Whenever a customer, researcher or expert should identify one or more vulnerabilities in the following environments:
- TIM portals (i.e. www.tim.it, www.gruppotim.it, etc.)
- Mobile applications bearing the TIM logo and published on official stores (i.e. TIM Music, My TIM Fisso, TIM Telefono)
- Devices bearing the TIM logo (i.e. TIM Vision decoder, ADSL modem-router, etc. except for cellular phones)
- Equipment pertaining to TIM’s fixed-line or mobile network (i.e. routers, load balancers, etc.)
he or she can send the information to TIM following the procedure laid out below.
Using the following procedure, whoever informs TIM of a system vulnerability is required to make a responsible disclosure so as not to expose other clients to unnecessary security risks.
The reporting person must avoid performing any activity that can either disrupt the impacted system or service or cause any data leakage/loss, limiting his/her use of the system/service to the minimum necessary and refraining from accessing data not strictly necessary to prove the existence of the vulnerability. Any activity on the impacted system/service must be carried out in full compliance with the provisions of the present policy. Moreover, the use of intensive or invasive scanning tools is not allowed.
Responsible disclosure implies that the reporting person has not spied on or disclosed any third-party data without their consent.
Specifically, whoever activates the procedure must:
Send the information via email to responsible-disclosure@telecomitalia.it with the following details:
- Personal data (name, surname and, if applicable, organization for which the person works)
- The type of vulnerability identified
- The service/device/application impacted by the flaw
- A detailed description of the problem encountered
- IP address from which the vulnerability was identified, together with the date and time of discovery
- A compressed archive (zip) with all the files which can help in reproducing the flaw (i.e. images, screenshots, text files with description details, PoC, source code, scripts, pcap traces, logs, source IP addresses, …). The maximum dimension of the archive cannot exceed 10MB. If the archive is password protected please specify the password in the body of the mail.
- The consensus or not to sending your personal data to the producer, if available, of the technology involved for a possible direct contact between the parties.
- The consensus or not to being listed in the Hall of Fame section, together with an optional personal contact, if you want it to be mentioned alongside your Name and Surname.
- In activating the Responsible Disclosure procedure you may encrypt your mail using the following public key:
PGP key: 0x68DEAD71
Fingerprint: 0184D9E3E0CACB6F6E9A813BDE90CF9768DEAD71
Observe strict secrecy on all information pertaining to the vulnerabilities discovered, and therefore commit not to reveal any of these, entirely or partially, or in any form make them available to third parties for a period of not less than 90 days, allowing TIM the required time to identify and apply the necessary countermeasures. In especially complex cases, TIM reserves the right to extend this period, giving appropriate notice to whoever sent the information.
In the cases where the information regarding the vulnerabilities comes from a legal entity (public or private), corporation, consortium or other associative body, the sender must take the necessary steps to limit access to said information to those employees who require the use of the affected system for their work activities, enacting all suitable and appropriate measures to maintain confidentiality and abovementioned limits while accessing and using the information.
Once a notice has been received, TIM is committed to following up as follows:
- Send an email to the reporting person/entity to acknowledge reception of the mail with the information outlined above. Within 10 days from this confirmation TIM will send a second email with an evaluation of the relevance of the vulnerability and the results of an initial analysis.
- Adequately manage the vulnerability report so as to respect the timeline indicated previously and, in case of an eligible report on a vulnerability which is not already being handled, publicly thank the sender in the Hall of Fame section, if the necessary authorization accompanied the original mail.
TIM does not offer economic rewards; moreover, TIM reserves the right not to manage reports which do not respect the criteria indicated in this procedure.
TIM stresses the importance of assuming responsible behavior even after the release of any patch as the rollout process can be long and complicated. Therefore, we ask a careful evaluation of information released in this regard, with the objective of safeguarding user security.
Below you will find some examples of vulnerability categories which are considered eligible for publication in the Hall of Fame:
- Cross Site Scripting (XSS)
- Cross Site Request Forgery (CSRF)
- Injection (i.e. SQL injection, user input)
- Broken Authentication and Session Management
- Broken Access Control
- Security Misconfiguration
- Redirect / Man in the Middle attacks
- Remote code execution
- Underprotected API
- Privilege Escalation
On the other hand, the following situations are not covered by this Responsible Disclosure initiative and therefore are not eligible for the Hall of Fame:
- Situations which are not inherent to security aspects (i.e. unavailability of a service, bugs in a GUI, etc.) and therefore managed through traditional channels of customer care.
- Problems regarding phishing or spam and vulnerabilities inherent to social engineering techniques; these must be signaled either via email to abuse@telecomitalia.it or through the form available on
https://www.gruppotim.it/en/footer/form-abuse.html
- Results of automatic tools for vulnerability assessment/penetration testing (i.e. Nessus, nmap, …).
- Reports on the use of weak configurations of the TLS protocol, or reports on non-compliance with best practices, such as, for example, the lack of security headers.
TIM reserves the right to update this Responsible Disclosure procedure at any time.
