Story image

$250,000 up for grabs in Microsoft's latest Windows Bounty Program

31 Jul 2017

Microsoft is offering up to US$250,000 (NZ$332,668/AU$313,047) in a new bug bounty program focused exclusively on ironing out the kinks in Windows 10. This time there’s a bigger payout for the Hyper-V bounty.

Last week the company launched the Windows Bounty Program, which includes all aspects of the Windows Insider Preview, as well as Hyper-V, Mitigation bypass, Windows Defender Application Guard and Microsoft Edge.

Microsoft says the program is ‘in the spirit of maintaining a high security bar in Windows’, and complements the company’s long list of defence technologies such as DEP, ASLR, CFC, CIG, ACG, Device Guard, Credential Guard and Windows Defender Application Guard.

The new bug bounty program aims to catch any critical or important remote code execution (RCE), privilege elevation or design flaws that compromise users’ security and privacy.’

However, if anyone discovers a vulnerability that Microsoft has already found, the bounty equated to 10% of the highest amount they could have received. In the case of a Hyper-V bounty ($US250,000), researchers would receive a payout of $25,000 if they found a RCE.

Microsoft has conducted several bounties since 2013, which reflects the changing nature of vulnerabilities and priorities in different points in time.

“Microsoft strongly believes in the value of the bug bounties, and we trust that it serves to enhance our security capabilities,” the company says.

There are also outstanding bounty programs for .NET and cloud applications, worth up to US$15,000 (NZ$19,960/AU$18,782).

Microsoft says that all security bugs are important, and users should report those bugs to secure@microsoft.com via Coordinated Vulnerability Disclosure (CVD) policy.

Interested researchers can also check out Bugcrowd’s list of current bug bounty programs from platforms such as Atlassian, Avira, Centrify, Cylance, HubSpot and 1Password.

However, bug bounty programs may not be alluring enough for some – recent reports suggest that Google’s bug bounties are not doing so well. Earlier this year the company’s Project Zero hacking contest failed to reward a single prize, despite rewards of up to US$200,000.

In the contest, there were no valid entries or bugs - instead there was just spam and entries that did not resemble what the company was after. Read more here. 

Microsoft’s bug bounty categories are below.

Who's watching you? 
With privacy an increasing concern amongst the public, users should be more aware than ever of what personal data companies hold.
Fake apps on Google Play scamming users out of cryptocurrency
Fake cryptocurrency apps on Google Play have been discovered to be phishing and scamming users out of cryptocurrency, according to a new report from ESET.
Managing data to comply with privacy regulations - Micro Focus
It’s crucial for organisations to be able to access, understand, and accurately classify the data they have so they know how to treat it.
Hackbusters! Reviewing 90 days of cybersecurity incident response cases
While there are occasionally very advanced new threats, these are massively outnumbered by common-or-garden email fraud, ransomware attacks and well-worn old exploits.
SEGA turns to Palo Alto Networks for cybersecurity protection
When one of the world’s largest video game pioneers wanted to strengthen its IT defences against cyber threats, it started with firewalls and real-time threat intelligence from Palo Alto Networks.
Forrester names Trend Micro Leader in email security
TrendMicro earned the highest score for technology leadership, deployment options and cloud integration.
LogRhythm releases cloud-based SIEM solution
LogRhythm Cloud provides the same feature set and user experience as its on-prem experience.
The impact of bringing biometrics to the door
"Despite the benefits of biometrics, there have been impediments to its broader enterprise adoption."