Google boosts bonuses for Chrome bug bounty hunters
Willing to pay more to shake out harder-to-find flaws
Computerworld - Google yesterday boosted payments to researchers for reporting bugs in Chrome, saying the move was prompted by a decline in vulnerabilities submitted by outsiders.
"Recently, we've seen a significant drop-off in externally reported Chromium security issues," Chris Evans, a Chrome software engineer, said in a Tuesday post to the Chromium Blog. "This signals to us that bugs are becoming harder to find."
Evans outlined new bonuses that Google will award researchers who report certain kinds of flaws. All the bonuses start at $1,000 but can climb from there.
Google will add the bonuses to the base payments -- which range from $500 to $3,133 -- for bugs that are "particularly exploitable," found in the more bug-free sections of Chrome's code, and for vulnerabilities that affect more than just the browser.
In the past, Google has written bonus checks for up to $10,000 for what it calls "particularly significant contributions." Those bonuses have been reserved for long-running reporting. Last March, for example, Google awarded three of its most prolific bug submitters $10,000 each.
The big-dollar bonuses remain in play, said Evans, and will also be awarded for especially impressive one-time reports that, for instance, detail graphics driver vulnerabilities, exploits in Chrome's 64-bit edition, or flaws in the "IJG libjpeg," the JPEG image encoding and decoding libraries.
Chrome and Mozilla's Firefox both rely on a newer variant of those libraries, dubbed "libjpeg-turbo," to accelerate image handling.
To mark the new bonus program, Google retroactively awarded $1,000 to one researcher and $3,000 to another.
Google debuted its bug bounty program in January 2010, raised the maximum payment from $1,337 to $3,133 in July of that year, and expanded the program in November 2010 to include security flaws on its websites.
So far this year, Google has paid researchers more than $250,000, nearly half of it to a pair who exploited Chrome at this year's Pwn2Own hacking contest.
Google last patched security vulnerabilities in Chrome on Aug. 8 and last paid bounties on July 31.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is firstname.lastname@example.org.
- Mozilla ships Firefox 31, adds search to new tab page
- Microsoft's IE steps back from the brink of irrelevance
- Firefox falters, falls to record low in overall browser share
- Firefox risks user backlash by adding search box to new tab page
- Google unseats Microsoft as the U.S. browser powerhouse
- Safari, Chrome push to mask URLs
- Chrome on Windows champs at the 64-bit
- Google pulls trigger, cripples some Chrome add-ons
- Microsoft shoots to shorten Internet Explorer's long tail
- Firefox risks irrelevance as mobile browsing booms
Read more about Application Security in Computerworld's Application Security Topic Center.
- Security, Privacy and Trust in Email Management This white paper discusses a SaaS-based email management solution that delivers the security, continuity and archiving capabilities your organization demands.
- Unifying Secuirty Operations Agile enterprises know that the way to quickly identify and react to threats to the business is to break down operational siloes by...
- Is Your Credit Card Data Safe from Hacks? News of recent credit card hacks has rocked consumer confidence. Even talk of a security breach can bring on a PR firestorm. What...
- Case Study Adopting ITSM Tech to Support ITIL Initiatives CIO Bart Murphy Improves Service Delivery while Lowering Costs by consolidating services across 6 business units.
- On-demand webinar - 7 Keys to Service Catalog Implementation Success Watch this webinar to learn 7 crucial keys to make your service catalog a success!
- Transform Your IT Service Management Watch this webinar, to learn how EasyVista can increase IT productivity & efficiency and deliver streamlined & integrated IT Service & Asset Mgmt. All Application Security White Papers | Webcasts