Slashdot Mirror
Microsoft Launches Bounty Program For Speculative Execution Side Channel Vulnerabilities (betanews.com)
An anonymous reader shares a report: Microsoft has launched a bug bounty program that will reward anyone who finds the next Meltdown or Spectre vulnerability. Known as speculative execution side channel vulnerabilities, Microsoft is willing to reward anyone who reports bugs that could cause problems like earlier in the year. The rewards on offer range from $5,000 up to $250,000 depending on the severity of the vulnerability, and the bounty program runs until the end of 2018. Microsoft says that it will operate under the principles of coordinated vulnerability disclosure.
Why is microsoft interested in paying bug bounties for hardware it doesnt make itself. Is this the new microsoft interfering in someone else's business? I know intel and microsoft have some sort of secret pact to support each other, but in recent years that friendship seems to be evaporating. So again, why? I suspect foul play at work here yet again from a convicted monopolist.
"Microsoft is willing to reward anyone who reports bugs that could cause problems like earlier in the year"
Like, earlier in the year, like, January? February? How early in the year are we talking?
It's not in our best interest to report it to Microsoft. It's in our interest to leverage it. Microsoft is afraid because Azure is full of security holes. IBM, Microsoft, and Amazon is pushing Cloud hosted services to business. The truth is there is nothing more secure than a private air gapped datacenter providing services for a business. If your business is hosted in the Cloud, it's not a matter of would you get hacked, it's a matter of when. If you are an IT Professional and you don't want your job outsourced or lost because the services are hosted in the Cloud, write code to leverage what you found and when the time is right, make it public.
Speculative Side Channel Vulnerabilities is just one method. Did you know that the IP stack has many vulnerabilities ? The NSA is aware of most of them.
They were more than likely aware of the Speculative Side Channel Vulnerabilities as well. I don't doubt that they were put in place on purpose. I am willing to bet
Intel and AMD hired engineers that were actually NSA agents. Who knows, perhaps they are still working there. There's actual hostile development activity as well. Cheap routers and switches with backdoors programmed in, IoT devices with back doors.
Never assume your posts or data are private. I'd imagine my very post is being monitored. There's nothing wrong with the post. I'm just saying if you think your data is safe and it hosted on a system connected to the net, you are mistaken. Only secure systems are air gapped with vetted users.
Any data installed on the air gapped system must be downloaded on a bastion host, scanned, and scrutinized.
250k is nothing compared to what a usable, 0-day bug like this would be worth on the black market.
Microsoft surely could have afforded to offer more?
M$ Wlndows is a vulnerability. Send my reward to Linux so they can fix what Winblows can't..
"the principles of coordinated vulnerability disclosure".
Coordinated with whom, the gov?
Many eyes make all bugs shallow!
Oh wait, Eveil M$ wants people to file bugz? And reward them for doing so? EEIVL!!!111
nt
That's an awfully specific bug bounty program. Finding something as severe as Meltdown/Spectre in hardware is 1 in a million. It took almost two decades to realize the fundamental design flaws in the way predictive branching was built but the Internet was new-ish back then and security was low on the priority list.
I hope Microsoft can pad that program out with other ultra-specific programs or there will be crickets chirping.
"Known as speculative execution side channel vulnerabilities, Microsoft is willing to reward anyone who reports bugs that could cause problems like earlier in the year. "
Microsoft has been called many things, but nobody calls it "speculative execution side channel vulnerabilities".