Google boosts bonuses for Chrome bug bounty hunters
Willing to pay more to shake out harder-to-find flaws
Computerworld - Google yesterday boosted payments to researchers for reporting bugs in Chrome, saying the move was prompted by a decline in vulnerabilities submitted by outsiders.
"Recently, we've seen a significant drop-off in externally reported Chromium security issues," Chris Evans, a Chrome software engineer, said in a Tuesday post to the Chromium Blog. "This signals to us that bugs are becoming harder to find."
Evans outlined new bonuses that Google will award researchers who report certain kinds of flaws. All the bonuses start at $1,000 but can climb from there.
Google will add the bonuses to the base payments -- which range from $500 to $3,133 -- for bugs that are "particularly exploitable," found in the more bug-free sections of Chrome's code, and for vulnerabilities that affect more than just the browser.
In the past, Google has written bonus checks for up to $10,000 for what it calls "particularly significant contributions." Those bonuses have been reserved for long-running reporting. Last March, for example, Google awarded three of its most prolific bug submitters $10,000 each.
The big-dollar bonuses remain in play, said Evans, and will also be awarded for especially impressive one-time reports that, for instance, detail graphics driver vulnerabilities, exploits in Chrome's 64-bit edition, or flaws in the "IJG libjpeg," the JPEG image encoding and decoding libraries.
Chrome and Mozilla's Firefox both rely on a newer variant of those libraries, dubbed "libjpeg-turbo," to accelerate image handling.
To mark the new bonus program, Google retroactively awarded $1,000 to one researcher and $3,000 to another.
Google debuted its bug bounty program in January 2010, raised the maximum payment from $1,337 to $3,133 in July of that year, and expanded the program in November 2010 to include security flaws on its websites.
So far this year, Google has paid researchers more than $250,000, nearly half of it to a pair who exploited Chrome at this year's Pwn2Own hacking contest.
Google last patched security vulnerabilities in Chrome on Aug. 8 and last paid bounties on July 31.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is email@example.com.
- Google reverses field, promises to restore Chrome's scrollbar arrows
- Update: Google ships Chrome 33, patches 28 bugs
- Mozilla's top exec defends in-Firefox ads, revenue search
- Mozilla taps in-Firefox ads as it searches for more revenue
- Mozilla ships Metro Firefox beta for Windows 8
- Mozilla defers Firefox's new 'Australis' UI to April
- Mozilla resets Metro Firefox ship date to mid-March
- Mozilla ships Firefox 26 with opening click-to-play move
- Mozilla banked $274M in '12 from Google-Firefox search deal
- Google trumpets Chrome's SPDY gains
Read more about Application Security in Computerworld's Application Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Riverbed Stingray Application Firewall: Securing Cloud Applications with a Distributed Web Application Firewall Responsibility over IT security is moving away from the network and IT infrastructure and to the application and software architecture itself. IT organizations...
- Web Application Firewalls--Laying the Myths to Rest This paper addresses some of the myths about WAFs and outlines how businesses are optimizing their investment in protecting their ever-evolving web apps.
- PCI DSS Compliance in Cloud Environments This technology analysis addresses the challenges of the evolving cloud security landscape and how organizations can achieve PCI DSS compliance in cloud environments...
- Web Attack Survival Guide This guide will help you protect your organization from external threats targeting your high-value applications and data assets.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Application Security White Papers | Webcasts