Microsoft To Pay Up To $15K For Bugs In Two Visual Studio Tools (microsoft.com) 43
itwbennett writes: Yesterday, Microsoft started a three-month bug bounty program for two open source tools that are part of Visual Studio 2015. The program applies to the beta versions of Core CLR, which is the execution engine for .NET Core, and ASP.NET, Microsoft's framework for building websites and web applications. Bounties range from $500 to $15,000, although Microsoft will reward more 'depending on the entry quality and complexity.' The highest reward will go to researchers who've found a remote code execution bug with a functioning exploit and an accompanying, high-quality white paper. On the low end, cross-site scripting or cross-site request forgery bugs with a low-quality report will get $500.
I've got a deal for someone... (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
You missed the joke. I used C# syntax.
Re: (Score:2)
For $15K? Still not worth reporting it. (Score:3)
>> Core CLR...and ASP.NET
Those are kind of a big deal in corporate America. If you find a good zero-day in either of those, the market might pay more than that just to exploit it at a single company, let alone a universal exploit. I'm thinking Microsoft may need to put some real money into this program to keep researchers on the light side of the force.
There is no zero day exploit. It's still in dev (Score:1)
Re: (Score:2)
So a person would need to choose between making up to $15k in a legal fashion that ultimately makes a product more secure and could benefit many companies...or sell it to nefarious people possibly for more money, but your exploit is used to attack companies and ultimately may trace back to you. Decisions decisions decisions.
Re: (Score:2)
Re: (Score:2)
Wait...you mean a company would do something that would good for PR? I'm shocked that this could ever happen!
$15k? (Score:2)
That isn't enough to get me to jack in my job and go bug hunting full time.
Re: (Score:3)
If I knew for sure that I'd win the bounty, and that they'd pay the full $15k, and that it wouldn't take me too long to get it, I'd happily burn a little vacation time.
But otherwise, the mathematical expectation is way too low.
Re: (Score:3)
I don't think the intent is to motivate full time bug hunting but rather allow those who suspect a bug to have the motivation to dig deeper. This is especially true of those in the enterprise level security consulting where they have a responsibility of testing for vulnerabilities or understanding the source of a security failure at their customer's.
I know people who have monetized exploitation of a bug. The reward is often limited unless you are willing to go the next level of exploitation which has higher
Is it more or less than the market price? (Score:2)
Re: (Score:2)
no clue but bounty is almost almost a million rubles
A sensible approach to open source security (Score:5, Insightful)
Re: (Score:1)
Whenever I see the phrase "general purpose computer" it makes me shudder as it implies hardware that can be used for any purpose. The language used in that quote is to imply that this hardware can be used to molest your children and other more specific hardware can't be used for this purpose. lol
Does it have a processor that can contain run functions for your own use and RAM that isn't constrained by software and firmware that you don't control? Voila - it's a general purpose computer.
Even freakishly slante
Re: (Score:2)
Not to be too rude about it - but does anyone actually trust Microsoft to pay off on this unless the exploit is stupidly egregious?
If you want them to pay the $15k, you need to have a working exploit, and XSS doesn't count, even though it should.
So no, they've stated they won't pay unless the exploit is stupidly egregious.
I think the most ironic part is that... (Score:2)
I think the most ironic part is that they are willing to pay up to $15K for a bug + a white paper on the bug, but not willing to pay anything more, should you include patches that actually fix the bug.
You would think that a bug *fix* was the end goal.
I'm of two minds, as to why this is the case:
(1) They just don't get this whole "Open Source" thing yet, although they seem to be trying really, really hard
(2) The intent of the program is actually to get the white papers, rather than the bug fixes. That, in t
Re: (Score:3)
I'm not in any way involved with this specific program, but I do work on VisualStudio.
It's pretty common for all kinds of software projects to take bug reports - even very detailed and thorough ones - from people who ultimately don't end up fixing the bug.
The interesting thing about finding a security bug - especially with the constraints described here - a working exploit and a white paper - it's pretty unambiguous that you've found one. You either have or you haven't.
Now, how to actually fix that bug mig