VeriSign Puts Flaw Bounty on Vista and IE7 91
rchris1172 writes "VeriSign's iDefense Labs has placed an $8,000 bounty on remote code execution holes in Windows Vista and Internet Explorer 7. As part of its its controversial pay-for-flaw VCP (Vulnerability Contributor Program), iDefense said it will pay the reward for each submitted vulnerability that allows an attacker to remotely exploit and execute arbitrary code on either of the two Microsoft products. In addition to the $8,000 award for the flaw, iDefense will pay between $2,000 and $4,000 for working exploit code that exploits the submitted vulnerability."
Only 8k? (Score:5, Interesting)
Wonder what they're really worth? (Score:2)
Although I suppose you could play both ends against each other, if you were ballsy enough; sell it to Verisign and the mob. Too bad I have this silly fear of death.
Re:Wonder what they're really worth? (Score:5, Funny)
Re: (Score:3, Insightful)
Then perhaps the simply righteous will step up.
"perhaps the simply righteous will step up" (Score:3, Insightful)
Yeah, and "the righteous" could code, then there wouldn't be any exploits in the first place. 8-).
-- Terry
Re: (Score:2)
Whereas the truly righteous would have stepped up regardless of bounty. The simply righteous who would have stepped up before, but are now thinking "wait a second.. I can get money for this that isn't crook money? Right on!".. well. Them - 1:0 - humanity.
Re: (Score:1)
Well, if you need to eat, then you need to do something to get money. If there is no money in helping, then time you would spend helping will have to be spent making money instead - thus less help occurs.
But if you can get payed for helping, then you are getting money for food AND helping at the same time. This e
Re: (Score:2)
You say that by my argument, cops shouldn't get paid.. not at all. The comparison person for a cop would be somebody who actually works for a security firm. If you run it that way, then it becomes a matter of a paid security firm guy deciding against telling people about a flaw because they want to see -additiona- money first. It's like a cop who already gets paid to do his job saying "I found the rapist.. but I'll want $12,000 before I tell
Re: (Score:1, Insightful)
Re: (Score:1, Interesting)
Most criminals will actually buy their own stuff, even though they could just steal it. There are advantages to doing things the legal way. Crime pays, but only until you get caught.
Re: (Score:2)
This is very good for security researchers tho, as we can't go sell to the Russians.
Re: (Score:1)
A lot of people talk about the "black market" but very few have ever been involved. There is so much collaboration now between intelligence and ISPs that it is quite difficult to make big money without having your butt exposed. I personally have never tried, despite being very interested in this "field", but from what I hear much of the money comes from bots/adware as opposed to the hollywood-ish hack-a-bank for the mafia nonsense.
Perhaps some of the more involved Anonymous Cowards
Re: (Score:1)
The ping of death (Score:1, Interesting)
This was hilarious to use at the LAN parties.
It would be good fun if someone found a similar flaw with vista and wrote a Linux client for it
Economics 101 or Why I Love Bounties (Score:4, Funny)
2. Get friend to go work at MSFT.
.
4. PROFIT!
Re:Economics 101 or Why I Love Bounties (Score:5, Insightful)
Re: (Score:1)
3. ???
Re: (Score:3, Funny)
3. ???
Darn. Guess you get the US $8000 bounty. Now, let's see, that's about 2 Euros, right?
Re: (Score:2, Funny)
This would probably work until QA at Microsoft tracked down the singular source of most of the exploited vulnerabilities in the past few months.
Considering the number and regularity of vulnerabilities in Microsoft softwar
Re:Economics 101 or Why I Love Bounties (Score:5, Funny)
O
/|\ <--- you
|
/ \
So this is Microsoft's long term profit strategy.. (Score:2)
Come on, no-one actually thought people could use MS software for anything else did they?
If you read TFA.. (Score:2, Informative)
Re:So this is Microsoft's long term profit strateg (Score:1)
Why make trillions when you could make . . . billions?
Re:Four Steps to Profit (Score:5, Informative)
Re: (Score:3, Insightful)
They could turn in bugs they already know about
Re: (Score:2)
Effective... (Score:5, Insightful)
So, not so stupid. Unlike most of the posts on this article so far.
Re: Effective (Score:1)
Re:Effective... (Score:5, Insightful)
So, not so stupid. Unlike most of the posts on this article so far.
What it's really doing is getting those hundreds of thousands of individuals to do someone else's (Microsoft's) job for them for damn near free.
Re: (Score:3, Insightful)
Re: (Score:2)
How is thousands of flaws defined as a good job?
Re: (Score:2)
Except that not everyone, in fact very few, will eventually be given a reward while hundreds of thousands of individuals spend possibly hundreds of hours each searching for flaws.
What it's really doing is getting those hundreds of thousands of individuals to do someone else's (Microsoft's) job for them for damn near free.
If it takes hundreds of thousands of individuals at hundreds of hours each to find a bug in a product, I would say that Microsoft already did a damn fine job.
Re: (Score:1)
Moar money (Score:5, Funny)
The company spokesman also added they'll double the bounty if the submitter already used the exploit to build a botnet and triple it if promises to use it to send a metric assload of e-mails with the subject "ha-ha" to everyone@microsoft.com.
