New bug bounty program rewards researchers for finding flaws in widely used software

Microsoft and Facebook team up to reward vulnerability research that can affect a lot of Internet users

A new bug bounty program sponsored by Microsoft and Facebook will reward security researchers for finding and reporting vulnerabilities in widely used software that have the potential to affect a large number of Internet users.

The program will be run by a panel of researchers from Facebook, Google, Microsoft and several other companies who helped manage or participated in other security bounty programs over the years.

"Our experiences have left us with a calling to improve vulnerability disclosure for everyone involved to bring the Internet to a better place," the researchers said on hackerone.com, the website hosting the new bug bounty program and which will connect bug hunters to response teams that can resolve the reported flaws.

The new program will reward vulnerabilities found in the Python, Ruby, PHP and Perl interpreters; the Django, Ruby on Rails and Phabricator development tools and frameworks; the Apache and Nginx Web servers, and the application sandbox mechanisms of Google Chrome, Internet Explorer 10, Adobe Reader and Flash Player.

The discovery of security issues that affect software implementations from multiple vendors or a vendor with dominant market share, such as vulnerabilities in Internet protocols, will also be rewarded. Example of past vulnerabilities that would have qualified in this category include the 2008 collision attack against the MD5 hashing function that was used to generate a forged CA certificate, the BEAST attack against SSL and the DNS cache poisoning vulnerability reported by security researcher Dan Kaminsky in 2008, the program organizers said.

The bounty amounts will vary depending on the severity of the reported issues and the software they affect. For example, rewards for finding vulnerabilities in Phabricator will start from $300 and can reach $3,000, but bounties for vulnerabilities in application sandboxes or Internet protocols will start at $5,000 and can be increased significantly at the discretion of the review panel. In the case of some software projects, submitting a patch along with a vulnerability report will double the bounty.

The new program is addressed not only to security researchers, but to anyone who discovers a security issue, as long as they comply with the program's disclosure philosophy and guidelines. That includes academic researchers, software engineers, system administrators, and even casual technologists.

The bounties are currently sponsored by Microsoft and Facebook, but the HackerOne panel encourages response teams who will address the reported issues to financially motivate security research if they can afford to.

Last month Google announced a similar initiative to pay for security fixes and code strengthening patches in widely used open-source applications and software libraries including OpenSSL, OpenSSH, BIND, libjpeg, libpng and others. This might explain why Google is not sponsoring the HackerOne bounties even though Chris Evans, a security engineer with the Google Chrome Security Team, is on the HackerOne panel.

Microsoft's sponsorship of the program might indicate that the company has softened its stance on paying for individual vulnerabilities, a practice it has opposed for years.

Microsoft launched two bounty programs for its own products in June, but with a goal of rewarding research into new defensive techniques or exploitation methods that bypass existing defenses, rather than rewarding the discovery of individual security flaws. On Monday, the company extended one of those programs to also reward reports of new attack techniques discovered by security professionals in active attacks.

Microsoft also ran a more traditional bug bounty program in June to pay for vulnerabilities found in the preview version of Internet Explorer 11, but that program only lasted 30 days.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags patchesonline safetyGoogleMicrosoftsecuritysoftwareExploits / vulnerabilitiesFacebook

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?