Google's Pwnium V to last forever and offer unlimited money rewards -- get rich, y'all!

Paying developers and users for discovering security vulnerabilities has become rather commonplace. You know what? Good. Why shouldn't the "average Joe" have the opportunity to earn some cheddar in exchange for making software more secure? It's a win / win proposition.

Every year, Google announces the annual Pwnium event, in which people have one day to show off a Chrome browser or Chrome OS exploit and get money. The problem? Limiting this activity to one day per year limits the opportunity. In other words, why not pay people all year long for discovering exploits? Well, Google is doing exactly that; Pwnium V will last forever and offer unlimited money rewards. Ready to get rich?

"Around this time each year we announce the rules, details and maximum cash amounts we’re putting up for our Pwnium competition. For the last few years we put a huge pile of cash on the table (last year it was e million) and gave researchers one day during CanSecWest to present their exploits. We’ve received some great entries over the years, but it’s time for something bigger", says Tim Willis, Hacker Philanthropist, Chrome Security Team.

Willis further explains, "starting today, Pwnium will change its scope significantly, from a single-day competition held once a year at a security conference to a year round, worldwide opportunity for security researchers. For those who are interested in what this means for the Pwnium rewards pool, we crunched the numbers and the results are in: it now goes all the way up to $∞ million".

Hah! Infinity million is rather funny, but Willlis explains that the Google legal team's collective heads were going to explode because of it. As a result, he shares the below disclaimer.

Our lawyercats wouldn’t let me say “never-ending” or “infinity million” without adding that “this is an experimental and discretionary rewards program and Google may cancel or modify the program at any time”. Check out the reward eligibility requirements on the Chrome VRP page.

So, why is Google making this change? The search-giant shares three specific reasons.

• Removing barriers to entry: At Pwnium competitions, a security researcher would need to have a bug chain in March, pre-register, have a physical presence at the competition location and hopefully get a good timeslot. Under the new scheme, security researchers can submit their bugs year-round through the Chrome Vulnerability Reward Program (VRP) whenever they find them.
• Removing the incentive for bug hoarding: If a security researcher was to discover a Pwnium-quality bug chain today, it's highly likely that they would wait until the contest to report it to get a cash reward. This is a bad scenario for all parties. It’s bad for us because the bug doesn’t get fixed immediately and our users are left at risk. It’s bad for them as they run the real risk of a bug collision. By allowing security researchers to submit bugs all year-round, collisions are significantly less likely and security researchers aren’t duplicating their efforts on the same bugs.
• Our researchers want this: On top of all of these reasons, we asked our handful of participants if they wanted an option to report all year. They did, so we’re delivering.

If you are talented enough, you can earn some serious money from Pwnium V. The highest payout for a single exploit is $50,000, but to earn that Google says you must "compromise a Chromebook or Chromebox with device persistence in guest mode".

Will you try and get paid for finding Chrome-based exploits? Tell me in the comments.

Photo Credit: Pavel L Photo and Video / Shutterstock