Google calls, raises Mozilla's bug bounty for Chrome flaws
Boosts cash-for-bugs maximum payment to $3,133, makes researchers mostly happy
Computerworld - Google on Tuesday hiked bounty payments for Chrome bugs to a maximum of $3,133, up almost $2,000 from the previous top dollar payout of $1,337.
The move came less than a week after rival browser maker Mozilla increased Firefox bug bounties to $3,000.
In an entry to the Chromium project's blog, Chris Evans, who works on the Chrome security team, announced the new maximum bounty of $3.133.70 and said Google would "most likely" award that amount for all vulnerabilities rated "critical" in the company's four-step scoring system.
"The increased reward reflects the fact that the sandbox makes it harder to find bugs of this severity," said Evans, referring to the technology baked into Chrome that isolates processes from one another and the rest of the machine, preventing or at least hindering malicious code from escaping an application to wreak havoc or infect the computer.
When Google launched Chrome bug bounties last January, it set $1,337 as the maximum amount, but said that the biggest bounty would be awarded only to vulnerabilities it considered "particularly severe or particularly clever." The company has cut a check for that amount only once in the last six months.
Like the previous maximum, the new amount is playing with "leet," a kind of geek-speak used by some researchers. There, "eleet" -- for the correctly-spelled "elite" -- is rendered as "31337."
Evans said that the base reward for less serious bugs would remain at $500, but that the security engineers who evaluate reported vulnerabilities would "consider rewarding more for high-quality bug reports" that included an accurate explanation of the root cause or to a researcher who, as Evans put it, conducted a "productive discussion towards resolution."
Google has paid out $14,846 for 21 reported vulnerabilities since January.
Researcher Sergey Glazunov earned not only the sole $1,337 that Google's awarded so far, but made the most of any contributor: $3,337. Four researchers -- Glazunov, Aki Helin, a researcher identified only as "wushi," and another nicknamed "kuzzcc" -- accounted for 73% of the money Google has paid for bounties.
Not surprisingly, researchers applauded the potential to earn more from Google and Mozilla.
"Chrome ups the ante on bug bounties. A bidding war begins!" said Charlie Miller on Twitter Tuesday. Miller is a well-known vulnerability researcher, and the only one to take home cash prizes three years running at the Pwn2Own hacking contest held each spring in Vancouver, British Columbia. "Who shall we help find bugs for?"
"It's a real beneficial development, and not only for researchers," said Dino Dai Zovi, a security consultant and researcher who, with Miller and colleague Alex Sotirov, launched an effort they dubbed "No Free Bugs" last year.
- Google reverses field, promises to restore Chrome's scrollbar arrows
- Update: Google ships Chrome 33, patches 28 bugs
- Mozilla's top exec defends in-Firefox ads, revenue search
- Mozilla taps in-Firefox ads as it searches for more revenue
- Mozilla ships Metro Firefox beta for Windows 8
- Mozilla defers Firefox's new 'Australis' UI to April
- Mozilla resets Metro Firefox ship date to mid-March
- Mozilla ships Firefox 26 with opening click-to-play move
- Mozilla banked $274M in '12 from Google-Firefox search deal
- Google trumpets Chrome's SPDY gains
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Gartner Report: A Guide to Gartner's Enterprise Mobile Security Self-Assessment Gartner introduces a model and a Toolkit intended to help mobility and security IT leaders assess their enterprise mobility programs from a security...
- Gartner Report: Containing Mobile Security Risks With the 80/20 Rule IT planners can deliver better mobile protection with higher user satisfaction by segmenting users into risk groups before committing to specific management or...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts