Microsoft will pay $186k to fix memory holes

By
Follow google news

Prefers 'defensive tech' over vulnerability bounty-hunting.

Microsoft will pay $US200,000 ($A186,000) to anyone who finds a fix to memory safety vulnerabilities.

Microsoft will pay $186k to fix memory holes

The Blue Hat Prize, launched at the BlackHat hacker conference in Las Vegas, was "designed to generate new ideas for defensive approaches to support computer security", Microsoft said.

The first-place winner will need to improve anti-exploit technology such as sandboxes and data-execution prevention that is vulnerable to attacks or develop a different solution.

"Your prototype must solve an open problem in exploit mitigation or significantly improve the effectiveness of existing mitigation solutions. Two examples of open problems that are suitable for consideration in this challenge are address space information disclosures and return-oriented programming. Note that you are not required to address these and you are not limited to these examples."

It must also not impose more than a 5 percent burden on processing and memory and not disrupt application compatibility or useability.

The winner will be available to Microsoft under an "irrevocable, perpetual, royalty-free, worldwide, unlimited, non-exclusive, sub-licenceable, unrestricted right and licence", it said.

Microsoft was one of the few software companies to have refused to pay for software vulnerabilities.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

Australia's AUKUS base to connect to subsea cables

Australia's AUKUS base to connect to subsea cables

Commercial spyware targeted Samsung Galaxy users for months

Commercial spyware targeted Samsung Galaxy users for months

Westpac factors post-quantum cryptography prep into "secure router" rollout

Westpac factors post-quantum cryptography prep into "secure router" rollout

Researcher trawls cybercrime sites, collects billions of stolen credentials

Researcher trawls cybercrime sites, collects billions of stolen credentials

Log In

  |  Forgot your password?