Google’s bug bounty program
isn't just paying off for Google (and, by extension, you); it's also
paying off for security researchers scouring the company’s software for
vulnerabilities. The search giant recently announced that over the past
three years, Google has received more than 2,000 security bug reports
and paid out more than $2 million in rewards.
Bug bounty payouts are becoming an increasingly popular way for
software makers to keep their products more secure. Instead of relying
exclusively on employees or reporting from private security firms, bug
bounty programs create a channel for private individuals to report
security flaws directly to the company. If the flaw meets the bounty
program’s requirements, then the company will pay out a monetary reward
to the discoverer of the flaw.
The basic concept of bug bounty programs can be traced back to open
source software and the mantra that the more eyes you have looking at a
piece of code, the more likely you are to find and patch security flaws.
Unlike the open source community, however, Google bug hunters don’t
always have access to underlying code. Instead, researchers try to find
innovative ways to exploit Google’s systems.
Opening the floodgates and declaring open season on your own software
may sound crazy, but the concept seems to be working. A recent study by
researchers at the University of California Berkeley found that bug bounty programs are cheaper and more effective than hiring employees to do the same job.
Part of the reason for a bug bounty’s effectiveness is that you end
up with more people trying to poke holes in your system. But in the case
of Google, the researchers said that gamification plays a big role as
well. Google pays out rewards on a sliding scale depending on the
severity of the vulnerability and issues bonuses for particularly
important bugs. Google also doles out bigger rewards during contests
such as Pwnium and Pwn2Own, where hackers compete for prizes by finding
the fastest way to break into a PC using browser-based exploits.
The chance of higher rewards motivates people to keep searching for
bugs in the hopes of a large payoff down the road. “The larger the
potential prize amount,” the UC Berkeley researchers said, “The more
willing participants are to accept a lower expected return, which, for
VRPs (vulnerability reward programs), means the program can expect more
participants.”
Cash for computer vulnerabilities
To celebrate its $2 million milestone, Google is not doubling but quintupling
down on its bug-bounty investment. The company will now pay as much as
$5,000 for anyone who can find flaws in Chromium, the Google-directed
open source project on which the company’s Chrome browser is based. The
$5,000 maximum reward is up from the $1,000 the company was paying
previously.
Google’s Chromium bounty increase follows a similar increase in June for anyone who finds security flaws in the search giant’s online services, such as Gmail, YouTube, and Google Drive.
Google isn’t the only major company offering bug bounties. Other
major firms also hoping to harness the power of the crowd for security
reporting include AT&T, Facebook, PayPal, and Samsung. Even the
ever-secretive Microsoft is getting into the bug bounty game, announcing
in June that it would pay out rewards for exploits found in Windows 8.1 and Internet Explorer 11 for a limited time.
0 comments: