Slashdot Mirror
Microsoft To Pay $200k Prize For New Security Tech
Trailrunner7 writes "In the face of mounting external pressure to begin paying bug bounties, Microsoft is instead launching a new program that will pay a $200,000 top prize to a security researcher who develops the most innovative defensive security technology. The program is designed to 'inspire researchers to focus their talents on defensive technologies,' the company said. Known as the Blue Hat Prize, after the company's regular internal research conferences, the program will focus in its first year on getting researchers to design a novel runtime technology to defend against memory safety vulnerabilities. Microsoft security officials said that rather than paying for individual bugs the way that some other companies such as Google, Mozilla and others do, they wanted to encourage researchers to think about ways to defeat entire classes of bugs."
Awesome! That'll pay for 15 graduate students!
If I develop something capable of winning this prize, I'm productizing it and making Microsoft pay for EULAs for it. That'll net me a lot more than $200k just from them, and more from everyone else.
And that's all I have to say about that.
Wire hooked up from the USB port delivers a 5 volt shock when user clicks on a malware site.
I'm not a lawyer, but I play one on the Internet. Blog
Linus Torvalds just opened a new bank account.
A 5 volt shock... yeah, that'll teach 'em!
If they persist, fetch the dreaded 9 volt batteries from the armoury!
Trolling is a art,
It's pocket change for Microsoft, but high enough to attract real interest. And $200,000 is just the beginning. Microsoft will make a very lucrative offer to whomever innovates at that level.
Wire hooked up from the USB port delivers a 5 volt shock when user clicks on a malware site.
I've always preferred positive over negative reinforcement.
Whenever a player quits EVE to go play WoW, the Average IQ of both games increase.
So every time you click on a non-malware site, then.... what?
"to defend against memory safety vulnerabilities"
Funny that they are restricting peoples talents like this. There may be better ways to defend against malware than this, which I don't think they are trying to defend against. It seems like this type of defensive vector might be more geared to DRM/TPM.
A whoosh sound plays over the speakers.
So every time you click on a non-malware site, then.... what?
your computer gives you an orgasm.
cat
If only the USB people had allowed for 3-phase power in the original spec...
I'm not a lawyer, but I play one on the Internet. Blog
When should I expect my cheque?
So every time you click on a non-malware site, then.... what?
your computer gives you an orgasm.
Wait, don't porn sites generally have the most malware?
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
I mean correct me if I'm wrong but it sounds like rather then actually plugging the holes that cause problems, they are looking for another antivirus equivalent to try and stop things once they fall into the holes? It sounds like a bug bounty system that doesn't want to actually involve fixing bugs.
That's going to be the most help. Make out the check to fsf. You're welcome.
Help stamp out iliturcy.
Like antivirus, and antimalware, they're trying to provide active defenses for when code tries to do something bad. ... but they continue to ignore the fact that the best defense is to not run bad code to begin with. They're so gung-ho on making it easy for the user to do what they want to do (which is an admirable enough goal) that we have:
Instead they're trying to install laser-turrets to shoot down every incoming mosquito after it's already intruded into our secure zone. Sure, that's nice too, but it's not a substitute.
Hey Bob, no talk of subluxation this time? Getting subtler in your trolling, eh?
So Microsoft's big idea is to buy software that other people have made?
I suppose it's not a bad business model, buy something that someone else created and rebrand it to sell it yourself...I mean hey, it worked for them before, right?
But why can't the world's largest software company do this themselves? I understand the need for an "outsider" to have a different perspective, but it seems that they should still be able to do this themselves.
Almost 30 years, and you still suck at life. Way to go, Microsoft.
Even if this competition was about developing secure operating systems - which it is not - there are operating systems out there (though not in popular use) that are way more secure that Linux in implementation, design, or both.
First to permanently turn Bob's computer off will probably win the prize.
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
This kind of contest worked pretty darn well for Netflix.
STOP HIDING FILE EXTENSIONS!
