Microsoft tacks up first wanted poster, debuts temp bounty for IE11 bugs
Better late to the party than never, say security experts
Computerworld - Microsoft on Wednesday backpedaled from a long-standing refusal to pay bug bounties when it announced a temporary program for the beta of Internet Explorer 11 (IE11).
The Internet Explorer 11 Preview Bug Bounty will start June 26, the day the browser launches alongside Windows 8.1 at the BUILD developer conference, and will run until July 26. During the 30 days, Microsoft will pay researchers up to $11,000 for each vulnerability they find and report to the company.
Microsoft has repeatedly rejected the idea of joining rivals, such as Google and Mozilla, in paying for bugs. In 2011, the company insisted a just-announced contest was a better use of its money than paying for bugs one by one.
Also yesterday, Microsoft expanded that 2011 contest -- then labeled the "BlueHat Prize" -- into an ongoing "BlueHat Bonus for Defense" initiative that will pay researchers up to $50,000 for fresh defensive security solutions.
The big money was reserved for another new program, dubbed "Mitigation Bypass Bounty," that will award up to $100,000 for any novel exploitation technique able to circumvent Windows 8.1's many defenses.
Only the IE11 preview program is a true bug bounty -- one that pays researchers for each unknown vulnerability they report -- but security experts were impressed nonetheless.
"We've waited years for this, and they're doing it in classic Microsoft fashion ... they're putting their own twist on a bug bounty by only paying for bugs in a beta," said Andrew Storms, director of security operations at Tripwire nCircle. "I can see the reasoning behind that, because beta is when bugs ought to be found."
Chris Wysopal, co-founder and CTO of Veracode, a Burlington, Mass. firm that develops application security testing and risk management software, agreed, but couldn't resist poking Microsoft.
"I've been a fan of bug bounties for a long time, and in 2010, after Google started paying for bugs, predicted that Microsoft would, too," said Wysopal. "It took them a good three years to do this. But they came up with a new twist which no one had tried before."
In 2010, Wysopal wrote a blog post in which he forecast that Microsoft would "cave to industry pressure as they are hit with more uncoordinated disclosures than their peers," and kick off a bounty program.
The limited-time IE11 bounty offer was triggered by a realization that researchers waited until after IE10 went final, or reached what Microsoft calls "release to manufacturing," or RTM, to report bugs, said Katie Moussouris, a senior security strategist lead with the company.
IE10, the immediate predecessor to IE11, shipped last October for Windows 8. It reached RTM along with that operating system in late August 2012, having been in beta, or as Microsoft called it, "preview," for almost a year.
"The researchers were looking for vulnerabilities [in IE10], but they were holding on to them," said Moussouris, not reporting them either to Microsoft directly, or more importantly, to the third-party bug bounty brokers like HP TippingPoint's Zero Day Initiative and VeriSign's iDefense, that pay, sometimes handsomely, for vulnerabilities. "We didn't want to wait for all the vulnerabilities until after RTM, because it was much better that we get them as early as possible."
Brokers such as TippingPoint and iDefense have policies that preclude bounties for bugs in betas, in part because there's no way they can know whether the flaws will be fixed or left untouched by the time a product is completed and shipped to customers.
The rewards for IE11 bugs, which range from $500 to over $11,000, are meant to shake those bugs from the researcher trees before IE11 is released to the public.
- Nadella departs from predecessor's practice, will do earnings call Thursday
- Microsoft to wrap Nokia deal Friday, name subsidiary 'Microsoft Mobile'
- Microsoft launches toolset for capturing 'ambient intelligence'
- Microsoft kicks off sales of lower-priced Office subscription in bid for iPad dollars
- At Build, mobility gets a boost with universal Windows apps
- Microsoft gets strategic with its Enterprise Mobility Suite
- Microsoft sketches out final Windows XP security updates for next week
- Microsoft teases touch-first Office for Windows
- Cortana's voice is synthesized in part from an AI character in Halo
- Hell freezes over: Microsoft makes Windows free for some devices
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts