Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

$10k Bounty for Critical Windows Flaws

Posted by CmdrTaco on Thu Feb 16, 2006 03:15 PM
from the rolling-in-the-benjamins dept.
Security Operating Systems Software Windows
An anonymous reader writes "iDefense, a Verisign company, is offering $10,000 to any researchers who find and report to it information on a previously unknown Windows flaw for which Microsoft later issues a "critical" advisory, according to a story over at Washingtonpost.com. Not really surprising, considering that Russian hacking groups are now paying thousands of dollars for exploits that attack unpatched holes in Windows. From the article: "Details of the flaw must be submitted exclusively to iDefense by March 31. There is no limit on the number of prizes that can be paid: if five researchers find and report five different Windows flaws for which Microsoft later issues critical advisories, all five will get paid...iDefense will change the focus of the challenge with each quarter -- the next challenge may focus on another vendor, or it may just center on particular class of vulnerabilities.""
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

$10k Bounty for Critical Windows Flaws 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Buy MSFT now (Score:5, Funny)

    by biocute (936687) on Thursday February 16 2006, @03:16PM (#14736164) Homepage
    I mean, who better than Bill Gates himself to submit hundreds of thousands of Windows exploits and makes zillions of them?

    1. Design flawed OS
    2. Wait for bounty on flaws
    3. Submit flaws
    4. Issue "critical" advisories on those flaws
    5. Profit!!!

    Mind you, if the bounty is for announced "patch" instead of "advisory", it will be almost impossible for BG to claim the prize.

  • Vista! (Score:5, Funny)

    by Anonymous Coward on Thursday February 16 2006, @03:17PM (#14736171)
    Now where's my check?

  • I could use an extra 10k (Score:3, Funny)

    by Yaksha42 (856623) on Thursday February 16 2006, @03:17PM (#14736174)
    It's times like this, when the rent is due, that I wish I knew more about hacking. :(
  • Operation: Who Wants To Be A Millionaire?

  • Remember though (Score:5, Interesting)

    by saskboy (600063) on Thursday February 16 2006, @03:19PM (#14736198) Homepage Journal
    If you're in the hunt, don't focus on Windows 3.1 or ME, since as of June 30, 2006 Windows will no longer be issuing critical warnings for either of those Operating Systems even if they know they exist. Well they might issue one out of the goodness of their hearts to encourage an upgrade to X...err Vista, but there will be no official patch.

    On second thought, maybe looking at Windows 3.0 coding errors would reveal flaws in Vista. After all, think of the WMF flaw...

  • Can anybody say, "lawsuit"? (Score:3, Insightful)

    by Anonymous Coward on Thursday February 16 2006, @03:19PM (#14736199)
    I can't imagine MS is gonna be too pleased with this.

    And they have a couple law-talkin guys on staff.
    • Why not? iDefense doesn't just release the vulnerabilities unannounced or sit on them exploiting them for profit, they submit them to Microsoft Security and publish only after a patch has been released. If anything, Microsoft should be happy that somebody is providing independent researchers a financial incentive not to release 0-day vulnerabilities to public lists.

  • Linux needs a similar plan. (Score:5, Interesting)

    by MikeFM (12491) on Thursday February 16 2006, @03:23PM (#14736241) Homepage Journal
    This is what Linux companies should be doing. Pay developers that find an exploit in Linux a couple thousand dollars and make sure the hole gets fixed quickly. Obviously then it becomes a race for the companies to have their own employees find and fix the holes before outside developers do the same. Maybe have some lesser (since they're already getting a paycheck) bounty available to their own employees that find the holes and fix them.

    As open as Linux is this kind of motivation could really bring in the eyeballs to make those holes shallow and get them patched up. Make the bounty $10,000 for critical bugs and maybe $2000 for lesser security bugs. If you get the kernel patched up then start working on libraries and then apps and by then it should be time to start looking at the kernel again.
    • Artifex does a bug bounty for ghostscript, but it's for patches, not for reports. $500 or $1000, depending on how critical a bug you fix.
      • I've heard of similar projects for Linux before but if they still exist I never hear anything about them. It really needs to be a well publized project if such a thing exists - otherwise people won't know about it and contribute.
    • Yeah, and considering the $10,000 applies to vulnerabilities rated as "critical", you'd hardly ever pay out.

