Vulnerabilities / Threats

05:51 PM
Connect Directly

New Bucks For Bugs Program Focuses On Open-Source Software, Internet Infrastructure

Microsoft and Facebook co-sponsor community bug bounty program that pays researchers for flaws found in popular open-source software, Internet protocols

Programs that pay security researchers for finding flaws in software have become all the rage, and now a new bug bounty program launched this week rewards finding vulnerabilities in key open-source software platforms as well as the underlying Internet infrastructure.

Microsoft and Facebook -- under the auspices of HackerOne -- are co-sponsoring The Internet Bug Bounty, a program that pays anywhere from $300 to $2,500 for a new vulnerability found in key open-source platforms, such as OpenSSL, Python, Ruby, PHP, Django, Rails, Perl, Phabricator, Ngix, and Apache httpd. The program also rewards a minimum of $5,000 to researchers who find working flaws in sandbox technologies, and a minimum of $5,000 for bugs found in the Internet's underlying infrastructure, such as DNS, SSL, or PKI, for example.

"I'm really happy about this program," says renowned security researcher Dan Kaminsky, who discovered a key DNS bug in 2008 that affected a large portion of the Internet. "The black market has gotten so hot because there are so many players doing criminal activities ... more accurately, they are out to compromise systems, and that takes a lot of work even to identify a flaw [to exploit].

"If nothing else, this program provides direct incentive for people to raise the quality of [software] flaw analysis," he says, pointing to the program's emphasis on quality vulnerability finds that pose real risks to the Internet community and its well-defined guidelines that promote responsible hacking.

Not all bug discoveries will actually qualify for a bounty payment, either, according to the program's disclaimer. In the case of Internet bugs, for example, the criteria for a paid flaw is one that affects multiple products, affects a significant number of users, or is "severe" or "novel," for instance.

There are two rewards for each bug -- one for finding it and the other for fixing it. So a researcher could make twice as much money by discovering and repairing a flaw.

Both Microsoft and Facebook, like many major vendors today, have established their own bug bounty programs that pay researchers who find flaws in their products.

"Facebook and Microsoft are funding the initial round, but this is a broader community effort involving participation from a range of backgrounds. We're all invested in the security of the Internet, and since we've all seen the positive benefits from bug bounty programs, it was a natural extension for some of the heaviest users of the Web to partner up to help protect it," says Alex Rice, product security lead at Facebook.

[How Microsoft's new bug bounty program will play in the quest for more secure software. See Microsoft's Big Bucks For Bugs Ups The Ante .]

A panel of volunteers from the security community is charged with managing the program, including Microsoft's Katie Moussouris, Matt Miller, Roman Porter, and Arthur Wongtschowski; Facebook's Rice, Neal Poole, and Colin Greene; Chrome's Chris Evans; iSec Partners' Jesse Burns; and Etsy's Zane Lackey.

"The Internet Bug Bounty is accessible to a broad pool of security researchers and has the potential to improve security for a wide variety of technology users," says Moussouris, senior security strategy lead for Microsoft Trustworthy Security. "This bounty is a great way to support coordinated disclosure of critical vulnerabilities in shared components of the Internet stack."

Countering the black market for bugs, indeed, is the main incentive for heavy-hitters like Microsoft and Facebook to team up and sponsor a vulnerability reward program for open-source platforms, says Chris Wysopal, CTO at Veracode. "This is a reaction to that" black market for bugs, he says. "This is really trying to disrupt the offensive market. As the offensive side of vulnerability finding has grown, this is counterbalancing it."

And more secure open-software platforms also benefit those vendors, as well as the entire Internet community, security experts say. "This is definitely helping out those open-source projects," Veracode's Wysopal says. "And [the vendors involved] are also helping themselves because they use these products. It's a win for them and a win for the Internet, in general."

The closest thing to a bug bounty for finding flaws in open-source software is Google's new patch bounty, announced earlier this month. Google launched an experimental program that offers rewards for coming up with security improvements to key open-source projects, such as OpenSSH, BIND, Chromium, and KVM.

Open-source software is often considered the weak link in applications, as flaws in open-source code have been targeted by attackers looking for the quickest and simplest way to break into systems. Community software projects typically lack sufficient resources to stay on top of bugs and patches, so the new HackerOne program should help.

Whether this newfound abundance of bug bounty programs will boost or dilute efforts to secure software remains to be seen. Facebook's Rice says the new program complements existing ones. "We see this program as complementary to existing bug bounty programs, and it’s focused on covering areas of the Web that aren’t currently in scope for existing programs," he said in an email interview.

Kaminsky, chief scientist and co-founder of fraud prevention startup White Ops, says the bigger problem with many bug bounty programs has been lesser-quality bug finds, and this new program should raise the bar to avoid that. "What's good about having this overarching program is that it very much puts a stake in the ground that this is what a program should look like, these are the types of good bugs to pay for," he says.

The Internet Bug Bounty has inspired Wysopal to rethink Veracode's informal bug bounty program for its own software. The secure code firm currently sends a "thank you package" to a researcher who finds any flaws in its code: It has no official funding for a bounty program at this time. Wysopal says he thinks the program may pressure other vendors to pony up with monetary awards for bugs found in their software, even at Veracode: "Maybe I'll see if I can get some" funding now, he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Strategist
11/9/2013 | 3:04:58 PM
re: New Bucks For Bugs Program Focuses On Open-Source Software, Internet Infrastructure
Actually, from all that I have read, open source has similar rate of defects compared to commercial software, and is actually fixed faster by the respective community. The problem for most developers is that unless you sign up to a service that would proactively alert you, you will likely not know of the new vulnerability, and therefore will not fix.

Before we added such service to White Source, almost all our customers told us that no one is tasked with continuously monitoring the various web-based databases for new vulnerabilities that are discovered and that affect code used in their product. So they would not know, even if these would be discovered, and hence they wont fix....

Dont get me wrong. Its great to put more power behind the discovery, but the dissemination of information is where things get complicated. Its also not trivial to (automatically) match a CVE to a specific open source library.
Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
The Case for Integrating Physical Security & Cybersecurity
Paul Kurtz, CEO & Cofounder, TruSTAR Technology,  3/20/2018
A Look at Cybercrime's Banal Nature
Curtis Franklin Jr., Executive Editor, Technical Content,  3/20/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.