News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
You are here: Home / Data Security / Google Offers Chrome Bug Bonuses
Gartner's #1 for endpoint backup
Google Ups Ante for Chrome Bug Hunters
Google Ups Ante for Chrome Bug Hunters
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
AUGUST
17
2012



Bugs are an unpleasant fact of life for browser-makers -- but Google is proving just how serious it is about getting to the root of them. Google on Thursday launched a new Chromium Vulnerability Rewards Program to encourage bug hunters to report open doors in its open source browser.

With the new program, Google is essentially upping the ante for security researchers who invest their time to make Chromium more secure. Google so far has paid out more than $1 million in rewards to security researchers but software engineer Chris Evans said there's been a drop off in reports recently.

"This signals to us that bugs are becoming harder to find, as the efforts of the wider community have made Chromium significantly stronger," Evans wrote in a blog post. Google figures harder-to-find bugs demand higher-than-usual rewards and is responding accordingly.

Big Bounty Bonuses

Under the new Chromium Vulnerability Rewards Program paradigm, Google is adding a bonus of $1,000 or more on top of the base reward for what it calls "particularly exploitable" issues.

"The onus is on the reporter to provide a quick demonstration as part of the repro," Evans explained. "For example, for a DOM-based use-after-free, one might use JavaScript to allocate a specific object type in the 'freed' slot, resulting in a vtable dereference of 0x41414141."

Google is also adding a bonus of $1,000 or more on top of the base reward for bugs in stable areas of the code base. By "stable," Evans said, Google means that the defect rate appears to be low. Google is also adding a bonus of $1,000 or more on top of the base reward for serious bugs that impact a significantly wider range of products beyond Chromium.

What does Google mean by over "$1,000 or more on top of the base reward"? Google can decide that on a case-by-case basis. Some rewards have reached as high as $10,000.

Beyond Google Chrome

But Google isn't stopping with Chrome. The Chromium Vulnerability Rewards Program continues to cover vulnerabilities in Adobe Flash as well as other well-known software such as the Linux kernel, various open-source libraries and daemons, X windows, and so on.

We caught up with Greg Sterling to get his take on the changes Google is making to its Chromium Vulnerability Rewards Program. He told us this move highlights Google's obvious interest in identifying and fixing security flaws.

"Crowd sourcing that function, as many companies are doing, is very smart and more effective than leaving it up to an internal team," Sterling said. "By raising the bounties it pays it will get more attention and time from hackers and others. There's a competitive market for their time and Google is competing with others."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY BE OF INTEREST
IT departments are embracing cloud backup, but there's a lot you need to know before choosing a service provider. Learn all the critical things you need to know by accessing the white paper, "5 Things You Didn't Know About Cloud Backup". Access the White Paper now.
MORE IN DATA SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Dairy Queen Latest Retailer To Report Hack
Known for its hot fries and soft-serve ice cream, Dairy Queen just made cyber history as the latest victim of a hack attack. The fast food chain said that customer data at some stores may be at risk.
 
Lessons from the JPMorgan Chase Cyberattack
JPMorgan Chase is investigating a likely cyberattack. The banking giant is cooperating with law enforcement, including the FBI, to understand what data hackers may have obtained.
 
Who Is the Hacker Group Lizard Squad?
Are they dangerous or just obnoxious? That’s what many are wondering about the hacker group Lizard Squad, which tweeted out a bomb threat that grounded a flight with a Sony exec aboard.
 

Enterprise Hardware Spotlight
Intel Intros Lightning-Fast PC Processors
Call it extreme. Intel just took the covers off its first-ever eight-core desktop processor, which is aimed at hardcore power users who expect more than the status quo from their computers.
 
HP Previews ProLiant Gen9 Data Center Servers
Because traditional data center and server architectures are “constraints” on businesses, HP is releasing new servers aimed at faster, simpler and more cost-effective delivery of computing services.
 
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 

Mobile Technology Spotlight
iWatch Watch: What Will Apple Ask Us To Wear?
There are still more questions than answers when it comes to details about the smart watch Apple seems poised to debut on Sept. 9. In fact, nobody seems completely sure that it will be a smart watch at all.
 
Samsung Maps Its Way with Nokia's 'Here' App for Galaxy Phones
Korean electronics giant Samsung has opted to license Here, Nokia’s mapping app -- formerly known as Nokia Maps -- for its Tizen-powered smart devices and Samsung Gear S wearable.
 
Google Successfully Tests Its Own Delivery Drone
While top technology companies are engaged in an "arms race" to develop drones that can quickly deliver goods to anyone anywhere, Google has revealed it successfully tested its own version.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.