Yahoo Will Pay Researchers $ 1 Million For Bug Reports

Since Internet giant Yahoo late 2013 a reward program for researchers and hackers have started it more than $ 1 million paid to bug reports. In total, Yahoo received during this period 10,000 bug reports, of which 1500 were finally rewarded financially, so let the company know .

Of the more than 1,800 people who took part in the rewards program have delivered about 600 bugs that could be verified. It is a small group bug detectors (6%) which is responsible for 50% of all bug reports. According to Yahoo was the addition of a reputation system to the reward program a big improvement. This gives researchers points for reporting verified bug reports, and the amount of the paid compensation. Through the reputation system, researchers can then compare the program with other participants their skills.

App Store And iTunes Exposed Significant Vulnerabilities: Relates To System Security

Security experts recently discovered a major flaw in Apple's iTunes App Store and invoice systems. An attacker who exploited this vulnerability could hijack sessions, the malicious manipulation of the invoice. Vulnerability Lab's security researcher Benjamin Kunz Mejri announced its discovery of this vulnerability this week. The major drawback is that the injection-side input validation web application vulnerabilities. The security researcher said in the announcement, can contribute to the flawed content features and services modules inject malicious script code through this vulnerability a remote attacker.

Mejri introduction represents an attacker could exploit the vulnerability approach is to replace the malicious script code to control the value of the invoice module name. If the device is in the Apple store to buy, the backend will use the name value to add coding control condition, which can generate an invoice before the invoice is sent to the seller. The consequences of this will lead to is to have the application side scripting code execution Apple invoice. The severity rating of the vulnerability is CVSS 5.8 (universal vulnerability rating system).

In addition the network attacker can also interact with other Apple applications store account users to control this vulnerability by continuing operating environment, irrespective of the user is the sender or recipient will not affect them take advantage of this loophole. The security researcher said invoice is available to sellers and buyers of both sides, this will give the buyer, the seller or the Apple web administrators / developers to bring great risk.

An attacker can also exploit this vulnerability to hijack user sessions, constantly launch phishing attacks, create links to external resources redirected lasting, influence or manipulation is connected to the service module.

After Mejri found the vulnerability in June 8 was the notification and coordination, then it would be for Apple's product security team issued a notice supplier, Apple after notification responded and feedback, Apple Developer Group provides repair After notice vulnerability, Vulnerability Laboratory was recently disclosed that they discovered this vulnerability.

Earlier this month, Apple's new version of iOS and OS X operating system, the existence of many security vulnerabilities were patched. In a security bulletin, Apple said they released the iOS 8.4 contains 20 multiple patches, the existence of remote code execution, the application terminates, encrypted traffic interception and other issues were corrected.

In these updates, the one called "Logjam" defects has been resolved. It is used in the Diffie-Hellman key exchange algorithm encryption vulnerabilities, the technology is widely used to share key and create a secure communication channel in the Internet protocol. That could allow hundreds of thousands of websites and servers using HTTPS exposed to the risk of theft and traffic is intercepted, and thus may be subject to-middle attack.

At least one of these issues will have a direct impact on Apple Watch. The problem exists in the application installation link, malicious applications can exploit the vulnerability Watch prevent application launch.

Proof of Concept

HackerOne Receives Investment Of $ 25 Million

HackerOne, the platform for reporting vulnerabilities in various software projects and applications, during a new round of investment $ 25 million received. HackerOne was in 2013 founded with the help of Facebook and Microsoft. Initially HackerOne focused on rewarding bug reports in popular software projects from which millions of people use. Meanwhile, all kinds of software companies through the website launched a so-called "bug bounty program."

HackerOne fulfills coordination between bug detector and the software in question. Also advises the platform software vendors for their own software via HackerOne want to start a rewards program. The money in the latest round of investment was raised include from Salesforce Chairman and CEO Marc Benioff, Dropbox's CEO and co-founder Drew Houston and Yelp CEO and co-founder Jeremy Stoppelman.

Since the last round of investment HackerOne the number of employees has expanded from 10 to 50. By now, Yahoo !, Twitter, Adobe, Dropbox, LinkedIn, Snap Chat and Airbnb all use the services of the platform. The total number of customers has now passed the 250. These software companies and projects in recent years to more than 1,500 researchers over $ 3.2 million was paid. The money was used to locate nearly 10,000 vulnerabilities and fix. Despite the positive noises made ​​LinkedIn recently announced that it had started a private reward program for a select group of researchers, because programs where everyone can join would create too much noise to. Why chose LinkedIn sure to route payments to researchers via HackerOne.

LinkedIn Pays Select Group Of Investigators For Leak

The business social networking site LinkedIn has since late last year decided to reward a program for a select group of researchers who report vulnerabilities. Unlike many other sites that launched a reward program to open bug reports LinkedIn decided the program decided to keep. According to information director Cory Scott , the program stems from the bug reports via security@linkedin.com enter.

Most reports were not usable according to Scott, but a small group of researchers used to send detailed bug reports. Then LinkedIn for this group of researchers decided to launch a special rewards program. This has already yielded more than 65 specific bugs for which more than $ 65,000 was paid. The program is structured so that the security team LinkedIn directly with investigators from the beginning works to the end. Payments late LinkedIn HackerOne walk through a platform where many companies start public reward programs.

Scott notes that LinkedIn has looked at an open reward program, but given the experience of external bug reports and the status of the current ecosystem of bug reports, the cost does not outweigh the benefits. Yet Scott calls outside researchers for bugs via security@linkedin.com to continue to report. He further states that it was decided to share the experiences LinkedIn to give "more nuance" to the discussion on the subject, which might be useful for others.

Google Will Pay Researchers For Android Leaks

After reward programs for Chrome and other Google products, the Internet giant is now paying researchers for bug reports in Android . In addition there are rewards distributed to researchers who develop patches making the entire ecosystem safer.

The highest remuneration shall be for researchers who know how to circumvent the security of the Android platform and the sandbox security. For small leaks Google pays $ 500, while critical vulnerabilities are worth $ 2,000. If the investigator in addition to leak a patch and compatibility test suite (CTS) develops is paid $ 8,000. A series of exploits that an app or an attacker with physical access to the kernel can compromise providing $ 10,000. In case the verified boot is compromised researchers receive $ 20,000.

Is an attack carried out remotely, wait for an amount of $ 30,000. The reward program applies to vulnerabilities in the latest versions of Android Nexus phones and tablets that are currently offered in the US Google Store. It still comes to the Nexus and Nexus 6 9. "Open security research is a strong point of the Android platform. The more security research focuses on Android, the safer it will be," said Android security engineer Jon Larimer.

Mozilla Firefox Raises Reward For Bug Reports

Over the past five years, Mozilla has $ 1.6 million paid to hackers and researchers who discovered bugs and vulnerabilities in Firefox and reported, but according to the open source developer's time for change.When Mozilla five years ago with the program began, a maximum reward of $ 3,000 paid for critical vulnerabilities. That amount has now increased to $ 7,500.

In addition, Mozilla also uses variable remuneration, depending on the quality of the message, the severity of the leak and the simplicity with which the vulnerability to attack. For this category of special vulnerabilities or attack techniques, researchers can get more than $ 10,000. Furthermore Mozilla also vulnerabilities as "moderate" may be considered also qualify for a reward, something that previously was not the case.

These vulnerabilities deliver between 500 and 2,000 dollars on. Besides cash researchers will also be rewarded with eternal fame as a Mozilla Firefox Security Bug Bounty Hall of Fame was launched where all the researchers who find bugs listed.The reward program applies to Mozilla Firefox, Thunderbird, Firefox for Android and FirefoxOS.

Drupal Praises To $ 1,000 For Bugs In Drupal 8

The creators of the popular content management system (CMS) Drupal is a temporary program started with hackers and researchers who find vulnerabilities in Drupal 8 and reporting are rewarded financially.The final version of Drupal 8 is coming and contains major changes to the architecture. To ensure that any security issues and vulnerabilities are found in time the developers on the platform of Bugcrowd launched a so-called "bug bounty" program.

Until August 31 this year to vulnerabilities in Drupal 8, such as cross-site scripting, SQL injection and cross-site request forgery, to be reported. Depending on the impact of the bug guard a reward of between 50 and 1,000 dollars. The rewards are only for Drupal 8 and run until August 31, although the program can be extendable. The program was started last Wednesday, and there are no bug reports received yet until now.

Tesla Motors Will Pay For Bug Reports On Website

Carmaker Tesla Motors is a reward program launched in which the hackers and researchers are rewarded for reporting bugs in the website. Vulnerabilities may only be in the domain teslamotors.com and underlying subdomains sought, except the shop feedback page and page for investors. The program, through Bugcrowd hosted, focuses on Tesla's website.

The rewards range from 25 to 1,000 dollars. The reporting of cross-site scripting can yield 200 to $ 500, while command injection, SQL injection and increasing duties with $ 1,000 reward. At present, there were already 22 bugs are offered. The reward program Tesla was already a year in the planning and was the past few weeks in "private mode", reports 'The Kos' on Twitter .

In April, the website and the Twitter account of the carmaker hijacked . Later an attacker via social engineering had changed the IP address of the website. The attack took place outside Tesla and was directed against domain registrar Network Solutions.

