Slashdot Mirror
Microsoft To Pay Up To $15K For Bugs In Two Visual Studio Tools (microsoft.com)
itwbennett writes: Yesterday, Microsoft started a three-month bug bounty program for two open source tools that are part of Visual Studio 2015. The program applies to the beta versions of Core CLR, which is the execution engine for .NET Core, and ASP.NET, Microsoft's framework for building websites and web applications. Bounties range from $500 to $15,000, although Microsoft will reward more 'depending on the entry quality and complexity.' The highest reward will go to researchers who've found a remote code execution bug with a functioning exploit and an accompanying, high-quality white paper. On the low end, cross-site scripting or cross-site request forgery bugs with a low-quality report will get $500.
Whoever is working on building this code, we can split any bug bounty money 50/50...
Moooooo#####Moooooooo
You Loch Ness Monster! I ain't givin' you no tree-fiddy!
>> Core CLR...and ASP.NET
Those are kind of a big deal in corporate America. If you find a good zero-day in either of those, the market might pay more than that just to exploit it at a single company, let alone a universal exploit. I'm thinking Microsoft may need to put some real money into this program to keep researchers on the light side of the force.
That isn't enough to get me to jack in my job and go bug hunting full time.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Is the reward offered by this bug bounty program higher than what that exploit would fetch if sell them to Bulgarians or Russians? If not why not?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
dotNet Core is still in dev and no version of Windows yet ships with it. So no zero-dayness is possible. .Net Framework versions up to 4.6 are the current live versions
"In the quest for truth we must train ourselves to view our favourite ideas just as critically as those we oppose"
What is interesting however is the thought that developer, documentation and test contributions to open source are unpaid, but security contributions are paid for. Possibly this reflects a lesson of the past 30 years that pretty much nobody in the world is capable of shipping fully secure software for general purpose computers.
"In the quest for truth we must train ourselves to view our favourite ideas just as critically as those we oppose"
You got modded troll, but the closer it gets to being a "trusted" OS, the closer it gets to being malware. Remember "trusted" means they don't trust you, and that they control the platform.
"First they came for the slanderers and i said nothing."
So a person would need to choose between making up to $15k in a legal fashion that ultimately makes a product more secure and could benefit many companies...or sell it to nefarious people possibly for more money, but your exploit is used to attack companies and ultimately may trace back to you. Decisions decisions decisions.
No, they're paying good money for these kinds of remote exploits to hand over to the NSA. They'll attempt to look like they're dragging their feet and slowly implementing a fix but really they're allowing the exploits to be used as zero days in the meantime by the government.
Neither of the two products in discussion are in production yet.
Not to be too rude about it - but does anyone actually trust Microsoft to pay off on this unless the exploit is stupidly egregious?
That thought has to be on the minds of anyone looking to use this bounty program.
I'm not pro/con anyone for the most part and I wouldn't try submitting anything to this. It would just be bad business to trust a company that has repeatedly and succesfully covered up public exploits and vulnerabilities in the past. They've used their 'abundance of use'/penetration, financal, and legal resources so often it's basically an open secret among people who care about this kind of thing.
Just my two cents. *shrugs*
By the time you dig down through the code base, run the tests, develop the exploit code and write the paper...most devs could have earned twice that elsewhere. Otherwise, you'll only find glaring bugs.
Microsoft should invest in a platform like Watson and have it dedicated to evolving hacking solutions for each portion of its codebase. That's what intel agencies do and its the only way to ensure top quality code.
Apparently these types of exploits can be sold legally for $100k.
"First they came for the slanderers and i said nothing."
I think the most ironic part is that they are willing to pay up to $15K for a bug + a white paper on the bug, but not willing to pay anything more, should you include patches that actually fix the bug.
You would think that a bug *fix* was the end goal.
I'm of two minds, as to why this is the case:
(1) They just don't get this whole "Open Source" thing yet, although they seem to be trying really, really hard
(2) The intent of the program is actually to get the white papers, rather than the bug fixes. That, in turn, has several possible motivations, but I think the most likely of those motivations are:
(2)(A) They want to find security people to hire through this program, and this is easier than evaluating the honesty of a resume, or trusting an interview process to discern between someone who can't do the job, someone who can do it (but probably won't), and someone who can and will do the job. In other words, it's a pretty cheap candidate qualification mechanism, compared to traditional HR processes in this regard (qualified candidate acquisition probably costs them many multiples of $15K per qualified candidate they find, since they have to put the unqualified ones through the same process to weed them out). If so, it's clever an innovative.
(2)(B) They want to obtain an insight into the correct mindset to use when approaching an exploit, so that they can quantify it, and teach it to other people. This would be a much more ambitious use of the data, since not a day goes by when there isn't some idiot wanting to "learn security" from the perspective of someone who can do a systems penetration posting on Slashdot (in fact, there was a new article on it on Slashdot today, not just an isolated idiot post). I'm pretty sure that they will fail in this regard, but I do have to wonder if there is government "cyber warfare" (finger quotes intentional) dollars underwriting this.
So I'm generally suspicious of the motivations and/or cluefullness of such a program, but hey, having a program at all is a step forward.
The chance of getting tracked back to you is extremely slim. And $150k for a zero-day used for corporate espionage is definitely in the realm of possibility.
There isn't any amount of money Microsoft can offer. Put simply, they need to clean up their shitty code to have any effect.
And besides, why should Microsoft care about their customers? They're locked into inescapable contracts, file formats and boatloads of MCSE drones on the payroll...with no hope for escape. Oh and of course EULA indemnity against any defects.
Sorry this has to be just for good PR, and therefore probably hatched from the Marketing division.
And further, both are open source.
You missed the joke. I used C# syntax.
Wait...you mean a company would do something that would good for PR? I'm shocked that this could ever happen!
Visual Smarter has a lot of tools for Visual Studio. It's worth of a try:
Http://VisualSmarter.blogspot.com