Re: (Score:1)
fix in 1 day?? (Score:1)
FTA:Microsoft typically frowns on the broker market for flaws in its products. "We do not believe that offering compensation for vulnerability information is the best way [researchers] can help protect customers," the company said during the last iDefense hacking challenge.
"Microsoft believes that responsible disclosure, which involves making sure that an update is available from software vendors the same day the vulnerability is first broadly known, i
Re: (Score:1)
Not going to work (Score:5, Interesting)
Re: (Score:3, Funny)
You have just won a new Boat!
Please come down to the stadium to pick it up.
Regards
Det. Sgt. Smith
Re: (Score:2)
Re: (Score:2)
Tell you what, Mr. Haxx0r -- you find a qualifying vulnerability, let me know, I'll give them my info and Paypal $7500K to you.
Re: (Score:1)
Sounds like a low figure (Score:2, Insightful)
$8000 might sound like a lot until you compare it to the stories we see of vulnerabilities being sold for $50,000 on underground sites. Why should I sell my findings to them for a much smaller amount?
Re: (Score:3, Insightful)
If you can help someone and get payed 8 dollars, or hurt someone and get 50 dollars, what would you do?
I think it's good that there is any compensation at all for white hats who would otherwise recieve no compensation at all for doing the least harmful thing. It would be nice if the rewards for help were on par with harm, but helping is reward in itself for some - and a bit extra reward helps the motivation.
Or sell to both (Score:1)
Cheap testing for MS (Score:2)
Determened, motivated hackers will do better testing than internal testers and cost less too! For each $8k prize issued there'd probably be a few hundred people each spending many hours. Cheap, very cheap!
Re: (Score:2, Insightful)
Perhaps eBay is the appropriate way to monetize on this kind of research.
I'm joking. Quit agreeing.
Re: (Score:1)
$8000 might sound like a lot until you compare it to the stories we see of vulnerabilities being sold for $50,000 on underground sites. Why should I sell my findings to them for a much smaller amount?
Probably not even all that much money (Score:2)
By the way it would not be that great of an idea for MS employees to go around submitting bugs to VeriSign, particu
Re: (Score:2)
I think that there WILL be a very serious amount of effort devoted to finding the vulns, actually. A HUGE effort. I
NOT the best business move! (Score:5, Funny)
Paying $8000 for each exploitable security flaw in Microsoft products is a quick way to put a company into bankruptcy! I noticed that the bounty only applies to the first six submissions, though, so VeriSign is only out $48000.
Who else here thinks that VeriSign will then turn around and sell the winning entries to the black market for $50000 each? hehe
Re: (Score:1)
The law on unintended consequences (Score:5, Funny)
Dilbert: Yahoo!
Alice: We're rich
Wally: Yes!!! Yes!!! Yes!!!
Pointy Haired Boss: I hope this drives the right behavior.
Wally: I'm gonna write me a new minivan this afternoon!
http://www.ourlocalstyle.com/images/uploadImages/
That'll be interesting (Score:1)
Actually, be lazy. I want to cash in.
Oh, please (Score:2, Insightful)
right, not all are Russian mafia (Score:3, Funny)
Why is Verisign doing this? (Score:2)
Re: (Score:1)
Ah, you don't know iDefense Business model, I see. They have paying customers which get the vulnerability descriptions and exploits first, while the contacted company tries to fix the flaw. After some time it is released to the public. So they directly earn money from those flaws and so have an interest to get flaws made available to them exclusively. They aren't the only ones doing business like that.
Re: (Score:2)
So Now I Can Legally Attempt To Compromise M$ ?? (Score:3, Funny)
Hax0r1ng is getting better all the time!
And they said we were just a bunch of internet hooligans.
muahahhaha
Chump Change (Score:2)
Legal? (Score:2)
With all the legal issues and suits flying around, id be sort of afraid to admit i knew something.
that is what I was wondering (Score:1)
If it is illegal, wouldn't verisign be in a bit of a bother now offering to purchase such a thing?
Greedo shot first (Score:2)
B: "You exterminate insects, then?"
A: "Sort of. It involves looking in lots of holes. That's all I can say right now. I'm late for a meeting with Jabba."
Pfft (Score:3, Insightful)
A 0day of this kind is worth at least twice that on the black market, mostly to the botnet creators who are the base of all the spam we get.
Re: (Score:1)
There have been a few posts of this nature in this discussion.
You seem to be saying that if someone finds an exploit they have the following choices:
(a) Turn in the exploit to the good guys for $10,000
(b) Sell the exploit to the bad guys for $20,000 and know that they will be contributing to human misery
I can't be the only person who would select the first op
I assume the $8000 is... (Score:2)
In other news... (Score:2, Funny)
...both Apple and Cisco are suing VeriSign for the use of iDefense in the name of their labs. Apple claims that it dilutes their brand identity, and Cisco claims that they've been selling "defense" hardware with the "i" trademark for years!
They should have used the money elsewhere.. (Score:1)
Microsoft (Score:1)
Dear Verisign, (Score:2)
Not a security flaw, but a real IE7 WTF (Score:1)