VPN Service Hola Promises Improvement After DDoS Attack

VPN service Hola has promised change after the bandwidth of users were used to carry out a DDoS attack and leaks were discovered in the software, but researchers are not convinced. Hola is an extension for Google Chrome offers users a free VPN connection.

What many people do not know is that the company behind the VPN service sells the users of bandwidth via a service called Luminati. Luminati gives parties that pay access Hola network. Recently knew anyone to use this service for a DDoS attack on the 8Chan website. Hola got them to endure a storm of criticism and the founder of 8Chan advised users to uninstall the software.

In addition, several vulnerabilities were discovered in the software that could allow an attacker to execute arbitrary code in the worst case to the computer. In a statement CEO Ofer Vilenski states that there is "growing pains" and that some allegations in the media are unjustified. However, the company will take various measures.

Bandwidth sharing

The first measure concerns about sharing of bandwidth. Through a P2P network called Hola thought it was clear to users that their bandwidth was used. Something not subsequently turns out to be, according Vilenski. Therefore, it still will be clearer for users to communicate. Furthermore, the CEO that there are not used as much bandwidth users, namely 6MB per day.

This bandwidth should be accessible only to business customers. In the case of DDoS attack that took place last week did a 'spammer' to pretend to be a company and were not noticed by Luminati. To avoid repetition have changed several processes.In addition, a Chief Security Officer will be appointed.

Vulnerabilities

Further Vilenski points to two vulnerabilities that were discovered and now would be patched. Hola also run some code by a third party and there will be a "bug bounty" program to be launched, in which hackers and researchers who report vulnerabilities are rewarded. Despite the words of the CEO are the researchers who discovered the vulnerabilities unconvinced.

According to them, the problems still exist and Hola has only made ​​cosmetic changes so that their demonstration of the leak has stopped working. "Many of the problems are ignored, and some claims are simply not true", so leave them on the website Adios-Hola.org know.

Microsoft Is Going To Reward Hackers For Bugs In Project Spartan

As with the test version of Internet Explorer 11 , Microsoft also launched a reward program for the test version of the new browser, code-named "Project Spartan", which hackers and researchers are rewarded for reporting vulnerabilities.

The compensation amount varies from 500 to $ 15,000, although Microsoft claims that the reward may also increase depending on the vulnerability and found the quality of the bug message. The program runs from April 22 until June 22nd. In this way, Microsoft hopes to encourage researchers to leaks in Project Spartan to find and report before a final version this summer appears. When IE11 made the rewards program will allow more bugs were logged than with the test version of IE10 was.

Besides the reward program for Microsoft Project Spartan also has the "Online Services Bug Bounty Program" expanded.Thus vulnerabilities in Azure and Sway.com be rewarded in the maximum reward to $ 15,000 was raised. Again, the rewards can be higher depending on the submission.

The highest rewards Microsoft hands out for attacks to bypass security measures in Windows 8.1 and Server 2012 R2.Allows researchers can earn $ 100,000. Also this program is adapted, including "Hyper-V escapes" now come for a reward eligible. According to Microsoft's Jason Shirk play "bug bounties", as the rewards are called, an increasingly important role in finding vulnerabilities and safer software.

Dropbox Will Pay Hackers To Bug Reports

The popular online storage service Dropbox goes hackers and researchers now have to pay for reporting bugs. In a blog posting suggests Devdatta Akhawe Dropbox storage service that sorts itself enable experts to find security problems, but that it can use all the help security researchers. The payment of bug rewards is an important incentive, set Akhawe.

Dropbox has also received all kinds of bug reports in the past and will reward all these researchers retrospectively. This is an amount totaling $ 10,475. The reward program Dropbox is organized through HackerOne , an initiative that offers companies the opportunity to start so-called "bug bounty" programs.

Approved bug reports can count on a minimum fee of $ 216, the maximum amount has not been established. The highest reward that Dropbox has so far paid amounts to nearly $ 5,000. According Akhawe late offering a reward program to see how dedicated Dropbox to privacy and security. Since the launch of the program, there are already 27 reported bugs and thanks 26 hackers.

Indian Student Pays Training With Bug Reports

The search for vulnerabilities in applications, web applications and other software for many researchers now become a lucrative business, with an Indian student pays even trained with. Shashank Kumar, known on Twitter as cyberboyIndia would now have about $ 30,000 in bug reports are earned. Thus he was able to pay most of his training, so he lets opposite The Verge know.

Despite the revenue say many researchers working on so-called "bug bounty" join programs that they are not full-time to look for vulnerabilities, but rather a part-time job or a way to generate additional income. Earnings that are higher on the black market. Nevertheless, most hackers would choose an official reward program, says Alex Rice, former security chief on Facebook and now CTO of HackerOne.

