Yahoo Will Pay Researchers $ 1 Million For Bug Reports

Since Internet giant Yahoo late 2013 a reward program for researchers and hackers have started it more than $ 1 million paid to bug reports. In total, Yahoo received during this period 10,000 bug reports, of which 1500 were finally rewarded financially, so let the company know .

Of the more than 1,800 people who took part in the rewards program have delivered about 600 bugs that could be verified. It is a small group bug detectors (6%) which is responsible for 50% of all bug reports. According to Yahoo was the addition of a reputation system to the reward program a big improvement. This gives researchers points for reporting verified bug reports, and the amount of the paid compensation. Through the reputation system, researchers can then compare the program with other participants their skills.

LinkedIn Pays Select Group Of Investigators For Leak

The business social networking site LinkedIn has since late last year decided to reward a program for a select group of researchers who report vulnerabilities. Unlike many other sites that launched a reward program to open bug reports LinkedIn decided the program decided to keep. According to information director Cory Scott , the program stems from the bug reports via security@linkedin.com enter.

Most reports were not usable according to Scott, but a small group of researchers used to send detailed bug reports. Then LinkedIn for this group of researchers decided to launch a special rewards program. This has already yielded more than 65 specific bugs for which more than $ 65,000 was paid. The program is structured so that the security team LinkedIn directly with investigators from the beginning works to the end. Payments late LinkedIn HackerOne walk through a platform where many companies start public reward programs.

Scott notes that LinkedIn has looked at an open reward program, but given the experience of external bug reports and the status of the current ecosystem of bug reports, the cost does not outweigh the benefits. Yet Scott calls outside researchers for bugs via security@linkedin.com to continue to report. He further states that it was decided to share the experiences LinkedIn to give "more nuance" to the discussion on the subject, which might be useful for others.

Favicon Bug Late Chrome, Firefox And Safari Crash

A bug in the way Google Chrome, Mozilla Firefox and Apple Safari handle the favicons of websites ensures that they can eventually crash. The problem was accidentally discovered by security analyst Andrea De Pasquale. He had a favicon 64MB download large that a full backup of a WordPress website turned out to be.

Programmer Benjamin Gruenbaum worked out the problem further into a demonstration on GitHub , which browsers without users have let this by downloading a large favicon. For his demonstration Gruenbaum created a favicon almost 10GB which ultimately caused a crash on his Macbook, so he lets on Hacker News know. Undetected downloads would especially be a problem for mobile users with a data limit. Gruenbaum then warned Mozilla and Google on the issue. The developers of Firefox came in three hours with a solution that will be present in the latest version of the browser. The problem is not with Internet Explorer.

Mozilla Firefox Raises Reward For Bug Reports

Over the past five years, Mozilla has $ 1.6 million paid to hackers and researchers who discovered bugs and vulnerabilities in Firefox and reported, but according to the open source developer's time for change.When Mozilla five years ago with the program began, a maximum reward of $ 3,000 paid for critical vulnerabilities. That amount has now increased to $ 7,500.

In addition, Mozilla also uses variable remuneration, depending on the quality of the message, the severity of the leak and the simplicity with which the vulnerability to attack. For this category of special vulnerabilities or attack techniques, researchers can get more than $ 10,000. Furthermore Mozilla also vulnerabilities as "moderate" may be considered also qualify for a reward, something that previously was not the case.

These vulnerabilities deliver between 500 and 2,000 dollars on. Besides cash researchers will also be rewarded with eternal fame as a Mozilla Firefox Security Bug Bounty Hall of Fame was launched where all the researchers who find bugs listed.The reward program applies to Mozilla Firefox, Thunderbird, Firefox for Android and FirefoxOS.

Indian Student Pays Training With Bug Reports

The search for vulnerabilities in applications, web applications and other software for many researchers now become a lucrative business, with an Indian student pays even trained with. Shashank Kumar, known on Twitter as cyberboyIndia would now have about $ 30,000 in bug reports are earned. Thus he was able to pay most of his training, so he lets opposite The Verge know.

Despite the revenue say many researchers working on so-called "bug bounty" join programs that they are not full-time to look for vulnerabilities, but rather a part-time job or a way to generate additional income. Earnings that are higher on the black market. Nevertheless, most hackers would choose an official reward program, says Alex Rice, former security chief on Facebook and now CTO of HackerOne.

"In order to sell something on the black market you should make one weapon. That could take months," said Rice. Most hackers do have the skills, according to him, but no bad intentions. Yet it also happens that hackers find that they did not have enough money or that bugs are not resolved quickly enough. Often these hackers then decide to reveal the problem yet, what a PR nightmare for businesses can be said Gus Anagnos of SYNACK.

That can ensure that companies in each bug melding overreact. "As an organization wasting a gun to his head, the start time to vulnerabilities that are not very important," Anagnos notes. There are also now several platforms launched where companies can join. The platform receives the entries and make the selection and communication, so the company only receives structured bug reports, so that can be solved earlier.

Facebook 1.3 Million Paid Researchers For Bug Reports

Facebook last year, $ 1.3 million paid for bug reports were submitted by researchers. Since the "bug bounty" program began in 2011 is more than $ 3 million disbursed. In 2014, Facebook received 17,000 bug reports, an increase of 16% compared to 2013.

Eventually, 321 researchers rewarded for their entries, which equates to an average reward of 1788 dollars per bugmelding.The five most active researchers earned last year together $ 256,000. Furthermore, according to figures from Facebook that most bugs last year were sent by Indian researchers, namely 196. Average yielded investigators USD 1,343 per bugmelding on.

The number of bug reports from Great Britain is 28 much lower, but average paid Facebook British researchers dollar 2,768 per bugmelding. A total of researchers from 65 countries paid by the social networking site. For this year expects Facebook again the necessary bug reports. Since the new year were already more than 100 valid reports are received.