Mozilla hikes Firefox bug bounties to $3K
Increases payment for reported vulnerabilities six-fold
Computerworld - Mozilla on Thursday boosted bug bounty payments six-fold by increasing the standard cash award to $3,000.
The new bounty for vulnerabilities in Firefox, Firefox Mobile and Thunderbird is also six times the normal payment by Google for flaws in its Chrome browser, and more than double the maximum $1,337 that Google pays for the most severe bugs.
Mozilla and Google are the only browser makers that pay security researchers for reporting vulnerabilities in their products.
"A lot has changed in the six years since the Mozilla program was announced, and we believe that one of the best ways to keep our users safe is to make it economically sustainable for security researchers to do the right thing when disclosing information," said Lucas Adamski, director of security engineering. Mozilla kicked off its bounty program in August 2004.
In an e-mail reply to questions, Adamski later Friday said Mozilla picked $3,000 as the new bounty after talking to researchers, saying it was "a number that we felt would fairly compensate them for their efforts."
Only bugs that Mozilla ranks "crucial" or "high" -- its top two ratings -- are eligible for payment. In Mozilla's hierarchy, critical vulnerabilities are those that allow remote code execution; in other words, ones that when exploited give the attacker full control of the machine. High vulnerabilities are those that expose "high-value" personal information, such as usernames, passwords and credit card numbers. Denial-of-service flaws are not eligible for a bounty, Mozilla said.
Google launched its own cash-for-flaws program in January 2010, paying $500 for most bugs. Some vulnerabilities, however, earn their discoverer $1,000, or even $1,337, the latter given only to bugs that Chrome's team judge's "particularly severe or particularly clever."
Bugs in the Mozilla Suite, which the Mozilla Foundation dropped in 2005 -- will no longer be eligible for bounties, said Adamski. But vulnerabilities in Firefox Mobile, Mozilla's mobile browser, as well as any Mozilla services that Firefox or Thunderbird rely on for safe operation, are eligible.
Mozilla also added new language to its reward policy that gives it some new flexibility.
"Mozilla reserves the right to not give a bounty payment if we believe the actions of the reporter have endangered the security of Mozilla's end users," the revised guidelines now state.
Adamski noted that change in his blog posting, but did not elaborate. He also later declined to provide more information on the scenarios that might make Mozilla invoke the new clause.
Researchers may have questions for Mozilla about the new language, since the FAQ for the bounty program says that they don't have to wait for patches to be built and applied to, say, Firefox before they go public with their information.
- Workarounds to purge search bar from Firefox's new tab page are available
- Mozilla ships Firefox 31, adds search to new tab page
- Microsoft's IE steps back from the brink of irrelevance
- Firefox falters, falls to record low in overall browser share
- Firefox risks user backlash by adding search box to new tab page
- Google unseats Microsoft as the U.S. browser powerhouse
- Safari, Chrome push to mask URLs
- Chrome on Windows champs at the 64-bit
- Google pulls trigger, cripples some Chrome add-ons
- Microsoft shoots to shorten Internet Explorer's long tail
- Data Protection eGuide In this eGuide, CSO and sister publications IDG News Service, Computerworld, and CIO pull together news, trend, and how-to articles about the increasingly...
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!