"In order to sell something on the black market you should make one weapon. That could take months," said Rice. Most hackers do have the skills, according to him, but no bad intentions. Yet it also happens that hackers find that they did not have enough money or that bugs are not resolved quickly enough. Often these hackers then decide to reveal the problem yet, what a PR nightmare for businesses can be said Gus Anagnos of SYNACK.

That can ensure that companies in each bug melding overreact. "As an organization wasting a gun to his head, the start time to vulnerabilities that are not very important," Anagnos notes. There are also now several platforms launched where companies can join. The platform receives the entries and make the selection and communication, so the company only receives structured bug reports, so that can be solved earlier.

Facebook 1.3 Million Paid Researchers For Bug Reports

Facebook last year, $ 1.3 million paid for bug reports were submitted by researchers. Since the "bug bounty" program began in 2011 is more than $ 3 million disbursed. In 2014, Facebook received 17,000 bug reports, an increase of 16% compared to 2013.

Eventually, 321 researchers rewarded for their entries, which equates to an average reward of 1788 dollars per bugmelding.The five most active researchers earned last year together $ 256,000. Furthermore, according to figures from Facebook that most bugs last year were sent by Indian researchers, namely 196. Average yielded investigators USD 1,343 per bugmelding on.

The number of bug reports from Great Britain is 28 much lower, but average paid Facebook British researchers dollar 2,768 per bugmelding. A total of researchers from 65 countries paid by the social networking site. For this year expects Facebook again the necessary bug reports. Since the new year were already more than 100 valid reports are received.

Researcher Could Remove All the Photo Albums On Facebook

A vulnerability in Facebook made ​​it possible to remove all photo albums of users and groups, as discovered an Indian security researcher. Developers of Facebook apps now use the Graph API (application programming interface) to read user data and write. To do this, the API has generally required an access token.

However, according to the documentation of Facebook is not possible to delete the photo albums via the Graph API.Nevertheless, attempted Laxman Muthiyah to do this, giving an error message. It said that the application you could not remove the photo album. What, according to the researcher also showed was that this could be another application.

Therefore he used a "Facebook for mobile" access token that he could remove photo albums. All that was required was the album ID of the Facebook user. Muthiyah warned Facebook and the problem was resolved within two hours. The researcher received for his mention a reward of $ 12,500. On YouTube is to find a demonstration of the vulnerability.

HackerOne Bug Fixes Serious Platform For Bug Reports

HackerOne, the platform for reporting vulnerabilities in various software projects and applications, has itself had to deal with a serious vulnerability that attackers may have access to unpublished bug reports from other investigators could get.

Cross Site Scripting (XSS) issue exists was caused by the way HackerOne the "\" character tried left harmless. Therefore could allow an attacker to execute code on a webpage, which could help again in a phishing attack, says researcher Daniel LeCheminant who discovered the problem.

He suspects that an attacker could also add arbitrary HTML to bug reports in order to gain unauthorized access to the bug reports and data from other researchers. It is the first time that an XSS problem was discovered in HackerOne. A day after LeCheminant administrators had informed the vulnerability was corrected and he got a reward of $ 5,000. An amount that is only for serious bugs reserved .

Microsoft Will Pay Researchers $ 125,000 For IE Attack

Microsoft has three researchers from HP with $ 125,000 reward for demonstrating an attack on Internet Explorer with two security features of the browser were bypassed. The two functions are precisely designed to protect the memory against attacks and were last June and July through security updates to IE added.

Microsoft has a reward program whereby it rewards researchers for developing attacks. It's not about specific vulnerabilities here, but methods to circumvent security features and technologies. The researchers reported the problem more than 120 days ago by Microsoft, which eventually confirmed the effect of the attack. The software giant awarded the researchers $ 100,000 for their reporting, plus $ 25,000 for the proposed solution.

However, HP has a deadline of 120 days after it has informed the supplier, where the details of discovered vulnerabilities are published after this period. In this case, however, decided to reveal the details yet, as Microsoft has not solved the problem.The money the researchers received they gave to charity, as did HP today announced .

Security Researcher Hijacks PayPal Accounts via Flash File

A security researcher has discovered a flaw in the PayPal website so he could take over users' accounts. The vulnerability was in the page to generate invoices. The page allows users to upload different types of files. PayPal turned out only to check the extension of the uploaded files, not the content, so the researcher discovered.

This allowed him to a Flash file with full read on www.paypal.com upload. Then, to take account of a user, the user must visit a Web site of the researcher. The researcher can then execute arbitrary commands with the PayPal account, such as the transfer of money and steal data.

The researcher reported the problem with us that rewards bug reports through a special program. However, eight days after he was told that another researcher had already reported the problem and, therefore, no compensation was paid. "I know that researchers sometimes find the same bugs, but I think that PayPal better to deal with this double bug reports," said the disappointed researcher.