Microsoft still bucks bug bounty trend

Powered by SC Magazine
 

Redmond says BlueHat is better.

The richest and biggest software company in the world still won’t pay researchers for disclosing vulnerabilities despite a growing number of its peers opting to do so.

Microsoft thinks bug bounties are superfluous: its Microsoft Security Response Centre (MSRC) team were constantly inundated with free vulnerability reports from researchers looking for fame, not fortune. Up to 80 per cent of Microsoft vulnerabilities were privately and freely reported.

Researchers had a variety of motivations behind reporting bugs and money was not necessarily chief among them, Microsoft security boss Mike Reavey said.

“I don’t think that filing and rewarding point issues is a long-term strategy to protect customers."

Redmond’s new BlueHat competition -- which pays handsomely for defensive security solutions -- was more effective, he said, and more appealing to those who consider security research an “intellectual pursuit”.

Reavey said BlueHat participants had respect because they were builders and breakers.

“Rewarding $200,000 for finding techniques that blocks an entire class of exploits scales better, and better protects customers.”

Companies including Google, Mozilla, Facebook and Samsung were some of an expanding list of companies prepared to shell out for privately-disclosed vulnerabilities.

PayPal was the latest to join that list this week after the company’s chief security officer Michael Barrett changed his tune on paying for vulnerabilities.

“I originally had reservations about the idea of paying researchers for bug reports, but I am happy to admit that the data has shown me to be wrong – it’s clearly an effective way to increase researchers’ attention on internet-based services and therefore find more potential issues,” Barrett said.

He said the experience from companies that pay for bugs was “very positive”.

Researchers could earn a dollar from Microsoft vulnerabilities through HP's Zero Day Initiative, which pays for reported bugs and supplies them to affected vendors for free.

Microsoft’s MSRC receives between 100,000 to 200,000 emails each year that range from critical vulnerability disclosures down to user requests to help deal with malware infections.

Of those, about 1000 were triaged and around 150 were considered vulnerabilities.

Only 16 have been released as more costly out-of-band security releases, and the remainder pushed through Microsoft’s monthly patch Tuesday updates.

Details on PayPal's bug bounty is available online.

Copyright © SC Magazine, Australia


Microsoft still bucks bug bounty trend
 
 
 
Top Stories
NSW to build its own myGov
Service NSW digital profiles available by September.
 
Australia's leaders agree to end GST-free online goods
Gerry Harvey may finally get his way.
 
What to expect from Abbott's national cyber security strategy
Key policy architect reveals focus of new document.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Microsoft reveals Microsoft Send, a new enterprise chat app to rival Slack
Jul 27, 2015
Microsoft Send is MSN Messenger for grownups, and you could be using it at work very soon
Developers offered $500,000 grants to find HoloLens uses
Jul 8, 2015
Can augmented-reality end up in business?
Microsoft Tossup: The planning app for unorganised groups of friends
Jul 8, 2015
App allows friends to research venues, vote on plans and chat. And depending on how you run your ...
Windows 10 drops 29 July... but only for some
Jul 6, 2015
If you've reserved your copy of Windows 10 and are keenly awaiting its 29 July release, don't ...
Xerocon is heading to Melbourne!
Jul 1, 2015
We're not saying Xero is our FAVOURITE or anything, but Xero's 2015 Xerocon conference is being ...
Latest Comments
Polls
Should law enforcement be able to buy and use exploits?



   |   View results
Yes
  13%
 
No
  51%
 
Only in special circumstances
  17%
 
Yes, but with more transparency
  18%
TOTAL VOTES: 678

Vote