Really, this has got to be the premiere cause of users not gaining some semblance of understanding in the basics of Windows-based computing. Once users start seeing these little tags after the name of a file, everything becomes much easier to explain and suddenly users are undimmed, if not enlightened.
that's what I was thinking. They'll blow billions every 3 months on BING and have blown billions on Zune and Windows CE but when it comes to security for Windows, the product which allows them to spend/waste so many billions, they offer a $200k bounty if you qualify? As you said, "How CHEAP of them!".
Then again, it's probably just another PR stunt.
LoB
"Anyone who stands out in the middle of a road looks like roadkill to me." --Linus
It's about ways to protect against bugs/exploits... specifically, about ways to protect against entire classes of bugs/exploits. In this case, they can learn a little from other systems, but it's not exactly innovative:
1. No running as administrative user. Make it impossible to modify anything that isn't in the home directory of the user without logging out, and logging back in as an administrator. Make it impossible to run an executable from the home directory unless you're running with admin privileges. Make it impossible to elevate permissions without logging out and back in as an administrator. Introduce a minor annoyance when you're running as administrator that will convince users to log out and run as a regular user... something like disabling the sound card when you're running as admin coupled with a screen overlay reminding users that they're running as admin, and disabling aero/screen graphics effects.
2. Set the default to have all ports closed, and to ignore ICMP packets.
3. Make it impossible for programs to open up incoming ports on the consumer version of the OS.
That won't prevent idiots from getting themselves infected... it's pretty well impossible to prevent idiots from getting themselves infected without removing the ability to expand on the factory configuration. It will, however, help protect against the majority of virus vectors currently in use. It'll also annoy users enough that they'll drop Microsoft like a used kleenex, and wouldn't make good business sense for them.
Unplug the network cable.
Tada! Instant security.
So rise up, all ye lost ones, as one, we'll claw the clouds.
Maybe you'll get a box of MS Word retail packages with a MSRP of $400 each instead of a check?
And then when you sell them on Ebay, MS will use the DMCA to have the auctions removed.
Option 1: Disable network connection. Now you can only hack yourself. Option 2: Nuke the world; cockroaches can't hack. Nobody, no problem. Please send the money to the address in my profile. Thx.
Never say never. Ah!! I did it again!
Valve is paying 1 million dollars for people playing a videogame.
Just asking.
Why is Snark Required?
They want to "defend against memory safety vulnerabilities?" I assume that they're talking about buffer overflows, if nothing else, and I can think of a couple of ways to prevent them: 1) non-von Neumann architecture; or, and here I'm going really crazy, I know, with an idea that'd disrupt the entire industry: 2) stop using bloody C.
Mind the Gap
Replace web browsers by virtual machines.
Rationale: web browsers are WAY too complicated to be ever secure; virtual machines, on the other hand need to support only a relatively small set of base instructions; as extra advantages, virtual machines are also more flexible and may relieve developers from the browser-compatibility headaches they've been having for years. Let's do it :)
If Pandora's box is destined to be opened, *I* want to be the one to open it.
I thought a Blue Hat was a Black Hat that couldn't get laid,
pocket calculator and a typewriter, and a fire-proof safe. These will cost you less than a reasonable PC and give you many years of service. Just send a couple of $1000 in real currency, none of the e-Money/net-money crap!
There was an unknown error in the submission.
Microsoft employed capability researcher Jonathan Shapiro for some time, but not any more. I wonder if that's because they decided it was too hard, unfeasible, never wanted caps at all, or some other reason. Caps would definitely be a way to defeat several if not most classes of bugs. In fact I have never encountered another method of computer security that seems credible.
http://no-spec.com/ [no-spec.com]
This is no different. M$'s "prize" is less than it would cost to PAY people to conduct the equivalent research. This kind of "contest" which is really "exploitation" should be considered an(other) unfair labour practice.
I'm paying $200,000 for your $1,000,000 working product... oh wait.
You could reverse the polarity of the electrical connection :-p
Don't kid yourself. It's the size of the regexp AND how you use it that counts.