Google pays $381,000 in bug bounties

Powered by SC Magazine
 

Payments used to squash 1100 vulnerabilities since November 2010.

Google has paid some $381,000 to close 1100 legitimate vulnerabilities under its bug bounty programme since its inception.

The vulnerabilities ranged from low to high severity and were reported by more than 200 individuals. Some 730 bugs qualified for reward.

Google security team technical program manager Adam Mein said that the programme "has been a big success".

The company received 43 bug reports in the week after the reward programme, an extension of Chromium Security Research, was launched in November 2010.

“Roughly half of the bugs that received a reward were discovered in software written by approximately 50 companies that Google acquired; the rest were distributed across applications developed by Google (several hundred new ones each year). Significantly, the vast majority of our initial bug reporters had never filed bugs with us before we started offering monetary rewards.”

Google accepts vulnerability reports for its google.com platform, as well as in YouTube, blogger.com and Orkut.

The base reward for qualifying bugs is $469, and if the rewards panel finds a particular bug to be severe or unusually clever, rewards of up to $2936 may be issued. The panel also said that it may also decide a single report actually constitutes multiple bugs requiring reward, or that multiple reports constitute only a single reward.

Mein said Google has gotten better and stronger as a result of this work and said  bug bounty programmes help build better relationships with the security research community.

This article originally appeared at scmagazineuk.com

Copyright © SC Magazine, US edition


Google pays $381,000 in bug bounties
 
 
 
Top Stories
Qld Transport to replace core registration system
State's biggest citizen info repository set for overhaul.
 
Innovating in the sleepy super industry
There’s little incentive to be on the bleeding edge, so why is Andrew Todd fighting so hard?
 
How technology will unify Toll
The systems headache formed through 15 years of acquisitions.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  7%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  5%
TOTAL VOTES: 844

Vote