Google boosts bonuses for Chrome bug bounty hunters
Willing to pay more to shake out harder-to-find flaws
Computerworld - Google yesterday boosted payments to researchers for reporting bugs in Chrome, saying the move was prompted by a decline in vulnerabilities submitted by outsiders.
"Recently, we've seen a significant drop-off in externally reported Chromium security issues," Chris Evans, a Chrome software engineer, said in a Tuesday post to the Chromium Blog. "This signals to us that bugs are becoming harder to find."
Evans outlined new bonuses that Google will award researchers who report certain kinds of flaws. All the bonuses start at $1,000 but can climb from there.
Google will add the bonuses to the base payments -- which range from $500 to $3,133 -- for bugs that are "particularly exploitable," found in the more bug-free sections of Chrome's code, and for vulnerabilities that affect more than just the browser.
In the past, Google has written bonus checks for up to $10,000 for what it calls "particularly significant contributions." Those bonuses have been reserved for long-running reporting. Last March, for example, Google awarded three of its most prolific bug submitters $10,000 each.
The big-dollar bonuses remain in play, said Evans, and will also be awarded for especially impressive one-time reports that, for instance, detail graphics driver vulnerabilities, exploits in Chrome's 64-bit edition, or flaws in the "IJG libjpeg," the JPEG image encoding and decoding libraries.
Chrome and Mozilla's Firefox both rely on a newer variant of those libraries, dubbed "libjpeg-turbo," to accelerate image handling.
To mark the new bonus program, Google retroactively awarded $1,000 to one researcher and $3,000 to another.
Google debuted its bug bounty program in January 2010, raised the maximum payment from $1,337 to $3,133 in July of that year, and expanded the program in November 2010 to include security flaws on its websites.
So far this year, Google has paid researchers more than $250,000, nearly half of it to a pair who exploited Chrome at this year's Pwn2Own hacking contest.
Google last patched security vulnerabilities in Chrome on Aug. 8 and last paid bounties on July 31.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is firstname.lastname@example.org.
- Workarounds to purge search bar from Firefox's new tab page are available
- Mozilla ships Firefox 31, adds search to new tab page
- Microsoft's IE steps back from the brink of irrelevance
- Firefox falters, falls to record low in overall browser share
- Firefox risks user backlash by adding search box to new tab page
- Google unseats Microsoft as the U.S. browser powerhouse
- Safari, Chrome push to mask URLs
- Chrome on Windows champs at the 64-bit
- Google pulls trigger, cripples some Chrome add-ons
- Microsoft shoots to shorten Internet Explorer's long tail
Read more about Application Security in Computerworld's Application Security Topic Center.
- The DDoS Threat Spectrum Bolstered by favorable economics, today's global botnets are using distributed denial-of-service (DDoS) attacks to target firewalls, web services, and applications, often simultaneously.
- How to Keep Company Assets Secure with Federated Identity and Access Management This Technology Spotlight discusses the growing need for security in today's cloud-based, mobile world of IT, and the rise of SaaS-based solutions.
- Security, Privacy and Trust in Email Management This white paper discusses a SaaS-based email management solution that delivers the security, continuity and archiving capabilities your organization demands.
- Unifying Secuirty Operations Agile enterprises know that the way to quickly identify and react to threats to the business is to break down operational siloes by...
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily...
- On Demand: Mastering the Art of Mobile Content Management Mobile device usage in the enterprise has skyrocketed, and it continues to escalate. IT must answer to users who demand access to their... All Application Security White Papers | Webcasts