New Bucks For Bugs Program Focuses On Open-Source Software, Internet Infrastructure

Microsoft and Facebook co-sponsor community bug bounty program that pays researchers for flaws found in popular open-source software, Internet protocols

Programs that pay security researchers for finding flaws in software have become all the rage, and now a new bug bounty program launched this week rewards finding vulnerabilities in key open-source software platforms as well as the underlying Internet infrastructure.
Microsoft and Facebook -- under the auspices of HackerOne -- are co-sponsoring The Internet Bug Bounty, a program that pays anywhere from $300 to $2,500 for a new vulnerability found in key open-source platforms, such as OpenSSL, Python, Ruby, PHP, Django, Rails, Perl, Phabricator, Ngix, and Apache httpd. The program also rewards a minimum of $5,000 to researchers who find working flaws in sandbox technologies, and a minimum of $5,000 for bugs found in the Internets underlying infrastructure, such as DNS, SSL, or PKI, for example.
Im really happy about this program, says renowned security researcher Dan Kaminsky, who discovered a key DNS bug in 2008 that affected a large portion of the Internet. The black market has gotten so hot because there are so many players doing criminal activities ... more accurately, they are out to compromise systems, and that takes a lot of work even to identify a flaw [to exploit].
If nothing else, this program provides direct incentive for people to raise the quality of [software] flaw analysis, he says, pointing to the programs emphasis on quality vulnerability finds that pose real risks to the Internet community and its
well-defined guidelines
that promote responsible hacking.
Not all bug discoveries will actually qualify for a bounty payment, either, according to the programs disclaimer. In the case of Internet bugs, for example, the criteria for a paid flaw is one that affects multiple products, affects a significant number of users, or is severe or novel, for instance.
There are two rewards for each bug -- one for finding it and the other for fixing it. So a researcher could make twice as much money by discovering and repairing a flaw.
Both Microsoft and Facebook, like many major vendors today, have established their own bug bounty programs that pay researchers who find flaws in their products.
Facebook and Microsoft are funding the initial round, but this is a broader community effort involving participation from a range of backgrounds. Were all invested in the security of the Internet, and since weve all seen the positive benefits from bug bounty programs, it was a natural extension for some of the heaviest users of the Web to partner up to help protect it, says Alex Rice, product security lead at Facebook.
[How Microsofts new bug bounty program will play in the quest for more secure software. See
Microsofts Big Bucks For Bugs Ups The Ante
.]
A panel of volunteers from the security community is charged with managing the program, including Microsofts Katie Moussouris, Matt Miller, Roman Porter, and Arthur Wongtschowski; Facebooks Rice, Neal Poole, and Colin Greene; Chromes Chris Evans; iSec Partners Jesse Burns; and Etsys Zane Lackey.
The Internet Bug Bounty is accessible to a broad pool of security researchers and has the potential to improve security for a wide variety of technology users, says Moussouris, senior security strategy lead for Microsoft Trustworthy Security. This bounty is a great way to support coordinated disclosure of critical vulnerabilities in shared components of the Internet stack.
Countering the black market for bugs, indeed, is the main incentive for heavy-hitters like Microsoft and Facebook to team up and sponsor a vulnerability reward program for open-source platforms, says Chris Wysopal, CTO at Veracode. This is a reaction to that black market for bugs, he says. This is really trying to disrupt the offensive market. As the offensive side of vulnerability finding has grown, this is counterbalancing it.
And more secure open-software platforms also benefit those vendors, as well as the entire Internet community, security experts say. This is definitely helping out those open-source projects, Veracodes Wysopal says. And [the vendors involved] are also helping themselves because they use these products. Its a win for them and a win for the Internet, in general.
The closest thing to a bug bounty for finding flaws in open-source software is
Googles new patch bounty, announced earlier this month
. Google launched an experimental program that offers rewards for coming up with security improvements to key open-source projects, such as OpenSSH, BIND, Chromium, and KVM.
Open-source software is often considered the weak link in applications, as flaws in open-source code have been targeted by attackers looking for the quickest and simplest way to break into systems. Community software projects typically lack sufficient resources to stay on top of bugs and patches, so the new HackerOne program should help.
Whether this newfound abundance of bug bounty programs will boost or dilute efforts to secure software remains to be seen. Facebooks Rice says the new program complements existing ones. We see this program as complementary to existing bug bounty programs, and it’s focused on covering areas of the Web that aren’t currently in scope for existing programs, he said in an email interview.
Kaminsky, chief scientist and co-founder of fraud prevention startup White Ops, says the bigger problem with many bug bounty programs has been lesser-quality bug finds, and this new program should raise the bar to avoid that. Whats good about having this overarching program is that it very much puts a stake in the ground that this is what a program should look like, these are the types of good bugs to pay for, he says.
The Internet Bug Bounty has inspired Wysopal to rethink Veracodes informal bug bounty program for its own software. The secure code firm currently sends a thank you package to a researcher who finds any flaws in its code: It has no official funding for a bounty program at this time. Wysopal says he thinks the program may pressure other vendors to pony up with monetary awards for bugs found in their software, even at Veracode: Maybe Ill see if I can get some funding now, he says.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New Bucks For Bugs Program Focuses On Open-Source Software, Internet Infrastructure