Microsoft Joins Bug-Bounty Movement After a Long Delay
Mozilla does it, Google does it, Facebook does it. Now, Microsoft will also pay for vulnerabilities, as much as $100,000, but only on its own terms.Breaking a longstanding moratorium on paying for information on vulnerabilities in its software products, Microsoft announced June 19 that the company has created two programs that will pay researchers for information on software flaws and a third that will reward researchers who create defensive measures. The software company will pay $100,000 to any researcher who develops a technique to bypass the defenses of the latest version of Microsoft's operating system, Windows 8.1. In a second vulnerability-reward program, the company will also pay up to $11,000 for each bug found during the first 30 days of the beta period of its latest version of Internet Explorer, Katie Moussouris, senior security strategist lead for Microsoft's Trustworthy Computing group, told eWEEK. "What we are looking for are new ways to bypass our mitigations," she said. "We want to learn about these new ways to punch holes in our shields, so we can develop defenses that work platform-wide and block those types of attacks." In addition to the two bug-bounty programs, Microsoft will also reward researchers who create novel ways to foil exploitation methods. Under its BlueHat Bonus for Defense program, also announced June 19, the company will award a $50,000 prize for techniques for blocking current attacks that bypass its defenses.
The programs come after years of criticism by some researchers and hackers that Microsoft should solve its security problems by paying for bugs. For more than a decade, security researchers have bristled at reporting bugs to Microsoft for free. While the company made billions of dollars on its software, researchers complained that they were expected to provide free quality assurance in the form of bug reports, or face criticism for being irresponsible. For a number of years, Microsoft had referred to the vulnerability reporting process as "responsible disclosure," if the researchers worked with the company to fix the issue before publicizing the flaw.