ARM9 userland takeover, and ARM9 kernel takeover. Hardware vulnerabilities are also appreciated such as low-cost cloning and security key detection on information leaks. Another aspect that Nintendo wants to have information are the Nintendo-published apps for the Nintendo 3DS family system especially the ARM11 userland takeover.
Nintendo and its trademark have always been a favorite for professional researchers mostly for fun. Just recently, the "New Super Luigi U Community" has been a victim of some harmless hacks that includes a change on the banner and an edited profile pic of Luigi. It caused a few ruffles to the members of the community but was immediately taken cared of by Nintendo Representatives. Another example of Nintendo's weakness of their software design is the existence of the R4 card and the homebrew 3DS games.
According to sources, this move of "Nintendo 3DS" to ask the help of the "world's finest researchers" is a good one. Many companies have been relying on HackerOne when improving the design and security of their system. World-known companies such as Airbnb, Twitter, and Dropbox are just some of the client of HackerOne.
What can you say about the "Nintendo 3DS" collaboration with HackerOne? Leave your comments and insights below.
