Story image

$250,000 up for grabs in Microsoft's latest Windows Bounty Program

31 Jul 2017

Microsoft is offering up to US$250,000 (NZ$332,668/AU$313,047) in a new bug bounty program focused exclusively on ironing out the kinks in Windows 10. This time there’s a bigger payout for the Hyper-V bounty.

Last week the company launched the Windows Bounty Program, which includes all aspects of the Windows Insider Preview, as well as Hyper-V, Mitigation bypass, Windows Defender Application Guard and Microsoft Edge.

Microsoft says the program is ‘in the spirit of maintaining a high security bar in Windows’, and complements the company’s long list of defence technologies such as DEP, ASLR, CFC, CIG, ACG, Device Guard, Credential Guard and Windows Defender Application Guard.

The new bug bounty program aims to catch any critical or important remote code execution (RCE), privilege elevation or design flaws that compromise users’ security and privacy.’

However, if anyone discovers a vulnerability that Microsoft has already found, the bounty equated to 10% of the highest amount they could have received. In the case of a Hyper-V bounty ($US250,000), researchers would receive a payout of $25,000 if they found a RCE.

Microsoft has conducted several bounties since 2013, which reflects the changing nature of vulnerabilities and priorities in different points in time.

“Microsoft strongly believes in the value of the bug bounties, and we trust that it serves to enhance our security capabilities,” the company says.

There are also outstanding bounty programs for .NET and cloud applications, worth up to US$15,000 (NZ$19,960/AU$18,782).

Microsoft says that all security bugs are important, and users should report those bugs to secure@microsoft.com via Coordinated Vulnerability Disclosure (CVD) policy.

Interested researchers can also check out Bugcrowd’s list of current bug bounty programs from platforms such as Atlassian, Avira, Centrify, Cylance, HubSpot and 1Password.

However, bug bounty programs may not be alluring enough for some – recent reports suggest that Google’s bug bounties are not doing so well. Earlier this year the company’s Project Zero hacking contest failed to reward a single prize, despite rewards of up to US$200,000.

In the contest, there were no valid entries or bugs - instead there was just spam and entries that did not resemble what the company was after. Read more here. 

Microsoft’s bug bounty categories are below.

Why SD-WAN is key for expanding businesses - SonicWall
One cost every organisation cannot compromise on is reliable and quick internet connection.
New threat rears its head in new malware report
Check Point’s researchers view Speakup as a significant threat, as it can be used to download and spread any malware.
Oracle updates enterprise blockchain platform
Oracle’s enterprise blockchain has been updated to include more capabilities to enhance development, integration, and deployment of customers’ new blockchain applications.
Used device market held back by lack of data security regulations
Mobile device users are sceptical about trading in their old device because they are concerned that data on those devices may be accessed or compromised after they hand it over.
Gartner names ExtraHop leader in network performance monitoring
ExtraHop provides enterprise cyber analytics that deliver security and performance from the inside out.
Symantec acquires zero trust innovator Luminate Security
Luminate’s Secure Access Cloud is supposedly natively constructed for a cloud-oriented, perimeter-less world.
Palo Alto releases new, feature-rich firewall
Palo Alto is calling it the ‘fastest-ever next-generation firewall’ with integrated cloud-based DNS Security service to stop attacks.
The right to be forgotten online could soon be forgotten
Despite bolstering free speech and access to information, the internet can be a double-edged sword, because that access to information goes both ways.