Nintendo offers $20,000 bounty for 3DS exploits

[Venustus]

Nintendo has launched a new bug bounty programme that offers rewards of up to £15,000 ($20,000) in exchange for vulnerability information regarding its handheld console, the 3DS.

Hosted by San Francisco-based HackerOne—a bug bounty platform created by security staff from Facebook, Microsoft, and Google—the programme invites researchers to find and address security vulnerabilities in the 3DS. These include "dissemination of inappropriate content to children," cheating methods like "save data modification," and of course piracy via "game application dumping" and "copied game application execution."

Nintendo also lists potential areas of investigation, including system vulnerabilities via "ARM11 kernel takeovers," and hardware vulnerabilities via "security key detection."

Those interested in nabbing one of Nintendo's rewards—which range from $100 all the way up to $20,000, depending on the vulnerability exposed—need to provide a description of the problem as well as proof-of-concept, or even functional code. Nintendo allows for code to be submitted up to three weeks after the initial report.

Notably, even if Nintendo doesn't offer a reward, the company holds a "worldwide, perpetual, irrevocable, non-exclusive, transferable, sublicenseable, fully-paid and royalty-free license" for any information submitted.

Nintendo's 3DS has been hacked several times over the years, allowing the console to run homebrew software, as well as pirated backup copies of games. One of the most famous exploits involved the obscure Ubisoft platformer Cubic Ninja, causing a jump in eBay prices for the game. Earlier this year, another exploit emerged, this time using the indie gravity-flipping platform game VVVVVV. It was swiftly pulled from the Nintendo eShop following the hack.

 

[tim one]

Admirable initiative, and I believe that also Sony should do the same!

 

[jamescv7]

Now that's what you call customer satisfaction point, something wrong on the product better fix it. No need for any whining arguments or denial.

Just give the deserving rights.

 

[JHomes]

*tosses cash to the ground*
"Yes, let them fight!"

 

[Wave]

Admirable initiative, and I believe that also Sony should do the same!

PS4 is much more secure than PS3 - I remember back in the days when I first started playing COD (was probably 10 or 11) on COD5 and I first bumped into a hacker, then they told me how to mod it and it was such an easy process... I think I had over 8 accounts banned but the console was never banned. I remember on PS3 you could modify inside components (e.g. with soldering and stuff) and un-ban the console but I never learnt to do this.

On PS4 jailbreaks are much less common IMO and much trickier, I doubt you'll find a hacker using god mode on BO3 or Infinite Warfare. While modding can be fun, it's a good thing it's harder as it can ruin game experience for others... Nothing worse than trying to kill an opponent who is invincible but ruins your stats!

When I did modding I didn't ruin other peoples games though, I did it in private matches for zombies... And writing your own mod menu's for console was always a fun thing to do, but it's been about 4 years so I can't remember a thing on it now.

Speaking of that, there's some guy on the Reddit forum for the BO area who works at Malwarebytes but he hides under a different identity and he solves the ciphers...