Microsoft still bucks bug bounty trend

Powered by SC Magazine
 

Redmond says BlueHat is better.

The richest and biggest software company in the world still won’t pay researchers for disclosing vulnerabilities despite a growing number of its peers opting to do so.

Microsoft thinks bug bounties are superfluous: its Microsoft Security Response Centre (MSRC) team were constantly inundated with free vulnerability reports from researchers looking for fame, not fortune. Up to 80 per cent of Microsoft vulnerabilities were privately and freely reported.

Researchers had a variety of motivations behind reporting bugs and money was not necessarily chief among them, Microsoft security boss Mike Reavey said.

“I don’t think that filing and rewarding point issues is a long-term strategy to protect customers."

Redmond’s new BlueHat competition -- which pays handsomely for defensive security solutions -- was more effective, he said, and more appealing to those who consider security research an “intellectual pursuit”.

Reavey said BlueHat participants had respect because they were builders and breakers.

“Rewarding $200,000 for finding techniques that blocks an entire class of exploits scales better, and better protects customers.”

Companies including Google, Mozilla, Facebook and Samsung were some of an expanding list of companies prepared to shell out for privately-disclosed vulnerabilities.

PayPal was the latest to join that list this week after the company’s chief security officer Michael Barrett changed his tune on paying for vulnerabilities.

“I originally had reservations about the idea of paying researchers for bug reports, but I am happy to admit that the data has shown me to be wrong – it’s clearly an effective way to increase researchers’ attention on internet-based services and therefore find more potential issues,” Barrett said.

He said the experience from companies that pay for bugs was “very positive”.

Researchers could earn a dollar from Microsoft vulnerabilities through HP's Zero Day Initiative, which pays for reported bugs and supplies them to affected vendors for free.

Microsoft’s MSRC receives between 100,000 to 200,000 emails each year that range from critical vulnerability disclosures down to user requests to help deal with malware infections.

Of those, about 1000 were triaged and around 150 were considered vulnerabilities.

Only 16 have been released as more costly out-of-band security releases, and the remainder pushed through Microsoft’s monthly patch Tuesday updates.

Details on PayPal's bug bounty is available online.

Copyright © SC Magazine, Australia


Microsoft still bucks bug bounty trend
 
 
 
Top Stories
Beyond ACORN: Cracking the infosec skills nut
[Blog post] Could the Government's cybercrime focus be a catalyst for change?
 
The iTnews Benchmark Awards
Meet the best of the best.
 
Telstra hands over copper, HFC in new $11bn NBN deal
Value of 2011 deal remains intact.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Xero prepares for key feature coming in 2015
Dec 19, 2014
Xero users will be able to track how their business is comparing to other Xero users.
More 4G from Optus in Darwin
Nov 21, 2014
Click to see where Optus has expanded coverage to the suburbs near Darwin.
Optus steps up regional 4G coverage
Nov 20, 2014
Once 700Mhz services are working, Optus claims regional users will have a "faster and more ...
This Huawei 4G phone costs $99
Nov 12, 2014
The $99 Huawei Ascend Y550, available through Vodafone, enters the budget market as one of the ...
4G smartphones: Microsoft's Lumia 830
Nov 7, 2014
Microsoft has announced its flagship Windows Phone, the Nokia Lumia 830 4G, will be available in ...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 1780

Vote
Do you support the abolition of the Office of the Information Commissioner?