Google pays $381,000 in bug bounties

Powered by SC Magazine
 

Payments used to squash 1100 vulnerabilities since November 2010.

Google has paid some $381,000 to close 1100 legitimate vulnerabilities under its bug bounty programme since its inception.

The vulnerabilities ranged from low to high severity and were reported by more than 200 individuals. Some 730 bugs qualified for reward.

Google security team technical program manager Adam Mein said that the programme "has been a big success".

The company received 43 bug reports in the week after the reward programme, an extension of Chromium Security Research, was launched in November 2010.

“Roughly half of the bugs that received a reward were discovered in software written by approximately 50 companies that Google acquired; the rest were distributed across applications developed by Google (several hundred new ones each year). Significantly, the vast majority of our initial bug reporters had never filed bugs with us before we started offering monetary rewards.”

Google accepts vulnerability reports for its google.com platform, as well as in YouTube, blogger.com and Orkut.

The base reward for qualifying bugs is $469, and if the rewards panel finds a particular bug to be severe or unusually clever, rewards of up to $2936 may be issued. The panel also said that it may also decide a single report actually constitutes multiple bugs requiring reward, or that multiple reports constitute only a single reward.

Mein said Google has gotten better and stronger as a result of this work and said  bug bounty programmes help build better relationships with the security research community.

This article originally appeared at scmagazineuk.com

Copyright © SC Magazine, US edition


Google pays $381,000 in bug bounties
 
 
 
Top Stories
Content, cost & constant innovation: How Foxtel plans to take on Netflix
Nell Payne inhabits the “brave new world of blue strings and networking”. Just don't ask her to put a TV screen on your microwave.
 
Westpac fires starting pistol on core banking upgrade
St George readies itself for move to Celeriti.
 
Sending in the drones
Margins are getting tighter in the industrial services industry, so Transfield Services' Stephen Phillips looks offshore - and to the skies - for the solutions he needs to keep pace.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Should Optus make a bid for iiNet?

   |   View results
Yes
  43%
 
No
  57%
TOTAL VOTES: 565

Vote