Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Management //

Patch Management

2/15/2018
08:05 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

Intel Boosts Bug Bounties in Wake of Spectre & Meltdown

Intel is increasing its bug bounty program in the wake of the controversy surrounding the Spectre and Meltdown vulnerabilities found within the company's x86 CPUs.

Intel created its first bug bounty program in March with the purpose of engaging the security community and incentivizing researchers to find vulnerabilities in the company's chips.

Now, in the wake of Spectre and Meltdown, the program is expanding.

The expanded Intel Corp. (Nasdaq: INTC) Bug Bounty Program, which the chip maker announced February 14, highlights three specific improvements to help deal with issues such as Spectre and Meltdown, as well as Intel's pledge to be more open to security concerns. (See Security Warning: Intel Inside.)

Specifically, the bug bounty program update focuses on side-channel vulnerabilities, which are akin to Spectre and Meltdown, which came to light earlier this year, following the release research paper that has dinged Intel's reputation in the security community. (See Intel CEO Promises Chips That Fix Spectre & Meltdown Flaws .)

These updates include:

  • A shift away for an invitation-only program to one that is open to all security researchers, which should increase the pool of those looking for flaws and vulnerabilities in the company's CPUs.
  • Between now and December 31, Intel will offer rewards of up to $250,000 for information on side-channel vulnerabilities.
  • An overall increase in the amount of money the company pays in bug bounties, including as much as $100,000 for details about certain vulnerabilities and flaws.

"We believe these changes will enable us to more broadly engage the security research community, and provide better incentives for coordinated response and disclosure that help protect our customers and their data," Rick Echevarria, vice president of Software and Services Group and the general manager of Platforms Security Division, wrote in Wednesday's blog post.


The fundamentals of network security are being redefined -- don't get left in the dark by a DDoS attack! Join us in Austin from May 14-16 at the fifth-annual Big Communications Event. There's still time to register and communications service providers get in free!

The specific requirements about how to apply to the bug bounty program and what it takes to collect the bounties can be found on Intel's security site.

When news about Spectre and Meltdown broke in January, Intel issued several patches to fix the problem, but those were criticized as slowing down CPU performance, as well as other problems. ZDNet recently reported on a test that showed issues with the Meltdown patch. (See Linus Torvalds: Intel's Spectre Patch Is 'Complete & Utter Garbage'.)

Other companies have looked to offer different tools to help mitigate the problems with Spectre and Meltdown. This week, Microsoft Corp. (Nasdaq: MSFT) offered a free update to its Windows Analytics service that allows IT departments to track Spectre and Meltdown updates and issues throughout a PC fleet.

In addition, Microsoft released a security update on Tuesday to fix issues in Outlook, Internet Explorer, Windows, Office, Edge and other products. Redmond also updated the frequently asked questions section of its Security TechCenter site to address issues related to side-channel vulnerabilities.

Related posts:

— Scott Ferguson, Editor, Enterprise Cloud News. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Browsers to Enforce Shorter Certificate Life Spans: What Businesses Should Know
Kelly Sheridan, Staff Editor, Dark Reading,  7/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15106
PUBLISHED: 2020-08-05
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally ...
CVE-2020-16192
PUBLISHED: 2020-08-05
LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters.
CVE-2020-17364
PUBLISHED: 2020-08-05
USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs.
CVE-2020-4481
PUBLISHED: 2020-08-05
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181848.
CVE-2020-5608
PUBLISHED: 2020-08-05
CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to bypass authentication and send altered c...