Google Broadens Bug Bounties To Include Web App Security

n0-0p writes "Google just announced they will pay between $500 and $3133.70 for security bugs found in any of their web services, such as Search, YouTube, and Gmail. This appears to be an expansion of the program they already had in place for Chrome security bugs. 'We've seen a sustained increase in the number of high quality reports from researchers, and their combined efforts are contributing to a more secure Chromium browser for millions of users.' The rules and qualification details were posted today at the Google Online Security Blog."

Comments

Apparently

[imamac]

Apparently, the Chrome program of this worked well.

Ain't the first, ain't the last

[Musically_ut]

Google: Keeping the Knuth tradition in CS alive!

Rejoice!

Re:Ain't the first, ain't the last

[johny42]

Actually, it was one hexadecimal dollar, which amounted to 256 (standard) cents.

Re:Ain't the first, ain't the last

[DragonWriter]

Actually, it was one hexadecimal dollar, which amounted to 256 (standard) cents.

1 in hexadecimal is the same as 1 in decimal. 1 dollar (decimal) is the same as 1 dollar (hex).

Now, 100 (hexadecimal) cents is the same as 256 (decimal) cents, which is probably what you mean.

1 dollar (decimal or hexadecimal) = 100 (decimal) cents

Re:Ain't the first, ain't the last

[johny42]

A hexadecimal dollar is 100 hexadecimal = 256 decimal cents. There's a semantic difference in "1 (hexadecimal dollar)" (Knuth's version) vs "(1 hexadecimal) dollar" (your version).

See Donald Knuth's FAQ.

Also, it's a joke, so there's probably no point in arguing technicalities.

Does this imply....

[santax]

I can actually 'test' the security of youtube/gmail and such and don't get a party-van in front of my house?

Re:Does this imply....

[butalearner]

From TFA:

These categories of bugs are definitively excluded:

• attacks against Google’s corporate infrastructure
• social engineering and physical attacks
• denial of service bugs
• non-web application vulnerabilities, including vulnerabilities in client applications
• SEO blackhat techniques
• vulnerabilities in Google-branded websites hosted by third parties
• bugs in technologies recently acquired by Google

Re:Does this imply....

[santax]

They are raining on my parade. *stops pinging to google.com*

New Minivan!

[Trip6]

http://thedailywtf.com/Comments/The-Defect-Black-Market.aspx?pg=2

Found some!

[Anne_Nonymous]

>> they will pay between $500 and $3133.70 for security bugs found in any of their web services,

I just found "About 7,690,000 results (0.33 seconds)" for security bugs in one of their services. Just go ahead and make that check out for an even bazillion and we'll call it good.

I wonder how the culture works on the other side.

[NBolander]

Does the responsible coder buy his department a cake, a case of beer or is he/she given a stern talking to.

This is such a smart move...

[Rooked_One]

In the end, they will be able to claim "If there were bugs, we paid you to find them, and you did... Lots of them. And because of that our browser is the best."

Just wait for it.

Re:This is such a smart move...

[Rooked_One]

Never said I used chrome - just saying what google will say down the road. ;)

Bug economy

[Caerdwyn]

A story from the past...

A Former Employer Who Shall Not Be Named had a product about to go golden-master, and wanted every employee in the company to participate in the final round of testing. Then the pointy-haired bosses got an idea! During the last round of testing, they put up a bounty of twenty dollars for each P3, fifty dollars for each P2, and a hundred dollars for each P1 bug found. However, the pointy-hairs decreed QA and Dev were excluded, and in the same breath decreed that QA and Dev would be working overtime.

An underground economy of bugs immediately sprang up. QA guys would find bugs and quietly share them with tech support/sales engineers/etc. Devs would notice (and it was whispered, though never proven, create) bugs and quietly share them with IT. And the proceeds would be split between the ineligible employees and the eligible.

Over fifty thousand in bounties were paid. Then the pointy-hairs got wind of what was going on.

And that was the end of that.

Irrelevant to the story at hand, though, I'm quite sure...

Re:Bug economy

[Christopher Fritz]

Seems CVS or similar would counter purposely creating bugs, unless someone's going to modify the history tree, and any older copies of the source code sitting around.

Am I missing any openings where "insert bugs" can still fill "???" and lead to "PROFIT!"? Maybe putting a bug in on purpose, and letting it sit around for a month before reporting it?

Re:Bug economy

[SheeEttin]

Hmm. I wonder if offering a non-monetary reward (e.g. baked goods) or a simple fiat "high score" would be an improvement on that.
Though one must always watch for people gaming the system, or becoming too fixated on the reward, when it's the bug-fixing that's the important part.
Perhaps only reward during specified "bugfix drives", and disqualify/discipline/fire anyone found to be inserting bugs just to be the one to fix them?

Re:Bug economy

[Caerdwyn]

As far as I know (this was about 6 months before my time at That Company, and was the subject of hallway lore, which is how I learned of it), it was never proven that buggy code was being deliberately checked in. What WAS certainly going on was that people who were in a position to know about bugs but were bounty-ineligible were sharing that knowledge with people who were bounty-eligible. The bugs were found and fixed, the product wasn't hurt, but the bounty system was thoroughly gamed by people who were excluded and heavily-worked.

Time period: 1993.

BFD

[thenextstevejobs]

I will offer 20 times the bounty to anyone who finds similar exploits in my products.

Oh, what's that, you can't find any?

Security through obscurity wins again.

Re:BFD

[SirThe]

Security through obscurity wins again.

Everyone knows that works so well for Microsoft.

Re:BFD

[merkki]

I get what you mean, but, how is Microsoft obscure?

Re:only elite haxors need apply

[icebike]

Never mind how many, I'm still wondering about that number.

I'm sure there is a swoosh involved somewhere, but what is the significance of 3133.70?

China

[C_Kode]

China is paying $1,000 and $6267.40 for any security bugs found in any of Googles web services. ;)

Re:only elite haxors need apply

[Cwix]

31337 = eleet (elite)

IE?

[dudpixel]

waiting for microsoft to start one of these for Internet Explorer or Windows. Then I can retire :)

Re:IE?

[jcaldwel]

Supposedly Verisign's iDefense labs will pay for IE exploits. Have a great retirement.

Re:Google Being Cheap

[JorDan Clock]

What makes you think these exploits are worth more on the "black market?"

How about Google starts listening to its forums?

[yourtallness]

Google, how about you solve some bugs/feature requests long overdue, for free (no bounty needed)? e.g. Word wrap for event titles in Google Calendar, lack of which has pissed off many a man?

What bugs get the eleet bounty?

[maxbash]

Wake me when the bounty is $ 9009.13

Re:What bugs get the eleet bounty?

[Shikaku]

It's OVER 9000!

Re:LOLWUT

[icebike]

Too old to pay much attention to kiddies I guess.

Re:only elite haxors need apply

[GameboyRMH]

Hand over your geek card, that's a 3-month suspension.

Re:Google Being Cheap

[GameboyRMH]

I would guess experience...because he's right.

Although not about the "exponentially" part. 3000^2=9 million. But yeah the black market price for any remote-exploitable bug starts higher than Google's biggest reward. And it's easier to get away with not paying taxes on the black market deal.