      A "critical" Windows flaw is one that allows remote exploitation. Find me a Linux distro in the past 3 or 4 years that is remotely exploitable in a default configuration, and *I'll* pay you the bounty.

  • $10 k isn't a lot for hackes (Score:4, Insightful)

    by madnuke (948229) on Thursday February 16 2006, @03:24PM (#14736249)
    That isn't a lot when you could sell the exploit on the internet like the WMF exploit was a snip at $5000 each, think how many people bought that in the malicous website, porn internet, fake-anti spyware companies like Win Hound. Some how I don't think this will last long.
    • Yes but the idea is obviously to encourage the "good guys" to find and report the holes before the "bad guys" find out about them. Most people would not trade security holes for cash on the black market, but they would certainly deliver them to a security company for pay.

  • Found it! (Score:5, Funny)

    by Fr05t (69968) on Thursday February 16 2006, @03:26PM (#14736257)
    iexplore.exe

    You may send the prize money to PO Box 3872, Moncton, NB, Canada

  • Shrewd business move for Verisign (Score:3, Insightful)

    by Weaselmancer (533834) on Thursday February 16 2006, @03:28PM (#14736284)

    They're investing in the first corporate-sponsored botnet. Now you can give your spam relay the corporate sponsorship it's always been craving! For an added bonus, we'll throw in a few auth certificates if you decide to become an elite Platinum Botnet customer!

    Don't delay, act now! Really, we mean it. Because offer is only valid until Microsoft's next Critical Advisory.

  • In the words of Dilbert (Score:5, Funny)

    by gasmonso (929871) on Thursday February 16 2006, @03:28PM (#14736289) Homepage

    Some Vista developer is saying to himself, "I'm gonna code me a minivan!"

    http://religiousfreaks.com/ [religiousfreaks.com]

  • What if five people find the same flaw? (Score:5, Interesting)

    by autopr0n (534291) on Thursday February 16 2006, @03:32PM (#14736313) Homepage Journal
    I mean, couldn't someone find a flaw, get together with 10 of his friends, and everyone reports it independantly? What happens then?

  • Free Press - Contest is a joke... (Score:5, Insightful)

    by xxxJonBoyxxx (565205) on Thursday February 16 2006, @03:34PM (#14736355)
    "iDefense will change the focus of the challenge with each quarter -- the next challenge may focus on another vendor, or it may just center on particular class of vulnerabilities."

    Or, iDefense may never pay any of the $10K prizes, citing independent discovery, not-really-critical status or just the fact that Verisign knows how to say "fuck you" better than almost anyone. Instead, they'll just get shitloads of free press for their cheesy security contest and a couple of marks will sign up for and/or buy whatever it is that Verisign/iDefense is hawking today.

  • Upcoming headline (Score:5, Funny)

    by Anonymous Coward on Thursday February 16 2006, @03:37PM (#14736376)
    Microsoft patches 87,000 critical flaws. Verisign files for bankruptcy protection.
  • Maybe I am provocative... Anyway: when are we going to have similar initiatives for OSX or linux?

  • Verisign?? (Score:3, Insightful)

    by Rob T Firefly (844560) on Thursday February 16 2006, @03:50PM (#14736499) Homepage Journal
    It's an interesting concept, but I wouldn't trust Verisign to get the tuna out of a can that had already been opened. I wonder what their deal is here.
  • If iDefense (Verisign) can come up with $10K per critical Microsoft Windows flaw, why can't HP (or any other party interested in a secure environment) come up with money to support the development of applications for their own, very secure operating system: HP OpenVMS [hp.com]? Why does this industry focus so much on Microsoft Windows and totally ignore alternatives?
  • Users.

    My prize may be donated to the Association for Smacking Stupid People Upside the Head.

  • Clank go the handcuffs (Score:3, Insightful)

    by TallMatthew (919136) on Thursday February 16 2006, @04:34PM (#14736885)
    "Here's your exploit, now where's my ten grand?"

    "Sir, you've just violated the DMCA by making our mistakes public. Off to jail you go."

  • What about beta? (Score:3, Insightful)

    by TopSpin (753) * on Thursday February 16 2006, @04:50PM (#14737034) Journal
    If I discover an obscure remotely exploitable security flaw in a Microsoft beta product (thus, unlikely to lead to a "critical" advisory,) why should I not sit on it until a few months after release and get paid?

