Slashdot Mirror
Microsoft Launches $100k Bug Bounty Program
Trailrunner7 writes "After years of saying that the company didn't need a bug bounty program, Microsoft is starting one. The company today will announce the start of a new program that will pay security researchers up to $100,000 for serious vulnerabilities and as much as $50,000 for new defensive techniques that help protect against those flaws. Microsoft security officials say that the program has been a long time in development, and the factor that made this the right time to launch is the recent rise of vulnerability brokers. Up until quite recently, most of the researchers who found bugs in Microsoft products reported them directly to the company. That's no longer the case. The system that Microsoft is kicking off on June 26 will pay researchers $100,000 for a new exploit technique that is capable of bypassing the latest existing mitigations in the newest version of Windows."
How much does the NSA then pay for the bugs? ;-)
Bugs? In Windows? I'm gonna be rich!
Better late than never. Microsoft exploits have been traded and sold to security companies owned by intelligence agencies for years now. At least now the researchers discovering the bugs have an incentive to sell to microsoft and get the bug fixed instead of selling it to the highest bidder who will probably use it to create either "private"-malware or government-malware. Thank you m$
There could be an influx of bug reports, I guess all those zero days waiting in the wings for a buyer, they might be cashed in, which is the whole point of this program, so the question is why did it take 15 years to arrive?
Metro. Eagerly awaiting my check for $100k.
After just one hour since they announced they "100k per bug" program, over 4 million bugs unique bugs were reported. When looking for comment, Steve Ballmer was seen parasailing into the sunset on his golden parachute.
Bank offer is $100K, do you take it or risk losing it to someone else while you figure out a "defensive technique" and collect the extra $50K?
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
Now all those slashdotters who keep insisting that Windows is ridden with security bugs (like they were in the early 2000s) have an opportunity to put up or shut up.
1) Pay for exploits up to 100,000
2) Sell exploits to NSA for up to 200,000, guaranteed unpatched for x days
3) Patch exploit; forcing NSA to buy more exploits
4) Repeat steps
5) Profit!
So up to a short time ago people did this for free? But now they are worth 100K a pop?
Troll is not a replacement for I disagree.
Update: the going price for an exploit in XP is $5 in Xbox Live credit, lol.
time to go hunt me some bugs
He seems to only be comparing the API that Java and C# have in common. C# has gone way beyond java with async/await, true generics, properties, dynamic objects, the var keyword, and many more features. Sure, they are comparable languages if you just use the subset of C# that maps to Java.
I've always wanted to be a part of one of these. I have no hacker skills but I can spot bugs.
will pay researchers $100,000 for a new exploit technique that is capable of bypassing the latest existing mitigations in the newest version of Windows."
In this style: http://technet.microsoft.com/en-us/security/bulletin/ms12-020
Bug no.: 54321
Severity: Critical
FAQ: Allows privilege escalation
Mitigating factors:
1. There are only 3 genuine users of the latest version of our operating system
2. We care a damn about affected earlier versions since those lousy bastards need to upgrade anyway
So it is a bug yes, latest version affected yes, but Bounty for you? No!!
If you keep throwing chairs, one day you'll break windows....
https://www.openrightsgroup.org/blog/2013/nsa-affects-responsible-disclosure
At least from now on, the only responsible disclosure is full disclosure.
I think that by making this decision, Microsoft is clearly slapping the 'slashdot crowd' in the face. Real Hard. They are fucking sick of your hater bullshit. I am with them, personally. They have sound product that has stood the test of time. Fuck you and your slashdot elitist crap. I DARE you to break windows.
I'm fully in support of this. They have the resources and knowledge to fix this from the root up. Just tell them what they did wrong, and they'll fix it. Hate them? too bad... just say whats wrong, and let them please let them fix the world? The rest of them have to deal with Windows... help them live through the pain.
Thanks,
Me
Microsoft could have secured the operating system with this steps: At install point, require an Admin password to be set, next, Make the Admin account useless for other use than administrative tasks (including installing software). Then, make a user account with low privileges for regular use.
I have been working as a techie for many years, and most of the problems i have encountered could have avoided if the user was required to log in to the admin account to install crapware.
Dear Microsoft,
I have found a terrible bug in windows 8. I don't know how it got through testing, but the start button and its menu is missing. It isn't actually letting adversaries *in* to the system but it is letting an awful lot of users *out* of the system. So I'm hopeful that you can stretch the definition of "security bugs" to cover "financial security of Microsoft bugs" and get a check headed my way.
Can't get people to buy your latest piece of software?
Simply offering a generous bug bounty may be enough to convince technologists to buy and use your software.
While the cost of the program is likely greater than the related sales, said technologists will become accustomed to your new software and push it on to their families, their friends, their neighbours, their customers and their workplaces. Genius marketing is genius.
[Rent This Space]
capable of bypassing the latest existing mitigations in the newest version of Windows
So if someone finds a juicy exploit in Windows 7, then his only potential choices are (a) a pat on the back from Balmer, or (b) sell it to the bad guys?
You'd have to pay me $100k to just use Windows 8, let alone find a bug
The biggest bug is the UI, could someone start a kickstarter to raise funds to pay a bunch of developers to fix that one?
you: "I found a bug that allows an attacker to compromise the system. Here is a write up of a proof of concept of the bug and a demo of the compromise." microsoft: "that's not a bug, that a feature."
Hacky McHacker: "Then you'll welcome the publicity when I demonstrate that feature. Cheerio!"
microsoft: "Lets not be too hasty mister McHacker..."
Comment removed based on user account deletion
The NSA needs better exploits.
What better way than to get Micro$oft to pay for them before sharing!
Just saying...
Apples, meet Oranges.
Comment removed based on user account deletion
Hardware is much more easily validated, and usually much less easily updated after the fact. And that is just the way it is. Anyone even basically familiar with both would know this.
Comment removed based on user account deletion
It's easier to validate a CPU (even the most high end of CPUs) than it is to validate an operating system and every service and application that comes with it including drivers and other software that will _later_ run on it for every possible security, functional, or nonfunctional flaw.
Don't be a fucking idiot.
To get a few more Windows 8 sales