Slashdot Mirror

← Back to Stories (view on slashdot.org)

Metasploit Launches Exploit Bounty Program

Posted by Soulskill on from the lighting-a-fire dept.

Trailrunner7 writes "The team behind the Metasploit Project is launching its own version of a bug bounty program: cash payouts for working exploits. The group is hoping to get exploit code for as many of its top 30 vulnerabilities as possible before the program expires later this summer. The amount of money paid for a working exploit module for Metasploit depends on the value of the vulnerability. A module for one of the vulnerabilities in the top five list — which includes a flaw in Google Chrome and another in the Windows DNS client — is worth $500. Modules for vulnerabilities in the separate top 25 list are worth $100 each under the rules."

16 of 26 comments (clear)

  1. Re:First Bug by Drethon · · Score: 1

    The first thing that comes up with the Windows Phone... seems appropriate to the not so subtle hint here

  2. Caveat by 93+Escort+Wagon · · Score: 2, Funny

    Modules for vulnerabilities in the separate top 25 list are worth $100 each under the rules.

    Unfortunately the bounties are being paid using Bitcoin.

    --
    #DeleteChrome
  3. I think they might need to offer more money by elucido · · Score: 1

    If the price is right, I and others might take them up on their offer.
    $500 isn't enough money. I can't even buy a decent computer with that.

    They need to offer at least $1000, and if it's an exploit that has to be exactly what they are looking for then it should be several thousand.

    1. Re:I think they might need to offer more money by 0100010001010011 · · Score: 2

      Considering google Is offering $1337 it really doesn't seem like a lot.

    2. Re:I think they might need to offer more money by elucido · · Score: 2

      $1337 is enough money to buy a brand new computer. It's enough money to pay rent for a month. That's the kind of money that would make me invest the time.

      And of course they need a system of determining who is working on what and some sort of reservation system. If I agree to write code, I don't want anyone else writing the same code. Anyway it's a start, and I hope more companies and websites start offering these kinds of bounties. They won't have any problem finding people looking to write exploit code in this economy.

    3. Re:I think they might need to offer more money by Julie188 · · Score: 2

      My thoughts exactly. Mozilla and Google are offering about $3,000 for exploits and TippingPoint has got a whole multi-tiered points-scheme for them. Some of the exploits they want modules for look pretty complicated, and worth more than $100. But given that many people would contribute to Metasploit for free, I suppose its still a nice Bug Bounty experiment.

      Julie

    4. Re:I think they might need to offer more money by Anonymous Coward · · Score: 1

      This is a completely false analogy. Mozilla, Google, and TippingPoint have bounty programs to buy *bugs* (not exploits) that have not been previously disclosed. This program is looking for *exploits* for bugs that have already been made public. While there's a huge difference in the amount of effort required to develop reliable exploit code versus simply identifying a vulnerability, the fact that the bugs are already public significantly decreases the value these exploits could fetch on alternative markets. Considering it's all in the name of community effort and everything will be released under a BSD license, it seems like this is supposed to be a way to reward contributors who might have written these exploits anyway and be just enough to convince potential contributors to pitch in, rather than a true "pay people for their work" scenario.

    5. Re:I think they might need to offer more money by elucido · · Score: 1

      This is a completely false analogy. Mozilla, Google, and TippingPoint have bounty programs to buy *bugs* (not exploits) that have not been previously disclosed. This program is looking for *exploits* for bugs that have already been made public. While there's a huge difference in the amount of effort required to develop reliable exploit code versus simply identifying a vulnerability, the fact that the bugs are already public significantly decreases the value these exploits could fetch on alternative markets. Considering it's all in the name of community effort and everything will be released under a BSD license, it seems like this is supposed to be a way to reward contributors who might have written these exploits anyway and be just enough to convince potential contributors to pitch in, rather than a true "pay people for their work" scenario.

      Nah, they are just doing this because they can get most of the code written by kids in India somewhere where $100 means something.

    6. Re:I think they might need to offer more money by ginbot462 · · Score: 1

      Not california or new england. But, would work in the south.

      --
      Atlas Shrugged : Thematic Story :: Battlefield Earth : Organized Religion
  4. it's about time by v1 · · Score: 1

    I'm amazed it took this long for this public of a bounty to get going. The blackhat market has traded in exploits for years now, and vendors have just now really started getting on the bug-bounty-bandwagon, it was only a matter of time before metasploit and other popular "other side of the fence" offers came up. I wonder what Zeus's authors are paying nowadays? And I wonder what exactly the results of competition in this sector will be? (good for us? bad for us? just a good show?)

    --
    I work for the Department of Redundancy Department.
    1. Re:it's about time by elucido · · Score: 2

      Definitely good. Most of this exploit code looks trivial to write, just time consuming.

      The more money they put up to allow people to make money, the more people they'll have writing exploit code.

  5. Let the market decide the price by Anonymous Coward · · Score: 1

    Surely the best thing for them to do would be to let the market decide the price. People can then 'bid' to be the person that received information about the vulnerability, and then other people can try to outbid them if they value that exploit more. Metasploit could then take a cut of the price, just like eBay.

    Companies particularly interested in getting information first about exploits in their software could bid high to ensure their offer is always taken up first.

    1. Re:Let the market decide the price by elucido · · Score: 1

      That is actually a very good idea.

  6. Not bad, but more than $100. by elucido · · Score: 1

    If they are only paying $100 to write the code, that's just cheap.

    When the bounties reach $1000, and there are plenty of bounties to choose from that could work.

  7. Re:Sounds like a honeypot by elucido · · Score: 1

    is it illegal to write an exploit?

  8. Too Little by Anonymous Coward · · Score: 1

    I like Metasploit and I know they haven't got the funds for big bounties but $100 is a joke. I can make that sort of money doing an hour of code review consulting work rather than spending a week trying to find some elusive BoF with zero-knowledge. Anything less than a few grand just isn't worth it when you can get a much greater return of investment of your effort elsewhere.