Microsoft Doubles Bounty Payouts
Monday, 10 August 2015

Microsoft has announced an increase for its Bounty for Defense program from $50K to $100K and an expansion of its Online Services Bug Bounty program, including and a bonus period during which some authentication vulnerabilities will receive double bounty payouts.

According to Jason Shirk in his announcement on TechNet raising the Bounty for Defense: 

  • Brings defense up on par with offense
  • Rewards the novel defender equally for their research


To clarify, Microsoft has offered rewards up to $100,000 for novel remote code execution vulnerabilities since it introduced its Mitigation Bypass Bounty in June 2013. It also offered an additional Bonus for Defence for submitting a report that described how to block such exploitation techniques. which was set at $50,000.  

Now the two rewards have been decoupled and researchers who submit defensive techniques to Microsoft can be eligible for a bounty up to $100,000. As before all bounties will be paid out at Mirosoft's discretion.

Other news in the announcement, which was timed to coincide with Black Hat 2015, the annual gathering of the security research community, was the extension of the Microsoft Online Services Bug Bounty program, originally launched in September 2014, to include Microsoft Account. To give further impetus to researchers to hunt out authentication vulnerabilities, for the next three months, until October 5, 2015, qualified submissions will be eligible for double bounties to a maximum of $30,000 USD.

The three Microsoft Account domains that are eligible for this are:  


and the types of vulnerability that will qualify include:

Eligible submissions will include vulnerabilities of the following types: 

  • Cross Site Scripting (XSS)
  • Cross Site Request Forgery (CSRF)
  • Unauthorized cross-tenant data tampering or access (for multi-tenant services)
  • Insecure direct object references
  • Injection Vulnerabilities
  • Authentication Vulnerabilities
  • Server-side Code Execution
  • Privilege Escalation
  • Significant Security Misconfiguration (when not caused by user) 

In addition, Remote App, which lets users run Windows apps hosted in Azure anywhere, and on a variety of devices is being added as a new property of the Online Services Bug Bounty Program.




Grafana Adds New Tools

Grafana Labs has announced new tools to make it easier to analyze application data on Grafana Cloud. The announcements are an Application Observability tool for Grafana Cloud, and Grafana Beyla, the e [ ... ]

Amazon Working On Olympus LLM

According to Reuters, Amazon is working on a large language model (LLM), codenamed "Olympus". With, reportedly, 2 trillion parameters, it is twice the size of OpenAI's GPT-4 model.

More News





or email your comment to:

Last Updated ( Tuesday, 04 October 2016 )