IoT安全的道德黑客行为：漏洞赏金计划和负责任的披露的初步研究
Ethical Hacking for IoT Security: A First Look into Bug Bounty Programs and Responsible Disclosure
摘要：
随着物联网安全事件的日益增多，物联网安全问题备受关注。物联网硬件和软件安全漏洞被利用，影响许多公司和个人。由于漏洞的原因超出了纯粹的技术措施，现在迫切需要揭开物联网“安全复杂性”的神秘面纱，并为公司，消费者和监管机构制定实用的指导方针。在本文中，我们提出了一项针对物联网中未探索领域的初步研究，阐明了众包道德黑客方法在增强物联网漏洞管理方面的潜力。我们专注于Bug Bounty Programs（BBP）和Responsible Disclosure（RD），这两个项目刺激黑客报告漏洞以换取金钱奖励。我们通过文献调查和专家访谈进行了定性调查，以探索BBP和RD如何以有效和具有成本效益的方式促进识别，分类，优先排序，修复和缓解物联网漏洞的实践。除了为物联网利益相关者制定切实的指导方针外，我们的研究还揭示了将BBP和RD与现有安全实践相结合的系统集成路径（例如，渗透测试），以进一步提高整体物联网安全性。
英文摘要：
The security of the Internet of Things (IoT) has attracted much attention due to the growing number of IoT-oriented security incidents. IoT hardware and software security vulnerabilities are exploited affecting many companies and persons. Since the causes of vulnerabilities go beyond pure technical measures, there is a pressing demand nowadays to demystify IoT "security complex" and develop practical guidelines for both companies, consumers, and regulators. In this paper, we present an initial study targeting an unexplored sphere in IoT by illuminating the potential of crowdsource ethical hacking approaches for enhancing IoT vulnerability management. We focus on Bug Bounty Programs (BBP) and Responsible Disclosure (RD), which stimulate hackers to report vulnerability in exchange for monetary rewards. We carried out a qualitative investigation supported by literature survey and expert interviews to explore how BBP and RD can facilitate the practice of identifying, classifying, prioritizing, remediating, and mitigating IoT vulnerabilities in an effective and cost-efficient manner. Besides deriving tangible guidelines for IoT stakeholders, our study also sheds light on a systematic integration path to combine BBP and RD with existing security practices (e.g., penetration test) to further boost overall IoT security.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
