Google patches 14 Chrome bugs, pays record $47K in bounties and bonuses
And it ships updated Flash Player before Adobe gets fixes into others' hands
Computerworld - Google yesterday patched 14 vulnerabilities in Chrome and handed out a record $47,500 in rewards to researchers, including $30,000 for "sustained, extraordinary" contributions to its bug-reporting program.
The record checks were cut just two days before Google will put up to $1 million on the line at CanSecWest, a security conference set to kick off Tuesday and run through Thursday.
Sunday's security update to Chrome 17 was the second for that version since it launched Feb. 8.
All 14 of the vulnerabilities patched yesterday were labeled "high," Google's second-most-serious threat ranking.
Ten of the bugs were tagged as "use-after-free" memory management vulnerabilities, a common type of bug reported by researchers, who continue to use Google's own memory error detection tool, AddressSanitizer, to sniff out flaws.
While the 14 bugs reported by four outside researchers earned them $17,500 in bounty payments, Google also rewarded three of them with surprise bonuses of $10,000 each for what it said was "sustained, extraordinary" work.
The three bonuses went to researchers Aki Helin and Arthur Gerkis, and to someone identified as "miaubiz." All three reported vulnerabilities that Google patched Sunday.
They also have been among the most prolific researchers for Google.
In 2011, for example, miaubiz earned more than $40,000 in bounties, while Helin took home $7,500 and Gerkis received $4,000.
"To determine the [$10,000] rewards, we looked at bug finding performance over the past few months," said Jason Kersey, a Chrome program manager, in a Sunday blog. "We have always reserved the right to arbitrarily reward sustained, extraordinary contributions. We reserve the right to do so again and reserve the right to do so on a more regular basis!"
So far this year, Google has paid nearly $73,000 to outside researchers.
It could lay out a lot more than that this week at CanSecWest, the Vancouver, British Columbia, security conference that opens tomorrow.
Last week, Google withdrew its sponsorship of the annual Pwn2Own hacking contest at CanSecWest, and instead said it would offer up to $1 million in cash prizes to researchers who demonstrate exploits of unknown Chrome vulnerabilities.
Google will pay $60,000 for what it called a "full Chrome exploit" -- one that successfully hacks Chrome on Windows 7 using only vulnerabilities in Chrome itself -- $40,000 for every partial exploit that uses one bug within Chrome and one or more in other software, and $20,000 for "consolation" exploits that hack Chrome without using any vulnerabilities in the browser.
The company has promised to pay out as much as $1 million, assuming it has that many takers.
Also included with Sunday's Chrome 17 was an update to Adobe Flash Player. Google again beat Adobe to the punch on delivering a Flash upgrade; Adobe is issuing a security update today that fixes two critical flaws in the popular media software.
Adobe credited two members of Google's security team, Tavis Ormandy and Fermin Serna, with reporting the Flash bugs.
Sunday's update to Chrome 17 can be downloaded for Windows, Mac OS X and Linux from Google's website. Users running the browser will be updated automatically through its silent service.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is email@example.com.
- IE6: Retired but not dead yet
- Chrome users won't give up, keep pressing Google to restore old-style new tab page
- Google quashes 31 vulnerabilities, restores Metro mode 'steppers' with Chrome 34
- Firefox's UI face-lift on track for April debut
- Ex-Mozilla engineer blames Microsoft's rules for Metro Firefox's death
- Mozilla patches 20 Firefox flaws, plugs Pwn2Own holes
- Google reverses field, promises to restore Chrome's scrollbar arrows
- Update: Google ships Chrome 33, patches 28 bugs
- Mozilla's top exec defends in-Firefox ads, revenue search
- Mozilla taps in-Firefox ads as it searches for more revenue
Read more about Security in Computerworld's Security Topic Center.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts