VeriSign Puts Flaw Bounty on Vista and IE7

rchris1172 writes "VeriSign's iDefense Labs has placed an $8,000 bounty on remote code execution holes in Windows Vista and Internet Explorer 7. As part of its its controversial pay-for-flaw VCP (Vulnerability Contributor Program), iDefense said it will pay the reward for each submitted vulnerability that allows an attacker to remotely exploit and execute arbitrary code on either of the two Microsoft products. In addition to the $8,000 award for the flaw, iDefense will pay between $2,000 and $4,000 for working exploit code that exploits the submitted vulnerability."

Comments

Only 8k?

[Anonymous Coward]

Only 8k for bugs which go on the market for 15-100k each exploit? Surely you jest, no self righteous will go for such a scam.

Re:Only 8k?

[w33t]

Only 8k for bugs which go on the market for 15-100k each exploit? Surely you jest, no self righteous will go for such a scam.

Then perhaps the simply righteous will step up.

Economics 101 or Why I Love Bounties

[WillAffleckUW]

1. Put bounty of $8000 on bugs for Vista and IE7.

2. Get friend to go work at MSFT.

.

4. PROFIT!

Re:Economics 101 or Why I Love Bounties

[Drawkcab]

What would you be offering in that equation that would lead to profit for you rather than your friend? Finding exploits is non-trivial even with the code in front of you. And if the guy is working at Microsoft with full access to the source repository and a talent for spotting this sort of thing, they're already making at least $8000 a month anyway (which they don't have to split with you), and could probably be amply rewarded in their career if they made a habit of finding and fixing those exploits.

Re:Economics 101 or Why I Love Bounties

[dreddnott]

I think the way that you would want to do it, and the way that the grandparent poster probably intended, is to have your friend work at Microsoft, put in his OWN bugs and holes in the code, and tell you what the vulnerabilities are so that YOU to write exploit code for it and get the money.

This would probably work until QA at Microsoft tracked down the singular source of most of the exploited vulnerabilities in the past few months.

Considering the number and regularity of vulnerabilities in Microsoft software recently, I wouldn't be surprised if one of their employees was already doing this, but selling them on the more lucrative black market instead.

Re:Economics 101 or Why I Love Bounties

[WillAffleckUW]

Quite right you are pointing out the missing step, here it is:

3. ???

Darn. Guess you get the US $8000 bounty. Now, let's see, that's about 2 Euros, right?

Re:Economics 101 or Why I Love Bounties

[Atario]

--------joke------------>

      O
     /|\      <--- you
      |
     / \

Effective...

[clifgriffin]

While others may scoff at 8,000 dollars, people are spending hundreds of hours on projects that are bringing in much less if anything. This is a good way to give people healthy motivation and reveal vulnerabilities early...before they make headlines.

So, not so stupid. Unlike most of the posts on this article so far.

Re:Effective...

[LoudMusic]

While others may scoff at 8,000 dollars, people are spending hundreds of hours on projects that are bringing in much less if anything. This is a good way to give people healthy motivation and reveal vulnerabilities early...before they make headlines.

So, not so stupid. Unlike most of the posts on this article so far. Except that not everyone, in fact very few, will eventually be given a reward while hundreds of thousands of individuals spend possibly hundreds of hours each searching for flaws.

What it's really doing is getting those hundreds of thousands of individuals to do someone else's (Microsoft's) job for them for damn near free.

Re:Effective...

[Eskarel]

If hundreds of thousands of individuals spend hundreds of hours searching for bugs and only a very few find anything they can cash in, then Microsoft has already done it's job. Verisign just wants to make sure they have.

Moar money

[zecg]

"In addition to the $8,000 award for the flaw, iDefense will pay between $2,000 and $4,000 for working exploit code that exploits the submitted vulnerability."

The company spokesman also added they'll double the bounty if the submitter already used the exploit to build a botnet and triple it if promises to use it to send a metric assload of e-mails with the subject "ha-ha" to everyone@microsoft.com.

