Microsoft waves more security pros into the pool for $100K bounties
Moves step closer to traditional bug bounties by accepting novel techniques found in active attacks that skirt Windows' defenses
Computerworld - Microsoft on Monday expanded its $100,000 bounty program, and will accept reports of in-the-wild attacks that demonstrate new techniques of bypassing Windows' anti-exploit technologies.
"This will be pretty disruptive," said Chris Wysopal, co-founder and CTO of Veracode, a Burlington, Mass. company that develops application security testing and risk management software, talking about the impact on cyber criminals. "This is a pretty big bounty for someone doing [security] incident response."
The expanded program lets front-line security researchers, which Microsoft described as "responders and forensics experts," submit reports of unique attack techniques that they have found in active exploits.
The maximum payment remains $100,000, the bar that Microsoft established in June when it kicked off what it called the "Mitigation Bypass Bounty."
Previously, Microsoft only accepted novel and reliable exploit techniques that researchers and academics had devised in the abstract, and which had not been used by actual hackers. The program aimed to acquire information about such techniques -- which could circumvent Windows 8.1's built-in defenses, like DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization) and SEHOP (Structured Exception Handling Overwrite Protection) -- before attackers used them so Microsoft could pre-empt exploits by beefing up the OS's protection.
Microsoft has awarded only one $100,000 Mitigation Bypass Bounty, which went to James Forshaw, the head of vulnerability research at U.K.-based Context Information Security, last month.
The change, as one security expert said, brings Microsoft closer to traditional bug bounty programs, which pay for each vulnerability. "[This] is very much riding the line of paying for zero-days," said Andrew Storms, director of DevOps at CloudPassage of San Francisco, in an instant message interview yesterday.
Microsoft declined to answer questions about how the changes were different from a per-bug bounty, with a spokesperson instead pointing to a blog post written by Katie Moussouris, a senior security strategist lead at the company, in which Moussouris likened bug bounties to paying to deflect individual arrows while the Microsoft program pays for information about "ways around the shield."
Security professionals disagreed whether Microsoft had crossed the line to a pay-for-bugs model, which the company has repeatedly said it would not do.
"It sure does seem to boil down to a person or organization has gotten their hands on a new attack method and they turn it over to Microsoft for a payout," said Storms. "Although I guess you could say that they are paying for a technique instead of a payload."
While acknowledging that it was "splitting hairs" to deny that the new program was a bug bounty, Wysopal said that "It's only for mitigation bypasses, it's not just for any zero-day bug. They're not paying for a zero-day [vulnerability] in Windows XP, for example."
Moussouris stressed that the bounty program expansion would now draw from a much larger pool of people. "We are going from accepting entries from only a handful of individuals capable of inventing new mitigation bypass techniques on their own, to potentially thousands of individuals or organizations who find attacks in the wild," she wrote.
The single award thus far points to the difficulty in meeting the original program's criteria, and the expansion signals that Microsoft wanted more grist for its mill.
But it's not opening up the program to just any Tom, Dick or Harriet hacker. Only pre-certified organizations will be allowed to submit reports eligible for the $100,000 awards, and then, as Storms pointed out, only after they sign an agreement that will, as in prior contests, require the reporters to not disclose details of the attack technique.
"I think they did that so that one black hat couldn't get paid for stealing from another black hat," said Wysopal, using the term for criminal coders, when asked why Microsoft wanted to pre-qualify those who submitted reports. "They're trying to make sure that only white hat, legitimate incident responders, get the money."
And he applauded the bounty expansion. "This is very smart. This raises the cost of offense because defenders will be on the lookout for mitigation bypass techniques in the zero-days they find, and [they're] incentivized to get that information to Microsoft, which can then close the hole," said Wysopal.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His email address is firstname.lastname@example.org.
- How Microsoft's CEO sees growth for Windows Phone and Lumia
- Microsoft wants you to forget Windows 8
- Microsoft again writes off Surface inventory, renews profitability doubts
- 'Nadella Effect' makes Ballmer $2.8B richer
- Microsoft reveals bankruptcy of devices strategy by dumping Nokia feature phones
- Microsoft may drag out layoffs for a year
- Surface survives Microsoft cuts, but tablet strategy remains muddled
- As it lays off workers, Microsoft also kills its low-end Nokia X smartphones
- How Microsoft announces layoffs will show the company's PR IQ
- Why Microsoft isn't spooked by the Apple-IBM alliance
Read more about Security in Computerworld's Security Topic Center.
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!