Dear Visitor,

Our system has found that you are using an ad-blocking browser add-on.

We just wanted to let you know that our site content is, of course, available to you absolutely free of charge.

Our ads are the only way we have to be able to bring you the latest high-quality content, which is written by professional journalists, with the help of editors, graphic designers, and our site production and I.T. staff, as well as many other talented people who work around the clock for this site.

So, we ask you to add this site to your Ad Blocker’s "white list" or to simply disable your Ad Blocker while visiting this site.

Continue on this site freely
  HOME     MENU     SEARCH     NEWSLETTER    
NEWS & INFORMATION FOR TECHNOLOGY PURCHASERS. UPDATED 9 MINUTES AGO.
You are here: Home / Data Security / Google Offers Chrome Bug Bonuses
Google Ups Ante for Chrome Bug Hunters
Google Ups Ante for Chrome Bug Hunters
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
AUGUST
17
2012

Bugs are an unpleasant fact of life for browser-makers -- but Google is proving just how serious it is about getting to the root of them. Google on Thursday launched a new Chromium Vulnerability Rewards Program to encourage bug hunters to report open doors in its open source browser.

With the new program, Google is essentially upping the ante for Relevant Products/Services researchers who invest their time to make Chromium more secure. Google so far has paid out more than $1 million in rewards to security researchers but software engineer Chris Evans said there's been a drop off in reports recently.

"This signals to us that bugs are becoming harder to find, as the efforts of the wider community have made Chromium significantly stronger," Evans wrote in a blog post. Google figures harder-to-find bugs demand higher-than-usual rewards and is responding accordingly.

Big Bounty Bonuses

Under the new Chromium Vulnerability Rewards Program paradigm, Google is adding a bonus of $1,000 or more on top of the base reward for what it calls "particularly exploitable" issues.

"The onus is on the reporter to provide a quick demonstration as part of the repro," Evans explained. "For example, for a DOM-based use-after-free, one might use JavaScript to allocate a specific object type in the 'freed' slot, resulting in a vtable dereference of 0x41414141."

Google is also adding a bonus of $1,000 or more on top of the base reward for bugs in stable areas of the code base. By "stable," Evans said, Google means that the defect rate appears to be low. Google is also adding a bonus of $1,000 or more on top of the base reward for serious bugs that impact a significantly wider range of products beyond Chromium.

What does Google mean by over "$1,000 or more on top of the base reward"? Google can decide that on a case-by-case basis. Some rewards have reached as high as $10,000.

Beyond Google Chrome

But Google isn't stopping with Chrome. The Chromium Vulnerability Rewards Program continues to cover vulnerabilities in Adobe Flash as well as other well-known software such as the Linux kernel, various open-source libraries and daemons, X windows, and so on.

We caught up with Greg Sterling to get his take on the changes Google is making to its Chromium Vulnerability Rewards Program. He told us this move highlights Google's obvious interest in identifying and fixing security flaws.

"Crowd sourcing that function, as many companies are doing, is very smart and more effective than leaving it up to an internal team," Sterling said. "By raising the bounties it pays it will get more attention and time from hackers and others. There's a competitive market for their time and Google is competing with others."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
MORE IN DATA SECURITY
NEWSFACTOR.COM
NEWSFACTOR NETWORK SITES
NEWSFACTOR SERVICES
© Copyright 2016 NewsFactor Network. All rights reserved. Member of Accuserve Ad Network.