Slashdot Mirror
Google Ups Bug Bounty To $20,000
Trailrunner7 writes, quoting Threatpost: "Search giant Google said it is quintupling the top bounty it will pay for information on security holes in its products to $20,000. Google said it was updating its rewards and rules for the bounty program, which is celebrating its first anniversary. In addition to a top prize of $20,000 for vulnerabilities that allow code to be executed on product systems, Google said it would pay $10,000 for SQL injection and equivalent vulnerabilities in its services and for certain vulnerabilities that leak information or allow attackers to bypass authentication or authorization features."
I am sure Google is employing many many very able programmers, but if Google has to pay bounty to hackers up to $20,000 to find bugs, does that mean the programmers who are sitting in Google's offices around the world have phailed?
Muchas Gracias, Señor Edward Snowden !
How does this work, then?
Do people look at this and say, "Wow, when it was $2k I wasn't interested, but now it's $20k I'll spend days of my life looking through Google code in the hope of finding a bug!"
Or is this a way of enticing black hats to come clean?
Bounty hunting makes sense when there's a lot to catch, as then everyone has a reasonable chance of success. But this is like asking privateers to waste their time looking for French ships sailing up the Thames on a Wednesday which the Navy have missed. Sure, once or twice you're going to be the first to spot a particularly egregious Frenchie meandering up the river on a Wednesday, but it's really not a particularly interesting or promising mission, is it?
Bug bounty: http://dilbert.com/strips/comic/1995-11-13/
Granted it's external rather than internal pay for a bug, but at $20k a piece, it wouldn't take a sleazy employee like ratbert long to figure out...
Why not make it an even $23294 and keep the theme?
think that said "Bugs Bunny"?
Have some brownie points to go towards your 'do no evil' moto, it needs them before it falls down.
1. Bugs are getting harder to find, especially ones that can be exploited
2. Criminals are paying good money for quality exploits.
3. It's cheaper than hiring more people to do it.
make imaginary.friends COUNT=100 VISIBLE=false
I guess the question now is, for most of us, how do you become a good security researcher? Seriously, are there any specific tools, trainings, tutorials, non-blackhat methods available?
Aside from being good business sense on the accounting side of things, this is also a PR move. The hip company pays the nerds who can help them out taking advantage of the CLOUD! I mean crowd. Did I say cloud?
I can tell you that it depends on which product group you are active in.
some teams like the C++ product group have (at least when I was an MVP) a very good relationship with their MVPs. this included getting developers to look at weird bugs, getting lots of interesting information, technical previews, etc. From my experience, the low level groups (SDK, DDK, C++) had a very active private community going with their MVPs.
For people interested in the product they were working with (C++ and SDK for me) being an MVP can be a rewarding experience, because you get a lot of technical inside information, people to talk with, an MSDN subscription, some free incidents with Microsoft support, etc.
Other (often the larger) product groups had virtually no real relationship with their MVPs, and some groups just treated them like unpaid 1st level support. Or in some cases they just plain ignored them. What it means to be an MVP and what you get out of it really depends entirely on your category and interest group. It can range from very good to very crappy.
Settings -> Personal Stuff -> Manage Saved Passwords -> Click on any password -> Click Show
Google bugs YOU!
This sig is not paradoxical or ironic.