HOME     MENU     SEARCH     NEWSLETTER    
NEWS & INFORMATION FOR TECHNOLOGY PURCHASERS. UPDATED 2 MINUTES AGO.
You are here: Home / Linux/Open Source / Google Offers Chrome Bug Bonuses
Druva Endpoint Backup:
Enterprises Realize Simple Secure Backup with Druva
www.druva.com
Google Ups Ante for Chrome Bug Hunters
Google Ups Ante for Chrome Bug Hunters
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
AUGUST
17
2012


Bugs are an unpleasant fact of life for browser-makers -- but Google is proving just how serious it is about getting to the root of them. Google on Thursday launched a new Chromium Vulnerability Rewards Program to encourage bug hunters to report open doors in its open source browser.

With the new program, Google is essentially upping the ante for security researchers who invest their time to make Chromium more secure. Google so far has paid out more than $1 million in rewards to security researchers but software engineer Chris Evans said there's been a drop off in reports recently.

"This signals to us that bugs are becoming harder to find, as the efforts of the wider community have made Chromium significantly stronger," Evans wrote in a blog post. Google figures harder-to-find bugs demand higher-than-usual rewards and is responding accordingly.

Big Bounty Bonuses

Under the new Chromium Vulnerability Rewards Program paradigm, Google is adding a bonus of $1,000 or more on top of the base reward for what it calls "particularly exploitable" issues.

"The onus is on the reporter to provide a quick demonstration as part of the repro," Evans explained. "For example, for a DOM-based use-after-free, one might use JavaScript to allocate a specific object type in the 'freed' slot, resulting in a vtable dereference of 0x41414141."

Google is also adding a bonus of $1,000 or more on top of the base reward for bugs in stable areas of the code base. By "stable," Evans said, Google means that the defect rate appears to be low. Google is also adding a bonus of $1,000 or more on top of the base reward for serious bugs that impact a significantly wider range of products beyond Chromium.

What does Google mean by over "$1,000 or more on top of the base reward"? Google can decide that on a case-by-case basis. Some rewards have reached as high as $10,000.

Beyond Google Chrome

But Google isn't stopping with Chrome. The Chromium Vulnerability Rewards Program continues to cover vulnerabilities in Adobe Flash as well as other well-known software such as the Linux kernel, various open-source libraries and daemons, X windows, and so on.

We caught up with Greg Sterling to get his take on the changes Google is making to its Chromium Vulnerability Rewards Program. He told us this move highlights Google's obvious interest in identifying and fixing security flaws.

"Crowd sourcing that function, as many companies are doing, is very smart and more effective than leaving it up to an internal team," Sterling said. "By raising the bounties it pays it will get more attention and time from hackers and others. There's a competitive market for their time and Google is competing with others."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
Forrester study shows 187% ROI with Druva Endpoint Backup: In a commissioned study conducted by Forrester Consulting on behalf of Druva, Forrester found that the costs and benefits for a composite organization with 3,000 inSync users, based on customer interviews, are: 1) 187% return on investment, and 2) Total cost savings and benefits of $3.8 million. Click here to access the study now.
MORE IN LINUX/OPEN SOURCE
Product Information and Resources for Technology You Can Use To Boost Your Business

NETWORK SECURITY SPOTLIGHT
The FBI is pointing the finger of blame for the Sony Pictures cyberattack directly at North Korea. The hackers stole confidential data and caused the movie giant to can its new comic film, "The Interview."

ENTERPRISE HARDWARE SPOTLIGHT
Almost half of consumer, industry and life sciences manufacturers are expected to be using 3D printers within three years and now 3D printing services are aiming to help companies experiment.

© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.