Google Ups Bug Bounty To $20,000 53
Posted
by
Unknown Lamer
from the security-through-cash dept.
from the security-through-cash dept.
Trailrunner7 writes, quoting Threatpost: "Search giant Google said it is quintupling the top bounty it will pay for information on security holes in its products to $20,000. Google said it was updating its rewards and rules for the bounty program, which is celebrating its first anniversary. In addition to a top prize of $20,000 for vulnerabilities that allow code to be executed on product systems, Google said it would pay $10,000 for SQL injection and equivalent vulnerabilities in its services and for certain vulnerabilities that leak information or allow attackers to bypass authentication or authorization features."
A failure of conventional hack-ism ? (Score:3, Interesting)
I am sure Google is employing many many very able programmers, but if Google has to pay bounty to hackers up to $20,000 to find bugs, does that mean the programmers who are sitting in Google's offices around the world have phailed?
Re:A failure of conventional hack-ism ? (Score:5, Interesting)
I am sure Google is employing many many very able programmers, but if Google has to pay bounty to hackers up to $20,000 to find bugs, does that mean the programmers who are sitting in Google's offices around the world have phailed?
Not necessarily. It just means that while they're confident in their code, they believe that it's always a good idea to have things vetted in the real world. The reasoning behind this is that the developers are often so close to the code that they can't possibly see EVERY conceivable bug or vulnerability. Inviting others to poke your products with a stick on a constant basis is a good thing. It lets Google get some good press, and also a MUCH more thorough real-world trial than they could do in house.
In a way, it's somewhat remniscent of the developers who worked on the flight software for the Space Shuttle computers [fastcompany.com]. Teams would actually compete to see who could find more bugs in the other team's code. This lead to some of the most robust and bug-free software ever written.
Re:A failure of conventional hack-ism ? (Score:4, Interesting)
I'd love to see a more vibrant market for this. The cost paid per bug (perhaps normalized by product revenue) would be a really useful measure of software reliability.
Re:A failure of conventional hack-ism ? (Score:5, Interesting)
What they're offering is still well below the $100,000 that a digital arms dealer like Vupen [forbes.com] charges for a year's subscription plan for exploits it discovers. And according to the Forbes article I linked to, some vulnerabilities individually cost several times more than that. It's so fucked up that NATO counties pay these security firms like Vupen, HB Gary Federal, etc. for exploits in the products of legitimate software companies for their use in cyberwarfare, espionage, and other nefarious shit. They'd rather leave everyone vulnerable, not even using the info they purchase to shore up their own government's systems lest the vulnerability become public and they lose the value of their purchase. If I were Google I'd save the bounty money and give it to their lawyers to create a tsunami of FOIA requests with every government they can to get the info about whatever exploits they have. Start a PR campaign letting the public know that their own government have knowledge that could help software companies make their products more secure for the computing public at large. Maybe if some influential people in the security field and tech firms complain loudly enough, something will change. I doubt it, but what hell else is there to do?
Re:A failure of conventional hack-ism ? (Score:4, Interesting)
This 20k figure has very little to do with programmer time.
It has a LOT more to do with googles size and customer base. When you look at just how much data google has, just how many customers (paying as well, with Google Apps) 20k is absoloute pocket change to possibly convince someone malicious to instead fix the problem than exploit it.