Story image

$250,000 up for grabs in Microsoft's latest Windows Bounty Program

31 Jul 2017

Microsoft is offering up to US$250,000 (NZ$332,668/AU$313,047) in a new bug bounty program focused exclusively on ironing out the kinks in Windows 10. This time there’s a bigger payout for the Hyper-V bounty.

Last week the company launched the Windows Bounty Program, which includes all aspects of the Windows Insider Preview, as well as Hyper-V, Mitigation bypass, Windows Defender Application Guard and Microsoft Edge.

Microsoft says the program is ‘in the spirit of maintaining a high security bar in Windows’, and complements the company’s long list of defence technologies such as DEP, ASLR, CFC, CIG, ACG, Device Guard, Credential Guard and Windows Defender Application Guard.

The new bug bounty program aims to catch any critical or important remote code execution (RCE), privilege elevation or design flaws that compromise users’ security and privacy.’

However, if anyone discovers a vulnerability that Microsoft has already found, the bounty equated to 10% of the highest amount they could have received. In the case of a Hyper-V bounty ($US250,000), researchers would receive a payout of $25,000 if they found a RCE.

Microsoft has conducted several bounties since 2013, which reflects the changing nature of vulnerabilities and priorities in different points in time.

“Microsoft strongly believes in the value of the bug bounties, and we trust that it serves to enhance our security capabilities,” the company says.

There are also outstanding bounty programs for .NET and cloud applications, worth up to US$15,000 (NZ$19,960/AU$18,782).

Microsoft says that all security bugs are important, and users should report those bugs to secure@microsoft.com via Coordinated Vulnerability Disclosure (CVD) policy.

Interested researchers can also check out Bugcrowd’s list of current bug bounty programs from platforms such as Atlassian, Avira, Centrify, Cylance, HubSpot and 1Password.

However, bug bounty programs may not be alluring enough for some – recent reports suggest that Google’s bug bounties are not doing so well. Earlier this year the company’s Project Zero hacking contest failed to reward a single prize, despite rewards of up to US$200,000.

In the contest, there were no valid entries or bugs - instead there was just spam and entries that did not resemble what the company was after. Read more here. 

Microsoft’s bug bounty categories are below.

On the road again: How to tackle mileage reporting for business
There may not be too much of a budget for company vehicles in an SMB’s day-to-day business, which means many people are increasingly using their own vehicles for work purposes.
Digital experience managers, get excited for Adobe Summit 2019
“Digital transformation may be a buzzword, but companies are trying to adapt and compete in this changing environment.”
HP extends laptop & workstation recall due to battery fire hazard
HP has extended its worldwide recall of several notebooks and mobile workstations due to the high risk of fire and burn hazards.
Privacy Bill may limit breach fines to $10,000
The Privacy Commissioner was seeking maximum breach fines of up to $1 million against body corporates.
Kathmandu breached, customer information accessed
Kathmandu is notifying potentially affected customers directly and has advised them to change their passwords for its online loyalty programme.
Was Citrix unaware of its own data breach until the FBI got involved?
According to a blog post from Citrix’s CSIO Stan Black, the FBI contacted Citrix on March 6 and advised that international cybercriminals had allegedly gained access to Citrix’s internal network.
How businesses can transform their customer experience in a realistic and timely way
“Businesses can’t simply decide to transform one day, then jump straight into making change for change’s sake."
Gartner: Marketing personalisation can be make or break
A Gartner survey shows brands risk losing 38% of customers because of poor marketing personalisation efforts.