Slashdot Mirror
Google Patches 10 Chrome Bugs, Pays Out $10K
CWmike writes "Google patched 10 vulnerabilities in Chrome on Thursday, but it didn't award any of the researchers who reported bugs its new top-dollar reward. Google divulged no details of the vulnerabilities and, as is its custom, it blocked public access to its bug-tracking database — a practice meant to keep attackers from using the information before most users have upgraded. Some rivals, such as Mozilla, do the same; others, like Microsoft, do not. Sergey Glazunov banked $4,674 for reporting four bugs, including the previous maximum $1,337 each for two of the quartet. A researcher known as 'kuzzcc,' who has also reported flaws in Opera to that browser's Norwegian maker, took home $2,000 for uncovering a pair of Chrome vulnerabilities. But no one received Google's new biggest bounty, which the company set at $3,133.70 last month, after Mozilla had increased its maximum vulnerability payment to $3,000."
Meritocracy at work. It's nice to see, and I'm sure I will hear all sorts of complaints about how it is neither fair nor effective.
Someone flopped a steamer in the gene pool.
Are they using a static analysis tool to find bugs?
", which the company set at $3,133.70 last month" Great, Easter eggs beyond the code.
you would think you could sell this information to certain other parties for a lot more than that
and the potential for damage that can be done to the company's brand, and with all of the money the company has, you'd think they'd pay at least an order of magnitude more. and get a lot more interest in finding and reporting security flaws to boot
they are playing pennies for gems of information
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
in the same boat
...but do no good?
Let me know when they figure out how to add a menu bar.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
I am one of the bad guys :)
I assure you the bugs are worth more. The problem with those who get caught is they are lazy. You have to make personal security priority #1. Most of those in the business don't spend the time and effort to protect themselves from the inevitable risk they are taking. If they keep it up long enough those risks catch up to them. People are stupid. You can't take millions upon millions of dollars without taking some precautions. Hiding doesn't work. You have to stop any one particular thing they might investigate before you get caught to reduce risk and even then make it impossible to discover the problem you created so they can't start to investigate before you have the money in hand. This way they can't track the money back to you. There are ways to make money untraceable. If you don't keep up one activity long enough they won't catch up with you. Deviation is key. The more time they have to learn about how you work they can learn about you the more likely they will catch you. If you deviate frequently they won't be able to connect the dots to catch you. Deviate and they loose your trail. If they don't catch up you still have a problem because the government will be suspicious of anybody with money and no reported source of income. You got to create fake entities to sell something intangible to generate profit and give the appearance of a legitimate business of which you can report to the IRS that'll explain the income you've generated.
There's a 6 month disclosure timing. They likely reported and got paid months ago for these.
WTF does that mean?
Not that this wasn't entirely predictable.
Yesterday, my employer's stock was at $13.37 and I laughed. No one else got the joke. :(
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Why would Google do that if its updates occur frequently due to they being deltas and of smaller sizes? Would it not make any difference since users are most likely patched up already? I can understand for users who are using the portable versions--like me--unless there are more portable users than there are who install the regular app.
The maximum amount paid for a bug is 1,377$ ? I guess someone at google played too much CS.
Ten grand? Is that a typo?
If I find an exploit I'm gonna sell it to the Russian mob. And not for no ten grand.
Why is Chrome version 6 already in beta. Yes, it's fast, but other than that? Meh. Any other company would call it version 1.0.
Google is playing catchup with version numbers.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
...
The reason that Google and alike are offering "bounties" on bugs is that the people behind malware do the same thing. They offer cash for exploits, not hard to find them either, just use a different search engine other than Google.
Of course it can't compete with the black market though but it's a good first step.
And ever since the pushed out fixes, I can't connect to a bunch of SSL sites (such as mail.google.com). Apparently the fixes broke the ability to access SSL sites from behind a corporate firewall in some cases. The fixes made Chrome nearly useless to me :(.
...to anyone who can identify an exploit that let's me introduce another 5 exploits