Google to pay bounties for Chrome browser bugs
Offers $500 for most vulnerabilities, $1,337 for 'particularly clever' flaws
Computerworld - Google yesterday announced a bug-bounty program that will pay researchers $500 for each vulnerability they report in the Chrome browser and its underlying open-source code.
In a post to the Chromium project's blog, Chris Evans, who works on the Chrome security team, said the base bounty would be $500, but that "particularly severe or particularly clever" bugs would reap rewards of $1,337 each.
The latter amount is a reference to "leet," a kind of geek-speak used by some researchers; there, "leet" is rendered as "1337."
New vulnerabilities in Chrome, Chromium -- the open-source project that Google uses to craft Chrome -- and plug-ins that ship with Chrome, such as Google Gears, are eligible for bounties, said Evans. Chrome OS is not part of the program at the moment, but it may be added in the future. Bugs that are ranked "high" or "critical" in Chrome's rating system get preference, he added, but others may be considered.
"While we have a bunch of great engineers at Google who spend their whole day trying to break into Chrome, we know there are lots of smart people outside of the company and we want their help too," Evans said in an e-mail reply to questions Friday. "We always know we can do more." About ten bugs submitted in 2009 would have been rewarded with a bounty payment had the program been in place, Evans added.
"Internet Explorer, Safari, Firefox...those browsers have been out there for a long time," said Pedram Amini, manager of the security research team at 3com's Austin, Tex.-based TippingPoint, which operates Zero Day Initiative (ZDI), one of the two best-known bug-bounty programs. "But Chrome, and now Chrome OS, need researchers. Google needs people to put eyes on the target."
Google's new bounty program isn't the first from a software vendor looking for help rooting out vulnerabilities in its own code, but it's the largest company to step forward, Amini said. Microsoft, for example, has traditionally dismissed any calls that it pay for vulnerabilities. "This will be beneficial to Google," Amini added. "There are actually very few vendors who play in the bounty market, but Google doing it is definitely interesting."
Both Amini and Google's Evans cited Mozilla's similar program as the first notable vendor-sponsored bounty. Mozilla kicked off a $500-per-vulnerability bounty in August 2004 that it is still in operation. The Mozilla program pays for bugs in the code used to create Firefox, Thunderbird and other open-source applications.
Mozilla declined to comment on Google's decision to pay bounties, or answer questions about the current status of its own bug bounty program.
- Mozilla ships Firefox 31, adds search to new tab page
- Microsoft's IE steps back from the brink of irrelevance
- Firefox falters, falls to record low in overall browser share
- Firefox risks user backlash by adding search box to new tab page
- Google unseats Microsoft as the U.S. browser powerhouse
- Safari, Chrome push to mask URLs
- Chrome on Windows champs at the 64-bit
- Google pulls trigger, cripples some Chrome add-ons
- Microsoft shoots to shorten Internet Explorer's long tail
- Firefox risks irrelevance as mobile browsing booms
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!