HOME     MENU     SEARCH     NEWSLETTER    
NEWS & INFORMATION FOR TECHNOLOGY PURCHASERS. UPDATED 7 MINUTES AGO.
You are here: Home / Linux/Open Source / Google Offers Chrome Bug Bonuses
Google Ups Ante for Chrome Bug Hunters
Google Ups Ante for Chrome Bug Hunters
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
AUGUST
17
2012
Bugs are an unpleasant fact of life for browser-makers -- but Google is proving just how serious it is about getting to the root of them. Google on Thursday launched a new Chromium Vulnerability Rewards Program to encourage bug hunters to report open doors in its open source browser.

With the new program, Google is essentially upping the ante for security researchers who invest their time to make Chromium more secure. Google so far has paid out more than $1 million in rewards to security researchers but software engineer Chris Evans said there's been a drop off in reports recently.

"This signals to us that bugs are becoming harder to find, as the efforts of the wider community have made Chromium significantly stronger," Evans wrote in a blog post. Google figures harder-to-find bugs demand higher-than-usual rewards and is responding accordingly.

Big Bounty Bonuses

Under the new Chromium Vulnerability Rewards Program paradigm, Google is adding a bonus of $1,000 or more on top of the base reward for what it calls "particularly exploitable" issues.

"The onus is on the reporter to provide a quick demonstration as part of the repro," Evans explained. "For example, for a DOM-based use-after-free, one might use JavaScript to allocate a specific object type in the 'freed' slot, resulting in a vtable dereference of 0x41414141."

Google is also adding a bonus of $1,000 or more on top of the base reward for bugs in stable areas of the code base. By "stable," Evans said, Google means that the defect rate appears to be low. Google is also adding a bonus of $1,000 or more on top of the base reward for serious bugs that impact a significantly wider range of products beyond Chromium.

What does Google mean by over "$1,000 or more on top of the base reward"? Google can decide that on a case-by-case basis. Some rewards have reached as high as $10,000.

Beyond Google Chrome

But Google isn't stopping with Chrome. The Chromium Vulnerability Rewards Program continues to cover vulnerabilities in Adobe Flash as well as other well-known software such as the Linux kernel, various open-source libraries and daemons, X windows, and so on.

We caught up with Greg Sterling to get his take on the changes Google is making to its Chromium Vulnerability Rewards Program. He told us this move highlights Google's obvious interest in identifying and fixing security flaws.

"Crowd sourcing that function, as many companies are doing, is very smart and more effective than leaving it up to an internal team," Sterling said. "By raising the bounties it pays it will get more attention and time from hackers and others. There's a competitive market for their time and Google is competing with others."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.
MORE IN LINUX/OPEN SOURCE
Product Information and Resources for Technology You Can Use To Boost Your Business
© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.