  • DMCA violation? (Score:3, Interesting)

    by sl4shd0rk (755837) on Thursday February 16 2006, @06:10PM (#14737763)
    Do the world a great service by finding windows bugs and then take it up the ass for 15 years when Shyster H. Lawyer decides to prosecute under the dmca because you took apart some binaries. Don't agree? Why do you think symantec and friends didn't want to mess with the BMG fiasco? Same reason. Microsoft made this mess, let them straighten it out.

  • I found a flaw!!! (Score:4, Funny)

    by Khyber (864651) <khyberkitsune@gmail.com> on Thursday February 16 2006, @06:14PM (#14737789) Journal
    d:\setup.exe

    I'll take my ten grand now. Oh wait, I found another one!!

    explorer.exe

    There's twenty grand you owe me now!
  • the devil is in the details. Any really good flaw reported will fall just this side of critical. Not critical no $10,000.00. No bad press.

    • Re:WTF? (Score:3, Insightful)

      by mythosaz (572040)
      (a) There is no telling how many remain. Windows may be getting close to "tight" in terms of remote exploitability, or it may still have several gaping holes. RPC-based exploits (the "real" dangerous ones) seem to have been closed for a while. It's mostly overflows and breakouts now, and mostly on user-initiated processes. [User-initiated processes don't spread like wildfire inside of corporate networks, like RPC-type flaws. Dangerous, but not panic-level stuff...]

      (b) People pay for these exploits beca
    • Why would "russian hacker groups" be paying thousands of dollars for unpatched expliots? Not many remaining?

      I didn't RTFA, but I'd guess it goes something like:

      1. Pay thousands of dollars for working Windows exploit
      2. Create code that uses the exploit to install keyloggers or other nastiness
      3. ???
      4. Profit!!

    • Re:Windows research is clearly more profitable... (Score:5, Insightful)

      by LordLucless (582312) on Thursday February 16 2006, @05:46PM (#14737587)
      There's no inherent security architecture protecting Firefox, Linux, OSX that doesn't also exist in Windows.

      That's total bollocks. Granted, the fact that windows is more popular than linux is *one* factor that discourages malware for linux, but it's far from the only one.

      Linux systems are designed to be run by users, and administered as root. Windows systems, by and large, are impossible to run as anything but root - many programs require root access to work properly, and Windows (up until recently) never had the equivelant of a linux sudo to get around that requirement. Windows developers have been encouraged for years to write programs dependant on root access. Execute permissions prevent accidental execution of malware on Linux, as does not having a stupid system of extensions which are so easily spoofed (especially when default windows behaviour is to hide recognized extensions!). The move over to NTFS was good, but it only really hit the public with XP. I still know many people using FAT-based systems. How long has Linux been running a permissions-based filesystem? There's a few architectural security advantages Linux has over windows. On the more abstract level, being open source gives Linux the potential to be more secure - it's hard to hide critical vulnerabilities in Linux, whereas MS has a history of doing so for windows.

      Firefox is another issue entirely; it's an application, not an OS. But comparing it to MS's Internet Explorer, it's far and away more secure. It doesn't install things behind the user's back, as MS IE does so very often. It doesn't allow the incredibly-insecure ActiveX components. I've never had a spyware infection or browser hijack simply by browsing in firefox. On my new laptop, however, I was browsing around using IE while I waited for firefox to download, and in between the time it took to start the download, and the time it had finished, IE had managed to install a little bugger called Aurora for me . Thanks IE!
      • Linux systems are designed to be run by users, and administered as root. Windows systems, by and large, are impossible to run as anything but root - many programs require root access to work properly, [...]

        This is solely an application problem. It has _nothing_ to do with Windows.

        [...] and Windows (up until recently) never had the equivelant of a linux sudo to get around that requirement.

        It's always had the functionality.

        Windows developers have been encouraged for years to write programs dependant on

        • Encouraged how ? What Microsoft documentation can you provide showing that developers have been told to write applications dependant on Administrator level access ? How do you reconcile this claim with the requirement of the "Made for Windows XP" logo that applications must run in a normal user account ?

          They encouraged it prior to the release of XP. Then they released XP, and changed the way programs are supposed to perform OS operations. Ok, that was a good step. But you can't expect millions of program

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.