Microsoft Doubles Bounty Payouts
Monday, 10 August 2015

Microsoft has announced an increase for its Bounty for Defense program from $50K to $100K and an expansion of its Online Services Bug Bounty program, including and a bonus period during which some authentication vulnerabilities will receive double bounty payouts.

According to Jason Shirk in his announcement on TechNet raising the Bounty for Defense: 

  • Brings defense up on par with offense
  • Rewards the novel defender equally for their research


msbugbountyshield

To clarify, Microsoft has offered rewards up to $100,000 for novel remote code execution vulnerabilities since it introduced its Mitigation Bypass Bounty in June 2013. It also offered an additional Bonus for Defence for submitting a report that described how to block such exploitation techniques. which was set at $50,000.  

Now the two rewards have been decoupled and researchers who submit defensive techniques to Microsoft can be eligible for a bounty up to $100,000. As before all bounties will be paid out at Mirosoft's discretion.

Other news in the announcement, which was timed to coincide with Black Hat 2015, the annual gathering of the security research community, was the extension of the Microsoft Online Services Bug Bounty program, originally launched in September 2014, to include Microsoft Account. To give further impetus to researchers to hunt out authentication vulnerabilities, for the next three months, until October 5, 2015, qualified submissions will be eligible for double bounties to a maximum of $30,000 USD.

The three Microsoft Account domains that are eligible for this are:  

  • login.windows.net
  • login.microsoftonline.com
  • login.live.com 

and the types of vulnerability that will qualify include:

Eligible submissions will include vulnerabilities of the following types: 

  • Cross Site Scripting (XSS)
  • Cross Site Request Forgery (CSRF)
  • Unauthorized cross-tenant data tampering or access (for multi-tenant services)
  • Insecure direct object references
  • Injection Vulnerabilities
  • Authentication Vulnerabilities
  • Server-side Code Execution
  • Privilege Escalation
  • Significant Security Misconfiguration (when not caused by user) 

In addition, Remote App, which lets users run Windows apps hosted in Azure anywhere, and on a variety of devices is being added as a new property of the Online Services Bug Bounty Program.

 

 msbugbountyshield

Banner


Chainguard Joins Docker Verified Publisher Program
15/03/2024

Chainguard has joined the Docker Verified Publisher (DVP) program, meaning its Chainguard Developer Images are now officially available on Docker's container image registry.



Running PostgreSQL Inside Your Browser With PGLite
18/03/2024

Thanks to WebAssembly we can now enjoy PostgreSQL inside the browser so that we can build reactive, realtime, local-first apps directly on Postgres. PGLite is about to make this even easier.


More News

 

raspberry pi books

 

Comments




or email your comment to: comments@i-programmer.info

Last Updated ( Tuesday, 04 October 2016 )