Recognizing Q4 Top 5 Bounty Hunters

We have tabulated the results from April-June 2018. The Top 5 Bounty Hunters for Q4 are now in. As with our list from Q3, we want to recognize both the leaders in payouts and in number of successful submissions. We appreciate the hard work and dedication of the following individuals and companies...

Recognizing Q4 Top 5 Bounty Hunters

We have tabulated the results from April-June 2018. The Top 5 Bounty Hunters for Q4 are now in. As with our list from Q3, we want to recognize both the leaders in payouts and in number of successful submissions. We appreciate the hard work and dedication of the following individuals and companies...

Microsoft Bounty Program Offers Payouts for Identity Service Bugs

Microsoft has lifted the curtain on a new bug-bounty program, offering payouts as high as $100,000 for holes in identity services and implementations of the OpenID standard. The bounty program touches on Microsoft’s array of digital identity solutions, which tout strong authentication, secure...

Microsoft Offers $100,000 Bounty for Finding Bugs in Its Identity Services

Microsoft today launched a new bug bounty program for bug hunters and researchers finding security vulnerabilities in its "identity services." Hacking into networks and stealing data have become common and easier than ever but not all data holds the same business value or carries the same risk...

Not all treasure is silver or gold

How Bug Bounty Programs Help Improve SaaS and Web Security By Captain Jack Sparrow, CC BY-SA 3.0, As many companies who have found themselves victims of a debilitating ransomware attack or major data breach have found out; an ounce of prevention is worth a pound of cure. The same is true for...

Mystery Company Offers $250,000 Bounty for VM Escape Vulnerabilities

An unnamed company will start an eight-week, invite-only bug bounty program in September that offers a $250,000 payout for virtual-machine escape vulnerabilities tied to an unreleased product. Bugcrowd announced the program today, and said the high-priced bounty is the largest advertised bounty o...

Average Bug Bounty Payments Growing

HackerOne said Monday its average dollar payouts to participants are up, and cross site scripting vulnerabilities cause the biggest headaches for companies. The bug bounty platform provider culled data from the past four years, analyzing 50,000 reported bugs and more than $17 million in payouts t...

Microsoft Extends Edge Bug Bounty Program Indefinitely

Microsoft said Wednesday it would no longer impose a time limit for its Edge bug bounty program. The Redmond, Wash. based company announced the Edge on Windows Insider Preview WIP program in August 2016 as a means to incentivize researchers to find and report vulnerabilities in the browser...

HackerOne: Race condition leads to duplicate payouts

@jigarthakkar39 discovered a race condition issue with some recent changes to our payments code that caused him to be able to receive duplicate payouts for some bounties. A number of variables and timing had to be just right for it to actually allow a malicious actor to exploit this and receive...

Google Increases Bug Bounty Payouts by 50% and Microsoft Just Doubles It!

Well, there's some good news for hackers and bug bounty hunters! Both tech giants Google and Microsoft have raised the value of the payouts they offer security researchers, white hat hackers and bug hunters who find high severity flaws in their products. While Microsoft has just doubled its top...

Facebook Bug Bounty Program Pays Out $5 Million in 5 Years

Facebook announced this week that it’s paid out more than $5 million to 900 researchers in the five years since it implemented its bug bounty program. The social network announced the figures, including some preliminary statistics around how the program has fared so far this year, in a blog post...

Microsoft Adds .NET Core, ASP.NET to Bug Bounty Program

Microsoft is stepping up its bug hunting efforts surrounding its Visual Studio development suite, adding Microsoft .NET Core and ASP.NET Core to its Bug Bounty program. The bounties opened yesterday and will run “indefinitely,” according to Microsoft. The bounty program includes the Windows and...

Putting Apple Bug Bounty Rewards in Perspective

Admittedly, the payouts for Apple’s bug bounty announced last week at Black Hat drew mixed reactions ranging from reasonable to raucously funny. Apple made a big splash at the annual hacker conference, first via a last-minute announcement that well-regarded Ivan Krstic would be giving a talk on...

New CryptXXX Can Evade Detection, Outsmart Decryption Tools

Tweet Crooks behind the fast spreading CryptXXX ransomware updated the latest variant with better encryption technology and new methods to evade detection by researchers. This latest version of CryptXXX was spotted by researchers at SentinelOne that say the new updated sample has already earned...

Mozilla Bug Bounty Payouts Going Up

After admittedly letting its bug bounty rewards get a little stagnant, Mozilla on Tuesday announced it was ready to sweeten the pot for researchers contributing vulnerabilities to the program. Raymond Forbes, an engineer at Mozilla, announced on the company’s website that payoffs were...

All Major Browsers Fall At Pwn2Own Day Two

Two researchers on Thursday took down the four major browsers, Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, and Apple Safari, as Pwn2Own, the annual hacking contest that runs in tandem at CanSecWest, wound down in Vancouver. The story of the day was Korean researcher Jung Hoon Lee...

Bug Bounty Programs Pay Economic Rewards

Bug bounty programs can be as much as 100 times more cost-effective for finding security vulnerabilities than hiring full-time security researchers to do the same thing. New research from the University of California at Berkeley, which focused on bug bounty programs run by Google and Mozilla, fou...

Google Fixes Security Vulnerabilities with Chrome Update

Google released a stable channel update for its Chrome browser yesterday, resolving 12 vulnerabilities, one of which was considered ‘critical’, Google’s most severe rating, ten of which received second most severe ‘high’ ratings, and one receiving a third-in-line ‘medium’ rating. Google paid out ...

Mega Bug Bounty Makes First Payouts

Week one of the Mega cloud storage service bug bounty is in the books and at least three payouts have been made. Controversial entrepreneur and MegaUpload founder Kim Dotcom made the challenge last week offering a €10,000 reward to anyone who could break the encryption protecting the service. Six...

Google Patches 12 Flaws in Chrome

Google has 12 vulnerabilities in Chrome, including seven high-risk flaws. The new release of Chrome also includes an updated version of the Adobe Flash player. This is the second update for Chrome in the last few days from Google. The company updates its browser on a rolling basis, pushing out a...