Bug bounty program pays researchers that find flaws in widely-used software
Microsoft and Facebook team up to reward vulnerability research that could help many Internet users
IDG News Service - A new bug bounty program sponsored by Microsoft and Facebook will reward security researchers for finding and reporting vulnerabilities in widely used software that have the potential to affect a large number of Internet users.
The program will be run by a panel of researchers from Facebook, Google, Microsoft and several other companies who helped manage or participated in other security bounty programs over the years.
"Our experiences have left us with a calling to improve vulnerability disclosure for everyone involved to bring the Internet to a better place," the researchers said on hackerone.com, the website hosting the new bug bounty program and which will connect bug hunters to response teams that can resolve the reported flaws.
The new program will reward vulnerabilities found in the Python, Ruby, PHP and Perl interpreters; the Django, Ruby on Rails and Phabricator development tools and frameworks; the Apache and Nginx Web servers, and the application sandbox mechanisms of Google Chrome, Internet Explorer 10, Adobe Reader and Flash Player.
The discovery of security issues that affect software implementations from multiple vendors or a vendor with dominant market share, such as vulnerabilities in Internet protocols, will also be rewarded. Example of past vulnerabilities that would have qualified in this category include the 2008 collision attack against the MD5 hashing function that was used to generate a forged CA certificate, the BEAST attack against SSL and the DNS cache poisoning vulnerability reported by security researcher Dan Kaminsky in 2008, the program organizers said.
The bounty amounts will vary depending on the severity of the reported issues and the software they affect. For example, rewards for finding vulnerabilities in Phabricator will start from $300 and can reach $3,000, but bounties for vulnerabilities in application sandboxes or Internet protocols will start at $5,000 and can be increased significantly at the discretion of the review panel. In the case of some software projects, submitting a patch along with a vulnerability report will double the bounty.
The new program is addressed not only to security researchers, but to anyone who discovers a security issue, as long as they comply with the program's disclosure philosophy and guidelines. That includes academic researchers, software engineers, system administrators, and even casual technologists.
The bounties are currently sponsored by Microsoft and Facebook, but the HackerOne panel encourages response teams who will address the reported issues to financially motivate security research if they can afford to.
Last month Google announced a similar initiative to pay for security fixes and code strengthening patches in widely used open-source applications and software libraries including OpenSSL, OpenSSH, BIND, libjpeg, libpng and others. This might explain why Google is not sponsoring the HackerOne bounties even though Chris Evans, a security engineer with the Google Chrome Security Team, is on the HackerOne panel.
- Deep Security +VMware vSphere with Operations Management Most midsize organizations are highly virtualized on VMware, and while this has produced significant savings, it also has created new challenges when it...
- 3 Questions to Ask Your DNS Host about Lowering DDoS Risks Neustar has had wide-ranging conversations with clients wanting to know how they can optimize protection as DDoS attacks increase in frequency and size.
- The Danger Deepens: 2014 Neustar Annual DDoS Attacks and Impact Report This report compares DDoS findings from 2013 to 2012, based on a survey of 440 North American companies, including 139 businesses delivering technology...
- DDoS Infographic: How Are Attacks Evolving? For the third consecutive year, Neustar surveyed businesses across major industries to track the evolution of DDoS attacks. Are they more frequent? Larger?...
- How to Use Crowd-Sourced Threat Intelligence to Stop Malware in its Tracks Threat sharing networks have been around for a long time, however they have typically been "invitation-only", available to only large companies, or those...
- An Incident Response Playbook: From Monitoring to Operations As cyber-attacks grow more sophisticated, many organizations are investing more into incident detection and response capabilities. In this webcast, learn how to develop... All Malware and Vulnerabilities White Papers | Webcasts