Articles about Bug Bounty

AgileBits, the company behind popular password manager 1Password, is raising the top bug bounty reward from $25,000 to $100,000, following the discovery of serious vulnerabilities in popular password managers, including its own service, that could have allowed attackers to gain access to user data.

To receive the highest reward in its bug bounty program, AgileBits says that a researcher would have to access an unencrypted "bad poetry" flag that is stored in a 1Password vault.

Continue reading →

Keen as ever to squash any security issues and bugs that might arise in their software, both Microsoft and Google have announced increases in their bug bounty program payouts. Microsoft has doubled some awards, while Google has used others to make knowing jokes.

Two increased rewards from Google include "leet" references. Find a Remote Code Execution bug and you could bag yourself $31,337 (up from $20,000); execute "Unrestricted file system or database access" and you could earn $13,337 (up from $10,000). While Google's increases are permanent, however, Microsoft's are just temporary.

Continue reading →

Already an attractive option for a variety of consumer applications, crowd sourcing is now catching on in the corporate world. One emerging area of crowd sourcing is bug bounty programs. These are rewards offered by organizations to security researchers or whitehat hackers, who receive recognition and financial compensation for finding and reporting bugs, exploits and vulnerabilities in the organizations’ websites and applications.

As a technology company or security professional, it’s easy to see the attraction of running bug bounty programs. But these programs are not without risk, and timing can be a critical factor. Unless they are managed carefully, bug bounty programs can come with serious consequences for your overall security posture.

Continue reading →

Hackers are having a moment. As high-profile breaches have become the norm over the last few years, more and more enterprise organizations have turned to bug bounty programs. As a result, the idea of hacking for good has finally begun to resonate with the general public. This rise in popularity has inspired many, from aspiring hackers to seasoned security professionals, to join the hunt and seek out bug bounty programs to "hack on".

As an information security professional by trade and a hacker by heart, I’ve had years of experience hacking for good. From my days as a penetration tester and security leadership roles at HP Fortify, Redspin and Citrix to hacking on bug bounty programs of all sizes, I have spent my life hacking for good -- much of this experience has been hacking on bug bounty programs.

Continue reading →

Apple has historically been very guarded and secretive. While this is still true today, the company has definitely become more open after Steve Job's death. Quite frankly, the fact that there are now public betas for both iOS and macOS is mind-blowing for the Apple faithful. Last month, the company even launched its first bug bounty program! Why did Apple soften its guarded position? It had to. As the technology market advances, and security becomes a bigger focus, it is not possible to catch all bugs and vulnerabilities in house.

While the bug bounty and public betas were very wise moves, the company is apparently taking things a step further. According to Forbes, Apple is enlisting iPhone jailbreakers and other hackers (such as Luca Todesco, Nicholas Allegra and Patrick Wardle) to bolster the security of its products using the aforementioned bug bounty program. In fact, it is rumored to be happening at a secret meeting. If true, is the company smart to trust these people?

Continue reading →

What kind of people spend their time looking for software bugs? Crowdsourced testing company Bugcrowd has released a report looking at how its community is made up that might give you a clue.

Bugcrowd researchers come from all over the world, as of September 1, 2016, the United States (29 percent) and India (28 percent) had the most sign-ups, followed by the United Kingdom on six percent.

Continue reading →

Bug bounty programs have become commonplace in recent years. Tech companies offer up rewards to coders, engineers and hackers who manage to unearth security vulnerabilities in software, and this means that problems are detected and patched faster than normal.

It is something that the likes of Google and Microsoft have offered for some time, and now Apple has decided it wants a piece of the action as well. Starting in September, the company will pay out up to $200,000 to anyone identifying vulnerabilities in its software and services.

Continue reading →

With data breaches still making headlines and security teams facing increased pressures it's not surprising that companies are looking for innovative ways to find flaws in their systems.

Crowdsourced security specialist Bugcrowd has released the results of its second annual State of Bug Bounty Report which shows that the number of bug bounty programs hosted on its platform is up by an average of 210 percent year on year since January 2013.

Continue reading →

Uber is calling on independent computer researchers and experts to find weaknesses in its system as the transportation firm is set to release its technical map.

As Uber jumps into the bug bounty bandwagon -- a philosophy that has long been advocated by the open-source software movement -- it details its software infrastructure to the public, identifies what sorts of data might be exposed inadvertently and suggests what types of flaws are the most likely to be found.

Continue reading →

A recent incident with the Facebook Bug Bounty program has led to many different reactions supporting both Facebook and the security researcher. Regardless of who is right in that whole story, the one fact is clear: the researcher went far beyond what the social media site had initially expected, and got access to the sensitive data the company didn’t really want to share with anybody, including the researchers’ community.

These days bug bounties have become very popular, raising more and more questions about their efficiency and effectiveness. We will try to understand how and if bug bounties can be used to test your corporate web applications. I intentionally omit bug bounties for stand-alone software (e.g. Chrome or various IoT applications) as it’s a different topic.

Continue reading →

You might think you have the best programmers in the world, but chances are there’s a kid in his parents’ basement somewhere who’s smarter than all your engineers combined.

That’s why bounty hunting for bugs has become hugely popular among software makers, employing pretty much every hacker worldwide in their search for overlooked bugs. Microsoft is one of such companies, and it’s using the Black Hat conference to promote its new bug bounty program, which sees the bounty doubled.

Continue reading →

Bounty hunters can make a killing if they uncover security problems with software. There are lots of companies who will pay out in cold, hard cash to anyone who managed to unearth security vulnerabilities, and Mozilla has announced that it is increasing its top level bounty.

The company is appealing to white hat hackers and security experts to help plug holes in its software, and it is willing to cough up for it. Mozilla's security program had already paid out $1.6 million over the years, and the Client Bug Bounty Program has just been updated so that maximum payout is now $10,000.

Continue reading →

Bounty programs benefit everyone. Companies like Microsoft get help from security experts, customers gain improved security, and those who discover and report vulnerabilities reap the rewards financially. Or at least that's how things are supposed to work.

Having reported a series of security problems to discount and deal site Groupon, security researcher Brute Logic from XSSposed.org was expecting a pay-out -- but the site refuses to stump up the cash. In all, Brute Logic reported more than 30 security issues with Groupon's site, but the company cites its Responsible Disclosure policy as the reason for not handing over the cash.

Continue reading →

It's not unknown for technology companies to run bounty programs that reward bug hunters for unearthing problems with software. Discover a security vulnerability and you could be in line for a nice cash bonus. Microsoft is one firm that runs such a program, and today the Microsoft Bounty Program is being expanded -- with a particular focus on Azure and Project Spartan.

Microsoft has already been asking for feedback about Windows 10 Technical Preview, but this is the first time a financial reward has been offered for pointing out security issues with any of its components. The maximum pay-out has been increased to $15,000 USD, so there's more incentive than ever to seek out problems and report them to Microsoft.

Continue reading →

There are award shows for everything nowadays, celebrating actors, athletes and more. However, computer nerds do not get the credit they deserve; we should get an award show too, right? Hell, they should give out trophies for fixing family members' computers. I have spent hours at my Uncle Roy's smelly house removing malware, only to leave with not so much as a thank you.

Don't worry though, Google cares about your nerdy endeavors -- if it helps the Chrome browser, that is. You see, the search giant is increasing the maximum bounty for finding bugs in the browser to $15,000. While money is awesome, the recognition may be equally cool, as your name may be added to the Google Hall of Fame!

Continue reading →