Google patches 14 Chrome bugs, pays record $47K in bounties and bonuses
And it ships updated Flash Player before Adobe gets fixes into others' hands
Computerworld - Google yesterday patched 14 vulnerabilities in Chrome and handed out a record $47,500 in rewards to researchers, including $30,000 for "sustained, extraordinary" contributions to its bug-reporting program.
The record checks were cut just two days before Google will put up to $1 million on the line at CanSecWest, a security conference set to kick off Tuesday and run through Thursday.
Sunday's security update to Chrome 17 was the second for that version since it launched Feb. 8.
All 14 of the vulnerabilities patched yesterday were labeled "high," Google's second-most-serious threat ranking.
Ten of the bugs were tagged as "use-after-free" memory management vulnerabilities, a common type of bug reported by researchers, who continue to use Google's own memory error detection tool, AddressSanitizer, to sniff out flaws.
While the 14 bugs reported by four outside researchers earned them $17,500 in bounty payments, Google also rewarded three of them with surprise bonuses of $10,000 each for what it said was "sustained, extraordinary" work.
The three bonuses went to researchers Aki Helin and Arthur Gerkis, and to someone identified as "miaubiz." All three reported vulnerabilities that Google patched Sunday.
They also have been among the most prolific researchers for Google.
In 2011, for example, miaubiz earned more than $40,000 in bounties, while Helin took home $7,500 and Gerkis received $4,000.
"To determine the [$10,000] rewards, we looked at bug finding performance over the past few months," said Jason Kersey, a Chrome program manager, in a Sunday blog. "We have always reserved the right to arbitrarily reward sustained, extraordinary contributions. We reserve the right to do so again and reserve the right to do so on a more regular basis!"
So far this year, Google has paid nearly $73,000 to outside researchers.
It could lay out a lot more than that this week at CanSecWest, the Vancouver, British Columbia, security conference that opens tomorrow.
Last week, Google withdrew its sponsorship of the annual Pwn2Own hacking contest at CanSecWest, and instead said it would offer up to $1 million in cash prizes to researchers who demonstrate exploits of unknown Chrome vulnerabilities.
Google will pay $60,000 for what it called a "full Chrome exploit" -- one that successfully hacks Chrome on Windows 7 using only vulnerabilities in Chrome itself -- $40,000 for every partial exploit that uses one bug within Chrome and one or more in other software, and $20,000 for "consolation" exploits that hack Chrome without using any vulnerabilities in the browser.
The company has promised to pay out as much as $1 million, assuming it has that many takers.
Also included with Sunday's Chrome 17 was an update to Adobe Flash Player. Google again beat Adobe to the punch on delivering a Flash upgrade; Adobe is issuing a security update today that fixes two critical flaws in the popular media software.
Adobe credited two members of Google's security team, Tavis Ormandy and Fermin Serna, with reporting the Flash bugs.
Sunday's update to Chrome 17 can be downloaded for Windows, Mac OS X and Linux from Google's website. Users running the browser will be updated automatically through its silent service.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is firstname.lastname@example.org.
- Workarounds to purge search bar from Firefox's new tab page are available
- Mozilla ships Firefox 31, adds search to new tab page
- Microsoft's IE steps back from the brink of irrelevance
- Firefox falters, falls to record low in overall browser share
- Firefox risks user backlash by adding search box to new tab page
- Google unseats Microsoft as the U.S. browser powerhouse
- Safari, Chrome push to mask URLs
- Chrome on Windows champs at the 64-bit
- Google pulls trigger, cripples some Chrome add-ons
- Microsoft shoots to shorten Internet Explorer's long tail
Read more about Security in Computerworld's Security Topic Center.
- The Pivotal Big Data Suite- Reducing the Risks of Big Data The explosion of big data and the rapid evolution of big data tools and technologies is challenging IT to meet the demands of...
- A Survival Guide for Data in the Wild All corporate data used to reside in the data center. Safe and sound behind the corporate firewall. But now, employees have multiple devices...
- Transforming Security: Designing a State-of-the-Art Extended Team The information security mission is no longer about implementing and operating controls.
- The Big Data Security Analytics Era Is Here New security risks and old security challenges often overwhelm legacy security controls and analytical tools.
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!