Google boosts bonuses for Chrome bug bounty hunters
Willing to pay more to shake out harder-to-find flaws
Computerworld - Google yesterday boosted payments to researchers for reporting bugs in Chrome, saying the move was prompted by a decline in vulnerabilities submitted by outsiders.
"Recently, we've seen a significant drop-off in externally reported Chromium security issues," Chris Evans, a Chrome software engineer, said in a Tuesday post to the Chromium Blog. "This signals to us that bugs are becoming harder to find."
Evans outlined new bonuses that Google will award researchers who report certain kinds of flaws. All the bonuses start at $1,000 but can climb from there.
Google will add the bonuses to the base payments -- which range from $500 to $3,133 -- for bugs that are "particularly exploitable," found in the more bug-free sections of Chrome's code, and for vulnerabilities that affect more than just the browser.
In the past, Google has written bonus checks for up to $10,000 for what it calls "particularly significant contributions." Those bonuses have been reserved for long-running reporting. Last March, for example, Google awarded three of its most prolific bug submitters $10,000 each.
The big-dollar bonuses remain in play, said Evans, and will also be awarded for especially impressive one-time reports that, for instance, detail graphics driver vulnerabilities, exploits in Chrome's 64-bit edition, or flaws in the "IJG libjpeg," the JPEG image encoding and decoding libraries.
Chrome and Mozilla's Firefox both rely on a newer variant of those libraries, dubbed "libjpeg-turbo," to accelerate image handling.
To mark the new bonus program, Google retroactively awarded $1,000 to one researcher and $3,000 to another.
Google debuted its bug bounty program in January 2010, raised the maximum payment from $1,337 to $3,133 in July of that year, and expanded the program in November 2010 to include security flaws on its websites.
So far this year, Google has paid researchers more than $250,000, nearly half of it to a pair who exploited Chrome at this year's Pwn2Own hacking contest.
Google last patched security vulnerabilities in Chrome on Aug. 8 and last paid bounties on July 31.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is firstname.lastname@example.org.
- Chrome users won't give up, keep pressing Google to restore old-style new tab page
- Google quashes 31 vulnerabilities, restores Metro mode 'steppers' with Chrome 34
- Firefox's UI face-lift on track for April debut
- Ex-Mozilla engineer blames Microsoft's rules for Metro Firefox's death
- Mozilla patches 20 Firefox flaws, plugs Pwn2Own holes
- Google reverses field, promises to restore Chrome's scrollbar arrows
- Update: Google ships Chrome 33, patches 28 bugs
- Mozilla's top exec defends in-Firefox ads, revenue search
- Mozilla taps in-Firefox ads as it searches for more revenue
- Mozilla ships Metro Firefox beta for Windows 8
Read more about Application Security in Computerworld's Application Security Topic Center.
- Gartner Magic Quadrant for Client Management Tools The client management tool market is maturing and evolving to adapt to consumerization, desktop virtualization, and an ongoing need to improve efficiency.
- Audit Ready and Asset Optimized: The Solid Promise of an Intelligent Software Asset Management Solution In this paper Frost & Sullivan examines the benefits of enterprise-grade Software Asset Management solutions, and how these solutions serve as the convergence...
- Gartner Magic Quadrant for Application Security The market for application security testing is changing rapidly. Technology trends, such as mobile applications, advanced Web applications and dynamic languages, are forcing...
- Five Steps to Achieve Success in your Application Security Program This white paper provides a general framework your organization can use to create or build upon an application security program. It includes guidelines...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Application Security White Papers | Webcasts