Re:Four Steps to Profit

[__aaclcg7560]

Didn't you read the fine print... current/former Microsoft employees not allowed. Otherwise, every anonymous coward at Microsoft would get the same idea and sabotage Vista/IE7 to collect the reward. Crime isn't supposed to pay if you're non-monopolist!

Not going to work

[AngryDad]

iDefense ask you to provide all your background information, names, addressess, telephones, photocopies of IDs, etc. Most people who can find vulnerabilities will not be willing to sacrifice their privacy. When iDefence and alike will only ask for e-mail address to paypal funds to, I'd be first in line to talk to them.

Re:Not going to work

[Zonnald]

Dear Sir,

You have just won a new Boat!
Please come down to the stadium to pick it up.

Regards

Det. Sgt. Smith

Sounds like a low figure

[Hyram Graff]

$8000 might sound like a lot until you compare it to the stories we see of vulnerabilities being sold for $50,000 on underground sites. Why should I sell my findings to them for a much smaller amount?

Re:Sounds like a low figure

[w33t]

Why should I sell my findings to them for a much smaller amount?

If you can help someone and get payed 8 dollars, or hurt someone and get 50 dollars, what would you do?

I think it's good that there is any compensation at all for white hats who would otherwise recieve no compensation at all for doing the least harmful thing. It would be nice if the rewards for help were on par with harm, but helping is reward in itself for some - and a bit extra reward helps the motivation.

Re:Sounds like a low figure

[Onymous Coward]

Exactly.

Perhaps eBay is the appropriate way to monetize on this kind of research.

I'm joking. Quit agreeing.

If you read TFA..

[ganjadude]

If you read TFA you would see that they are only offering 6 8K rewards, its not unlimited, you cannot make trillions.

NOT the best business move!

[Arthur Dent '99]

Paying $8000 for each exploitable security flaw in Microsoft products is a quick way to put a company into bankruptcy! I noticed that the bounty only applies to the first six submissions, though, so VeriSign is only out $48000.

Who else here thinks that VeriSign will then turn around and sell the winning entries to the black market for $50000 each? hehe

The law on unintended consequences

[andersen]

Pointy Haired Boss: Our goal is to write bug-free software. I'll pay a ten dollar bonus for every bug you find and fix.
Dilbert: Yahoo!
Alice: We're rich
Wally: Yes!!! Yes!!! Yes!!!
Pointy Haired Boss: I hope this drives the right behavior.
Wally: I'm gonna write me a new minivan this afternoon!

http://www.ourlocalstyle.com/images/uploadImages/2 006/05/13/dilbert_bugFixMinivan.gif

Oh, please

[lawrenlives]

I'd like to think not everyone involved in the "field" is a scumbag criminal in cahoots with the Russian mafia. Go ahead, prove me wrong! Despite the seemingly faceless nature of corporations, it's always human beings like you and me that get screwed in the end.

So Now I Can Legally Attempt To Compromise M$ ??

[TastyWheat]

And get paid for it??

Hax0r1ng is getting better all the time!
And they said we were just a bunch of internet hooligans.

muahahhaha

Re:Four Steps to Profit

[Sosarian]

Microsoft is in the habit of knowing about bugs but won't fix because if it's not out in the wild.

They could turn in bugs they already know about :)

Re:Wonder what they're really worth?

[Anonymous Coward]

Too bad I have this silly fear of death Yeah I wouldn't mess around with those Verisign guys either.....

Pfft

[Tom]

What a cheap publicity stunt.

A 0day of this kind is worth at least twice that on the black market, mostly to the botnet creators who are the base of all the spam we get.

In other news...

[MattPat]

...both Apple and Cisco are suing VeriSign for the use of iDefense in the name of their labs. Apple claims that it dilutes their brand identity, and Cisco claims that they've been selling "defense" hardware with the "i" trademark for years!

"perhaps the simply righteous will step up"

[tlambert]

"perhaps the simply righteous will step up"

Yeah, and "the righteous" could code, then there wouldn't be any exploits in the first place. 8-).

-- Terry

right, not all are Russian mafia

[r00t]

Some are working with the Russian military.